Dsniff - Revision history

Unknown user: /* References */

2022-03-05T20:20:32Z

References

← Older revision		Revision as of 20:20, 5 March 2022
Line 77:		Line 77:
	=References=		=References=

	~~https://www.monkey.org/~dugsong/dsniff/~~		==Software==

			original: https://www.monkey.org/~dugsong/dsniff/

			working Mac version: https://github.com/ggreer/dsniff


			==Information and Guides==

	[[Dsniff/PlasticForkGuide_HackBB]]		[[Dsniff/PlasticForkGuide_HackBB]]

Unknown user: /* Dsniff Suite of Tools */

2022-03-05T20:17:52Z

Dsniff Suite of Tools

← Older revision		Revision as of 20:17, 5 March 2022
Line 60:		Line 60:
	* [[Tcpkill]] – kills specified in-progress TCP connections.		* [[Tcpkill]] – kills specified in-progress TCP connections.
	* [[Tcpnice]] – slow down specified TCP connections via “active” traffic shaping.		* [[Tcpnice]] – slow down specified TCP connections via “active” traffic shaping.
	* [[Urlsnarf]]
	* [[Webmitm]] - HTTP / HTTPS monkey-in-the-middle. transparently proxies.		* [[Webmitm]] - HTTP / HTTPS monkey-in-the-middle. transparently proxies.

Unknown user: /* Dsniff Suite of Tools */

2022-03-05T20:17:29Z

Dsniff Suite of Tools

← Older revision		Revision as of 20:17, 5 March 2022
Line 43:		Line 43:
	==Dsniff Suite of Tools==		==Dsniff Suite of Tools==

	dsniff ~~can be used with~~ other ~~analysis~~ tools ~~to extract particular types of content from the traffic stream~~:		dsniff sniffs for passwords, but there are other tools for sniffing other goodies:

	* filesnarf - saves selected files sniffed from NFS traffic.		* filesnarf - saves selected files sniffed from NFS traffic.

Unknown user: /* What is dsniff? */

2022-03-05T20:16:58Z

What is dsniff?

← Older revision		Revision as of 20:16, 5 March 2022
Line 3:		Line 3:
	==What is dsniff?==		==What is dsniff?==

	~~dsniffi s~~ a tool for sniffing plaintext ~~traffic and extracting "goodies" from the~~ traffic. ~~There is an entire~~ suite of sniffing/snarfing tools that ~~are designed to~~ work ~~with~~ dsniff to extract ~~various~~ types of information (~~passwords,~~ images, emails, URLs, etc.).		dsniff is a tool for sniffing passwords from plaintext traffic. It comes as part of a suite of sniffing/snarfing tools that work like dsniff but extract other types of information (images, emails, URLs, etc.).

	~~dsniff can only sniff plaintext traffic, not encrypted traffic. That means that as SSL-protected communications have become much more common in modern browsers, websites, and networks in~~ the ~~past 15 years, the usefulness of dsniff on its own has diminished.~~		From the original readme:

	But ~~because~~ SSL will never be implemented everywhere, and ~~because~~ SSL itself has weaknesses~~, there~~ are other tools to attack and remove the SSL layer, which makes communications vulnerable to dsniff.		<pre>
			dsniff
			password sniffer. handles FTP, Telnet, SMTP, HTTP, POP,
			poppass, NNTP, IMAP, SNMP, LDAP, Rlogin, RIP, OSPF, PPTP
			MS-CHAP, NFS, VRRP, YP/NIS, SOCKS, X11, CVS, IRC, AIM, ICQ,
			Napster, PostgreSQL, Meeting Maker, Citrix ICA, Symantec
			pcAnywhere, NAI Sniffer, Microsoft SMB, Oracle SQL*Net, Sybase
			and Microsoft SQL auth info.

			dsniff automatically detects and minimally parses each
			application protocol, only saving the interesting bits, and
			uses Berkeley DB as its output file format, only logging
			unique authentication attempts. full TCP/IP reassembly is
			provided by libnids(3) (likewise for the following tools as
			well).
			</pre>

			dsniff can only sniff plaintext traffic, not encrypted traffic. As SSL-protected communications have become cheaper and more common everywhere (modern browsers, websites, networks, backend communication) in the past 15 years, the usefulness of dsniff on its own has diminished.

			But SSL will never be implemented everywhere, and SSL itself has weaknesses. There are other tools to attack and remove the SSL layer, which makes communications vulnerable to dsniff.

	==How to use dsniff?==		==How to use dsniff?==

Unknown user: /* References */

2022-03-05T20:13:54Z

References

← Older revision		Revision as of 20:13, 5 March 2022
Line 58:		Line 58:

	=References=		=References=

			https://www.monkey.org/~dugsong/dsniff/



	[[Dsniff/PlasticForkGuide_HackBB]]		[[Dsniff/PlasticForkGuide_HackBB]]

Unknown user: /* Tools */

2022-03-05T20:12:22Z

Tools

← Older revision		Revision as of 20:12, 5 March 2022
Line 23:		Line 23:

	==Dsniff Suite of Tools==		==Dsniff Suite of Tools==

	~~dsniff can be used with other analysis tools to extract particular types of content from the traffic stream:~~

	~~==Other Dsniff Suite Tools==~~

	dsniff can be used with other analysis tools to extract particular types of content from the traffic stream:		dsniff can be used with other analysis tools to extract particular types of content from the traffic stream:

Unknown user: /* DSniff Suite of Tools */

2022-03-05T20:12:02Z

DSniff Suite of Tools

← Older revision		Revision as of 20:12, 5 March 2022
Line 22:		Line 22:
	=Tools=		=Tools=

	==~~DSniff~~ Suite of Tools==		==Dsniff Suite of Tools==

	dsniff can be used with other analysis tools to extract particular types of content from the traffic stream:		dsniff can be used with other analysis tools to extract particular types of content from the traffic stream:


	==Other Dsniff Suite Tools==		==Other Dsniff Suite Tools==

Unknown user: /* Other Dsniff Suite Tools */

2022-03-05T20:00:04Z

Other Dsniff Suite Tools

← Older revision		Revision as of 20:00, 5 March 2022
Line 31:		Line 31:
	dsniff can be used with other analysis tools to extract particular types of content from the traffic stream:		dsniff can be used with other analysis tools to extract particular types of content from the traffic stream:

	* ~~[[Filesnarf]]~~ - saves selected files sniffed from NFS traffic.		* filesnarf - saves selected files sniffed from NFS traffic.
	* ~~[[Msgsnarf]]~~ – record selected messages from different Instant Messengers.		* msgsnarf – record selected messages from different Instant Messengers.
	* ~~[[Mailsnarf]]~~ – sniffs mail on the LAN and stores it in mbox format.		* mailsnarf – sniffs mail on the LAN and stores it in mbox format.
	* ~~[[Urlsnarf]]~~ – output selected URLs sniffed from HTTP traffic		* urlsnarf – output selected URLs sniffed from HTTP traffic
	* ~~[[Webspy]]~~ – sends URLs sniffed from a client to your local browser		* webspy – sends URLs sniffed from a client to your local browser

	additionally, dsniff comes with other tools that can be used to carry out a MITM attack in order to use dsniff:		additionally, dsniff comes with other tools that can be used to carry out a MITM attack in order to use dsniff:

Unknown user: /* Tools */

2022-03-05T19:39:39Z

Tools

← Older revision		Revision as of 19:39, 5 March 2022
Line 21:		Line 21:

	=Tools=		=Tools=

			==DSniff Suite of Tools==

			dsniff can be used with other analysis tools to extract particular types of content from the traffic stream:


	==Other Dsniff Suite Tools==		==Other Dsniff Suite Tools==
Line 26:		Line 31:
	dsniff can be used with other analysis tools to extract particular types of content from the traffic stream:		dsniff can be used with other analysis tools to extract particular types of content from the traffic stream:

	* [[~~Msgsnarf~~]]		* [[Filesnarf]] - saves selected files sniffed from NFS traffic.
	* [[~~Filensarf~~]]		* [[Msgsnarf]] – record selected messages from different Instant Messengers.
	* [[Mailsnarf]]		* [[Mailsnarf]] – sniffs mail on the LAN and stores it in mbox format.
	* [[Urlsnarf]]		* [[Urlsnarf]] – output selected URLs sniffed from HTTP traffic
	* [[Webspy]]		* [[Webspy]] – sends URLs sniffed from a client to your local browser

	~~==Combo Attacks==~~		additionally, dsniff comes with other tools that can be used to carry out a MITM attack in order to use dsniff:

	~~dsniff attacks require a~~ [[~~MITM~~]] ~~attack tool, such as:~~		* [[Arpspoof]] – Send out unrequested (and possibly forged) arp replies.
			* [[Dnsspoof]] – forge replies to arbitrary DNS address / pointer queries on the Local Area Network.
	* [[~~Ettercap~~]] / ~~[[Bettercap]]~~		* [[Macof]] - flood the local network with random MAC addresses.
	* [[~~Dnsspoof~~]]		* [[Sshmitm]] – SSH monkey-in-the-middle. proxies and sniffs SSH traffic.
	* [[~~Arpspoof~~]]		* [[Sshow]] – SSH traffic analyser.
	* [[~~Macof~~]]		* [[Tcpkill]] – kills specified in-progress TCP connections.
	* [[Tcpkill]]		* [[Tcpnice]] – slow down specified TCP connections via “active” traffic shaping.
	* [[Tcpnice]]		* [[Urlsnarf]]
	* [[~~Webmitm~~]]		* [[Webmitm]] - HTTP / HTTPS monkey-in-the-middle. transparently proxies.
	* [[~~Sshmitm~~]]

	in case of SSL-encrypted traffic, attempt to strip the SSL layer using:		in case of SSL-encrypted traffic, attempt to strip the SSL layer using:

Unknown user: /* Combo Attacks */

2022-03-05T19:13:11Z

Combo Attacks

← Older revision		Revision as of 19:13, 5 March 2022
Line 40:		Line 40:
	* [[Arpspoof]]		* [[Arpspoof]]
	* [[Macof]]		* [[Macof]]
	* [[~~Tcpdkill~~]]		* [[Tcpkill]]
	* [[Tcpnice]]		* [[Tcpnice]]
	* [[Webmitm]]		* [[Webmitm]]