{"id":551,"date":"2015-08-03T00:35:34","date_gmt":"2015-08-03T00:35:34","guid":{"rendered":"https:\/\/hhardsoft.wordpress.com\/?p=551"},"modified":"2015-08-03T00:35:34","modified_gmt":"2015-08-03T00:35:34","slug":"evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales","status":"publish","type":"post","link":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/","title":{"rendered":"Evadiendo protocolo HTTPS y HSTS, Google Chrome, Mozilla Firefox, Etc. Robo de credenciales."},"content":{"rendered":"

Hoy os presento un ataque Man In The Middle (MITM)<\/a><\/em><\/strong>, utilizando la herramienta NMAP<\/a><\/strong><\/em>, y el software Man In The Middle Framework<\/a><\/em><\/strong>, una vez explicado lo que voy hacer, lo siguiente que voy a explicar son los protocolos que voy a evadir haciendo este ataque MITM<\/a><\/em>. <\/a>\"\u00edndice\"<\/a><\/strong><\/p>\n

\u00bfQu\u00e9 es el protocolo HTTPS<\/strong><\/em>?<\/p>\n

Seg\u00fan Wikipedia:<\/p>\n

Hypertext Transfer Protocol Secure (en espa\u00f1ol: Protocolo seguro de transferencia de hipertexto), m\u00e1s conocido por sus siglas HTTPS, es un protocolo de aplicaci\u00f3n basado en el protocolo HTTP, destinado a la transferencia segura de datos de Hipertexto, es decir, es la versi\u00f3n segura de HTTP.<\/p>\n

\u00bfQu\u00e9 es el protocolo HSTS<\/em><\/strong>?<\/p>\n

Seg\u00fan Wikipedia:<\/p>\n

HTTP Strict Transport Security (o Seguridad de transporte HTTP estricta) (HSTS) es un mecanismo de pol\u00edtica de seguridad web seg\u00fan la cual un servidor web declara a los agentes de usuario compatibles (por ejemplo, un navegador web) que deben interactuar con ellos solamente mediante conexiones HTTP seguras (es decir, en capas HTTP sobre TLS\/SSLnotas 1 ). HSTS es un protocolo de normas de IETF y se especifica en el RFC 6797. La pol\u00edtica HSTS1 es comunicada por el servidor al agente de usuario a trav\u00e9s de un campo de la cabecera HTTP de respuesta denominado “Strict-Transport-Security”. La pol\u00edtica HSTS especifica un per\u00edodo de tiempo durante el cual el agente de usuario deber\u00e1 acceder al servidor s\u00f3lo en forma segura.<\/p>\n

Bueno una vez explicado los protocolos que queremos saltarnos, empezar\u00e9 a explicar como hacerlo, comenzamos haciendo un escaneo de todos los nodos UP de la red.<\/p>\n

Informaci\u00f3n de nuestra m\u00e1quina conectada a la red con Kali Linux, para determinar como es la red en la que estamos:<\/p>\n

\"Screenshot_7\"<\/a><\/p>\n

Escaneamos la red con NMAP para ver que nodos estan UP:<\/p>\n

\"Screenshot_1\"<\/a><\/p>\n

\n

nmap -sP “192.168.1.0\/24”<\/p>\n<\/blockquote>\n

-sP: Sondeo ping, Determina que equipos hay en la red haciendo ping y para saber si estan operativos.<\/p>\n

( Este comando nos sirve para ver que equipos en la red en la que estamos conectados estan operativos)<\/p>\n

\"Screenshot_2\"<\/a><\/p>\n

En este caso detecto un posible router, m\u00e1s adelante determinaremos si realmente es un router pero ser\u00e1 lo m\u00e1s probable.<\/p>\n

\"Screenshot_3\"<\/a>Lo siguiente que encontramos es una posible v\u00edctima, en este caso esta ser\u00e1 nuestra v\u00edctima.<\/p>\n

El siguiente paso es saber que puertos y que servicios corren cada uno de los nodos para determinar quien es el router y que equipo nos interesa atacar, esto lo haremos de la siguiente manera:<\/p>\n

\"Screenshot_4\"<\/a><\/p>\n

\n

nmap -sV “192.168.1.0\/24”<\/p>\n<\/blockquote>\n

-sV: Sondear puertos, para obtener la informaci\u00f3n del servicio y la versi\u00f3n instalada.<\/p>\n

(Esto se utiliza para escanear los equipos de la red y sus puertos, y tambi\u00e9n para saber que servicios tienen)<\/p>\n

Resultados:<\/p>\n

\"Screenshot_5\"<\/a>Los resultados son claros este nodo presenta servicios que suele tener un router abiertos, tambi\u00e9n acompa\u00f1a el nombre, ya que la compa\u00f1ia orange instala estos routers.<\/p>\n

\"Screenshot_6\"Los resultados que se nos presentan en el siguiente nodo son, que utiliza skype, y que es un ordenador con el SO Windows y que utiliza una placa base o una tarjeta de red de ASRock. Este equipo ser\u00e1 nuestro equipo v\u00edctima.<\/p>\n

Con esto determinamos cual va a ser el objetivo atacado y cual es la puerta de enlace de la red, con el fin de hacer un Man In The Middle (MITM)<\/a><\/em><\/strong>.<\/p>\n

Equipo atacado: 192.168.1.108<\/p>\n

Puerta de enlace: 192.168.1.1<\/p>\n

Comenzamos a utilizar Man In The Middle Framework<\/a><\/em><\/strong>:<\/p>\n

Abrimos Kali Linux, abrimos una consola y comenzamos con el comando para inicializar la evasi\u00f3n de estos protocolos y obtener credenciales:<\/p>\n

\n

mitmf –hsts –spoof –arp -i eth0 –target 192.168.1.108 –gateway 192.168.1.1<\/p>\n<\/blockquote>\n

\"Screenshot_8\"<\/a><\/p>\n

–hsts: Ejecuta el script SSLstrip+ para el bypass del protocolo HSTS. Es decir burlar el protocolo HTTPS y HSTS, asi obteniendo todas las credenciales en texto plano y pudiendo snifarlas.<\/p>\n

–spoof: Ejecuta el plugin de spoofing para hacernos pasar por el router.<\/p>\n

–arp: Usamos esto para redirigir el tr\u00e1fico del atacado hacia nuestra m\u00e1quina y dirigirla al router mediante ARP Spoofing.<\/p>\n

-i ( ): Especificar que interfaz vamos a utilizar.<\/p>\n

–target: Se coloca la IP de la v\u00edctima.<\/p>\n

–gateway: Se coloca la IP del router.<\/p>\n

Antes de iniciar este comando vemos como ingreso en www.gmail.com y este tiene https:<\/p>\n

\"Screenshot_9\"<\/a><\/p>\n

 <\/p>\n

Ahora iniciaremos el comando antes mencionado para vurlar estos protocolos:<\/p>\n

\"Screenshot_10\"<\/a><\/p>\n

Como podemos ver ahora al ingresar en www.gmail.com este inicia sin el protocolo https:<\/p>\n

\"Screenshot_11\"<\/a><\/p>\n

 <\/p>\n

Ahora ingresaremos las credenciales para ver como tambi\u00e9n las obtenemos:<\/p>\n

\"Screenshot_12\"<\/a>Una vez iniciamos sesi\u00f3n nos iremos a Kali Linux y abriremos la terminal que dejamos con el comando lanzado anteriormente y encontraremos algo parecedio a esto, con las credenciales en texto plano:<\/p>\n

\"Screenshot_13\"<\/a>como podemos ver estos son los datos extraidos es decir las credenciales ( %40 = @):<\/p>\n

Email: hhardsoft@gmail.com<\/p>\n

Password: prueba1<\/p>\n

 <\/p>\n

Todo este proceso es simplemente educativo y para descubrir m\u00e1s sobre el mundo de la seguridad inform\u00e1tica, cada vez que aprenda algo lo subir\u00e9 tan r\u00e1pido como pueda para compartirlo con todos.<\/p>\n

Todo el proceso y las im\u00e1genes han sido comprobadas, y capturadas por mi.<\/p>\n

Saludos, David De Maya Merras, @DavidDeMaya<\/p>\n","protected":false},"excerpt":{"rendered":"

Hoy os presento un ataque Man In The Middle (MITM), utilizando la herramienta NMAP, y el software Man In The Middle Framework, una vez explicado lo que voy hacer, lo …<\/p>\n","protected":false},"author":1,"featured_media":552,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[3,7],"tags":[32,36,39],"class_list":["post-551","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guias","category-seguridad-informatica","tag-kali-linux","tag-mitm","tag-nmap"],"yoast_head":"\nEvadiendo protocolo HTTPS y HSTS, Google Chrome, Mozilla Firefox, Etc. Robo de credenciales. - Hardsoft Security<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Evadiendo protocolo HTTPS y HSTS, Google Chrome, Mozilla Firefox, Etc. Robo de credenciales. - Hardsoft Security\" \/>\n<meta property=\"og:description\" content=\"Hoy os presento un ataque Man In The Middle (MITM), utilizando la herramienta NMAP, y el software Man In The Middle Framework, una vez explicado lo que voy hacer, lo ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/\" \/>\n<meta property=\"og:site_name\" content=\"Hardsoft Security\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/HardSoftDavid\" \/>\n<meta property=\"article:published_time\" content=\"2015-08-03T00:35:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/08\/c3adndice.jpg?fit=301%2C167&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"301\" \/>\n\t<meta property=\"og:image:height\" content=\"167\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"david\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:site\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"david\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/\"},\"author\":{\"name\":\"david\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"headline\":\"Evadiendo protocolo HTTPS y HSTS, Google Chrome, Mozilla Firefox, Etc. Robo de credenciales.\",\"datePublished\":\"2015-08-03T00:35:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/\"},\"wordCount\":853,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2015\\\/08\\\/c3adndice.jpg?fit=301%2C167&ssl=1\",\"keywords\":[\"Kali Linux\",\"MITM\",\"nmap\"],\"articleSection\":[\"Gu\u00edas\",\"Seguridad inform\u00e1tica\"],\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/\",\"name\":\"Evadiendo protocolo HTTPS y HSTS, Google Chrome, Mozilla Firefox, Etc. Robo de credenciales. - Hardsoft Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2015\\\/08\\\/c3adndice.jpg?fit=301%2C167&ssl=1\",\"datePublished\":\"2015-08-03T00:35:34+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2015\\\/08\\\/c3adndice.jpg?fit=301%2C167&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2015\\\/08\\\/c3adndice.jpg?fit=301%2C167&ssl=1\",\"width\":301,\"height\":167},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2015\\\/08\\\/03\\\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Evadiendo protocolo HTTPS y HSTS, Google Chrome, Mozilla Firefox, Etc. Robo de credenciales.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\",\"name\":\"Hardsoft Security\",\"description\":\"Chasing (In)Security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hardsoftsecurity.es\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\",\"name\":\"david\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"caption\":\"david\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Evadiendo protocolo HTTPS y HSTS, Google Chrome, Mozilla Firefox, Etc. Robo de credenciales. - Hardsoft Security","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/","og_locale":"es_ES","og_type":"article","og_title":"Evadiendo protocolo HTTPS y HSTS, Google Chrome, Mozilla Firefox, Etc. Robo de credenciales. - Hardsoft Security","og_description":"Hoy os presento un ataque Man In The Middle (MITM), utilizando la herramienta NMAP, y el software Man In The Middle Framework, una vez explicado lo que voy hacer, lo ...","og_url":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/","og_site_name":"Hardsoft Security","article_publisher":"https:\/\/www.facebook.com\/HardSoftDavid","article_published_time":"2015-08-03T00:35:34+00:00","og_image":[{"width":301,"height":167,"url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/08\/c3adndice.jpg?fit=301%2C167&ssl=1","type":"image\/jpeg"}],"author":"david","twitter_card":"summary_large_image","twitter_creator":"@DavidDeMaya","twitter_site":"@DavidDeMaya","twitter_misc":{"Escrito por":"david","Tiempo de lectura":"4 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/#article","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/"},"author":{"name":"david","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"headline":"Evadiendo protocolo HTTPS y HSTS, Google Chrome, Mozilla Firefox, Etc. Robo de credenciales.","datePublished":"2015-08-03T00:35:34+00:00","mainEntityOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/"},"wordCount":853,"commentCount":0,"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/08\/c3adndice.jpg?fit=301%2C167&ssl=1","keywords":["Kali Linux","MITM","nmap"],"articleSection":["Gu\u00edas","Seguridad inform\u00e1tica"],"inLanguage":"es","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/","url":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/","name":"Evadiendo protocolo HTTPS y HSTS, Google Chrome, Mozilla Firefox, Etc. Robo de credenciales. - Hardsoft Security","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/#primaryimage"},"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/08\/c3adndice.jpg?fit=301%2C167&ssl=1","datePublished":"2015-08-03T00:35:34+00:00","author":{"@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"breadcrumb":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/#primaryimage","url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/08\/c3adndice.jpg?fit=301%2C167&ssl=1","contentUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/08\/c3adndice.jpg?fit=301%2C167&ssl=1","width":301,"height":167},{"@type":"BreadcrumbList","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/evadiendo-protocolo-https-y-hsts-google-chrome-mozilla-firefox-etc-robo-de-credenciales\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/hardsoftsecurity.es\/"},{"@type":"ListItem","position":2,"name":"Evadiendo protocolo HTTPS y HSTS, Google Chrome, Mozilla Firefox, Etc. Robo de credenciales."}]},{"@type":"WebSite","@id":"https:\/\/hardsoftsecurity.es\/#website","url":"https:\/\/hardsoftsecurity.es\/","name":"Hardsoft Security","description":"Chasing (In)Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hardsoftsecurity.es\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Person","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a","name":"david","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","caption":"david"}}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7xGFx-8T","jetpack-related-posts":[{"id":1028,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2016\/09\/13\/realizar-ataque-mitm-con-evil-foca-ataque-mitm-ipv6-slaac\/","url_meta":{"origin":551,"position":0},"title":"Realizar Ataque MITM Con Evil Foca. Ataque MITM IPv6 SLAAC.","author":"david","date":"septiembre 13, 2016","format":false,"excerpt":"Hola a todos de nuevo, hoy os traigo un v\u00eddeo de como realizar un ataque MITM con evil foca, para la pila de protocolos IPv6, el fin de este ataque es conseguir contrase\u00f1as o toda la informaci\u00f3n que transcurra por la red en texto plano generado por la v\u00edctima. Aqu\u00ed\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/09\/owasp-man_in_the_middle.jpg?fit=569%2C316&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/09\/owasp-man_in_the_middle.jpg?fit=569%2C316&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/09\/owasp-man_in_the_middle.jpg?fit=569%2C316&ssl=1&resize=525%2C300 1.5x"},"classes":[]},{"id":51,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2014\/10\/02\/que-es-el-sniffing\/","url_meta":{"origin":551,"position":1},"title":"\u00bfQu\u00e9 es el Sniffing? Ataque MITM.","author":"david","date":"octubre 2, 2014","format":false,"excerpt":"\u00bfQu\u00e9 es el Sniffing?, Ataque MITM. \u00bfQu\u00e9 es el Sniffing?, Ataque MITM. El Sniffing, es una t\u00e9cnica utilizada para escuchar todo lo que ocurre dentro de una red, esto se suele hacer en redes internas o de intranet, pero tambi\u00e9n se llega a ver en internet. Todo esto se consigue\u2026","rel":"","context":"En \u00abSeguridad inform\u00e1tica\u00bb","block_context":{"text":"Seguridad inform\u00e1tica","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/seguridad-informatica\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2014\/10\/5-hackers-famosos-que-debes-conocer.jpg?fit=640%2C364&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2014\/10\/5-hackers-famosos-que-debes-conocer.jpg?fit=640%2C364&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2014\/10\/5-hackers-famosos-que-debes-conocer.jpg?fit=640%2C364&ssl=1&resize=525%2C300 1.5x"},"classes":[]},{"id":1071,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2016\/12\/17\/hacking-basico-leccion-1-realizar-mitm\/","url_meta":{"origin":551,"position":2},"title":"COMO hacer un MITM – Hacking B\u00e1sico Lecci\u00f3n #1","author":"david","date":"diciembre 17, 2016","format":false,"excerpt":"Hola a todos hoy vengo a presentar la primera lecci\u00f3n de una serie de v\u00eddeos relacionados con el Hacking B\u00e1sico y fundamental, en este peque\u00f1o v\u00eddeo muestro como realizar un mitm con exito. Aqu\u00ed adjunto el primer v\u00eddeo: Hacking B\u00e1sico Lecci\u00f3n 1. Realizar MITM. \u00a0 \u00a0 \u00a0 Gracias por leer\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/09\/owasp-man_in_the_middle.jpg?fit=569%2C316&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/09\/owasp-man_in_the_middle.jpg?fit=569%2C316&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/09\/owasp-man_in_the_middle.jpg?fit=569%2C316&ssl=1&resize=525%2C300 1.5x"},"classes":[]},{"id":57,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2014\/10\/03\/prueba-de-sniffeo-de-la-red-burlando-el-protocolo-https\/","url_meta":{"origin":551,"position":3},"title":"Prueba de Sniffeo de la red, burlando el protocolo HTTPS.","author":"david","date":"octubre 3, 2014","format":false,"excerpt":"\u00bfEn que se basa la prueba? En esta prueba se procede al Sniffeo de la red, espec\u00edficamente para burlar el protocolo https, lo que se har\u00e1 en esta prueba sera hacer un ataque man in the midle, para as\u00ed interceptar todas las peticiones del \"cliente\" hacia los servidores que est\u00e1n\u2026","rel":"","context":"En \u00abSeguridad inform\u00e1tica\u00bb","block_context":{"text":"Seguridad inform\u00e1tica","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/seguridad-informatica\/"},"img":{"alt_text":"Network-Sniffing1","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2014\/10\/network-sniffing1.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":1507,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2018\/05\/22\/fuerza-bruta-a-ftp-con-nmap-y-proxychains\/","url_meta":{"origin":551,"position":4},"title":"Fuerza bruta a FTP con NMAP y ProxyChains.","author":"david","date":"mayo 22, 2018","format":false,"excerpt":"Hola buenos d\u00edas a todos, hoy os traigo una gu\u00eda bastante interesante, la cual utilizo las herramientas NMAP y ProxyChains... Para los m\u00e1s experimentados, ya sabr\u00e1n para que sirven las dos herramientas anteriormente mencionadas, pero para los m\u00e1s novatos, vamos a realizar una peque\u00f1a aclaraci\u00f3n\/definici\u00f3n de que son estas herramientas,\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/05\/pentesting_logo.png?fit=634%2C309&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/05\/pentesting_logo.png?fit=634%2C309&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/05\/pentesting_logo.png?fit=634%2C309&ssl=1&resize=525%2C300 1.5x"},"classes":[]},{"id":568,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/08\/03\/resumen-de-opciones-de-nmap\/","url_meta":{"origin":551,"position":5},"title":"Resumen de opciones de NMAP.","author":"david","date":"agosto 3, 2015","format":false,"excerpt":"Cuando se ejecuta Nmap sin par\u00e1metros se muestra este resumen de opciones. Puede encontrar siempre la \u00faltima versi\u00f3n en http:\/\/www.insecure.org\/nmap\/data\/nmap.usage.txt. Aunque ayuda a recordar las opciones m\u00e1s habituales no es un sustituto de la documentaci\u00f3n en detalle que acompa\u00f1a al resto de este manual. Algunas de las opciones menos conocidas\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2014\/12\/nmap-project-logo.png?fit=1200%2C640&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2014\/12\/nmap-project-logo.png?fit=1200%2C640&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2014\/12\/nmap-project-logo.png?fit=1200%2C640&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2014\/12\/nmap-project-logo.png?fit=1200%2C640&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2014\/12\/nmap-project-logo.png?fit=1200%2C640&ssl=1&resize=1050%2C600 3x"},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/08\/c3adndice.jpg?fit=301%2C167&ssl=1","_links":{"self":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/551","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/comments?post=551"}],"version-history":[{"count":0,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/551\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media\/552"}],"wp:attachment":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media?parent=551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/categories?post=551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/tags?post=551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}