ephores/superphish

Script to silently intercept SSL on computers infected with Superfish malware

Superphish

Peter Hortensius, Lenovo CTO, in an interview with Wall Street Journal:

"We’re not trying to get into an argument with the security guys. They’re dealing with theoretical concerns."

This script will silently intercept SSL connections made from computers infected with Superfish malware on the local network. All traffic will be logged into 'superphish.log'. Works in three stages:

• Activates packet forwarding
• ARP poisoning
• SSL interception with Superfish CA keys

To target all clients on network:

./superphish.sh interface gateway-ip

Specific target:

./superphish.sh interface gateway-ip target-ip

Needed dependecies will be installed automatically at first run.

Thanks to:

• Robbert Graham for the Superfish certificate
• Moxie for sslniff