Ettercap - Revision history

Admin at 00:20, 22 August 2016

2016-08-22T00:20:14Z

← Older revision		Revision as of 00:20, 22 August 2016
Line 1:		Line 1:
	Note: ~~also see~~ [[Bettercap]]		Note: Ettercap is the old method. Check out [[Bettercap]].

	=What Ettercap Is=		=What Ettercap Is=

Admin: /* Basic Sniffing Attack */

2016-08-22T00:14:33Z

Basic Sniffing Attack

← Older revision		Revision as of 00:14, 22 August 2016
Line 88:		Line 88:

	<pre>		<pre>
	$ ettercap -Tq -i eth0		$ ettercap -T -i eth0
	</pre>		</pre>

Admin: /* Why Ettercap */

2016-08-21T20:09:41Z

Why Ettercap

← Older revision		Revision as of 20:09, 21 August 2016
Line 17:		Line 17:
	==Why Ettercap==		==Why Ettercap==

	Do you really need ettercap, or can you perform the entire attack yourself?		Do you really need ettercap, or can you perform the entire attack yourself, using artisan, hand-crafted Python scripts?

	Ettercap is basically a tool for automating different steps in ~~the~~ man in the middle attack. You ~~could perform the~~ attack ~~yourself. However~~, ~~it would require~~ multiple windows, switching between scripts, and (depending on ~~whether~~ you~~'re really writing your own tools) deep knowledge of the~~ ARP protocol and packet-forging software.		Ettercap is basically a tool for automating different steps in a man in the middle attack. You can use different sets of tools, perhaps launch an attack with 3 or 4 tools doing separate things, but that requires multiple windows, switching between scripts, and depending on how deep you actually go, learning about ARP protocol and packet forging software.

	Ettercap prevents you from having to manually mount ~~the entire~~ attack. However, there are tradeoffs, namely, Ettercap gives you a simple interface, which takes away much of your control. ~~That means~~ it ~~may do things~~ you don't like ~~or understand~~.		We simply don't have the luxury of time to spend on that kind of wizardry.

			Ettercap prevents you from having to manually mount a complex, multi-step attack. However, there are tradeoffs, namely, Ettercap gives you a simple interface, which takes away much of your control. If you don't like how Ettercap does it - tough. If you don't understand what it's doing - tough. If you don't like the documentation - tough.

	==What Hardware==		==What Hardware==

Admin: /* What Ettercap Is */

2016-08-21T20:07:09Z

What Ettercap Is

← Older revision		Revision as of 20:07, 21 August 2016
Line 3:		Line 3:
	=What Ettercap Is=		=What Ettercap Is=

	Ettercap is a ~~tool for executing [[Man in~~ the ~~Middle]] attacks~~.		Ettercap is a set of tools that do lots of different things. In essence, it is used to reroute network traffic through its host computer, and sniff the traffic as it passes through. It has the software stack required to do both.

	Ettercap can ~~be used in unified mode~~, or ~~in bridge mode~~.		As a sniffing tool, Ettercap is similar to Dsniff in that it can sniff traffic and search for specific kinds of credentials for specific kinds of protocols (e.g., email passwords). It also has functionality to filter traffic (drop packets based on certain filter criteria) or modify traffic.

	~~Unified mode means~~ Ettercap ~~uses~~ a ~~single network interface~~ for ~~sending/receiving to~~ the ~~client as well as to~~ the ~~server~~, and ~~sniffs all relevant traffic at~~ the ~~single interface~~.		Before you can sniff traffic, you have to be able to hear it - which is why a man in the middle attack tool is important when doing sniffing.

			As a man in the middle attack tool, Ettercap has the capability to run ARP, ICMP, DNP spoofing attacks. It can also work in conjunction with other attack tools - e.g., it can sniff and let another program do MITM, or it can do MITM and let other programs sniff. It can be used to strip SSL and issue fake certificates to clients.

			==Man in the middle? what?==

			See [[Man in the Middle]]

			==Why Ettercap==

			Do you really need ettercap, or can you perform the entire attack yourself?

			Ettercap is basically a tool for automating different steps in the man in the middle attack. You could perform the attack yourself. However, it would require multiple windows, switching between scripts, and (depending on whether you're really writing your own tools) deep knowledge of the ARP protocol and packet-forging software.

	~~Bridge mode means~~ Ettercap ~~is using two bridged network interfaces, one connecting~~ to the ~~client and one connecting to the server~~, ~~and is sniffing traffic crossing that bridge~~.		Ettercap prevents you from having to manually mount the entire attack. However, there are tradeoffs, namely, Ettercap gives you a simple interface, which takes away much of your control. That means it may do things you don't like or understand.

	==What ~~Ettercap Actually Does~~==		==What Hardware==

	Ettercap ~~is basically~~ a tool for automating different steps in a man-in-the-middle attack. While you could perform the attack yourself, it would require a lot of windows, switching between scripts, and some really deep technical knowledge of the ARP protocol, packet-forging tools, and how to craft and send ARP packets in the right proportions.		Ettercap can use a single network interface (unified mode) or two network interfaces (bridged mode).

	Ettercap ~~saves you from having~~ to ~~manually mount~~ the ~~man-in-~~the~~-middle attack~~. ~~Be aware of~~ the ~~tradeoffs that Ettercap presents - while it gives you a simple interface for conducting man in~~ the ~~middle attacks~~, ~~it may also do things you don't understand or want, things~~ that ~~can draw the attention of network administrators onto you~~.		Unified mode means Ettercap uses a single network interface for sending/receiving to the client as well as to the server, and sniffs all relevant traffic at the single interface.

			Bridge mode means Ettercap is using two bridged network interfaces, one connecting to the client and one connecting to the server, and is sniffing traffic crossing that bridge.

	=Installing/Building=		=Installing/Building=

Admin: /* Basic Sniffing Attack */

2016-08-21T19:57:37Z

Basic Sniffing Attack

← Older revision		Revision as of 19:57, 21 August 2016
Line 63:		Line 63:
	===Basic Sniffing Attack===		===Basic Sniffing Attack===

	To run a basic sniffing attack in text only mode, you just need to specify the internet device to sniff:		To run a basic sniffing attack in text only mode, you just need to specify the internet device to sniff, and a file to write to (pcap file):

			<pre>
			$ ettercap -T -i eth0 -w output.pcap
			</pre>

			or you can start the program and interact with the text-based menu:

	<pre>		<pre>
Line 69:		Line 75:
	</pre>		</pre>

	Remember that ~~unless~~ you're on a network hub, you ~~won~~'t see traffic ~~intended for other parties -~~ you'll only see traffic intended for ~~you~~. To see all the traffic, you'll need to perform a man in the middle attack.		Remember: if you run the program in this way, it will not conduct a man in the middle attack, and will not give you options to conduct a man in the middle attack. This means that you need to ensure you can see the traffic you want to sniff.

			If you're on a network hub, all ports see all traffic - so you don't need to do anything to see everyone else's traffic. However, if you're on a network switch, ports only see traffic intended for the device on that port. To see all the traffic, you'll need to perform a man in the middle attack.

	===Man in the Middle===		===Man in the Middle===

Admin: /* Remaining Questions */

2016-08-21T19:48:20Z

Remaining Questions

← Older revision		Revision as of 19:48, 21 August 2016
Line 156:		Line 156:
	* What's generating all of this TCP dup ack and keep-alive ack traffic?		* What's generating all of this TCP dup ack and keep-alive ack traffic?
	* Where do the sniffed goodies get printed and logged to? Are they saved by default? Where?		* Where do the sniffed goodies get printed and logged to? Are they saved by default? Where?
	* <s>Does or can ettercap create pcap files?</s> (use the -w flag)		* <s>Does or can ettercap create pcap files?</s> (use the -w or --write flag)

	=Flags=		=Flags=

Admin: /* Remaining Questions */

2016-08-21T19:48:11Z

Remaining Questions

← Older revision		Revision as of 19:48, 21 August 2016
Line 156:		Line 156:
	* What's generating all of this TCP dup ack and keep-alive ack traffic?		* What's generating all of this TCP dup ack and keep-alive ack traffic?
	* Where do the sniffed goodies get printed and logged to? Are they saved by default? Where?		* Where do the sniffed goodies get printed and logged to? Are they saved by default? Where?
	* Does or can ettercap create pcap files?		* <s>Does or can ettercap create pcap files?</s> (use the -w flag)

	=Flags=		=Flags=

Admin: /* Watching in Wireshark */

2016-08-21T19:46:04Z

Watching in Wireshark

← Older revision		Revision as of 19:46, 21 August 2016
Line 139:		Line 139:
	Your man in the middle attack is now running on the local network. By monitoring traffic on your device <code>eth0</code>, you can see all of the traffic passing through the device and on to the sheep.		Your man in the middle attack is now running on the local network. By monitoring traffic on your device <code>eth0</code>, you can see all of the traffic passing through the device and on to the sheep.

	===~~Watching in~~ Wireshark===		===Monitoring Statistics===

			You can monitor the statistics of traffic sniffed from Ettercap, click View > Statistics and watch the numbers roll by.

			===Monitoring with Wireshark===

	If you watch in Wireshark, you'll notice, among other things, a bunch of black packets. This is because your computer is duplicating every packet that reaches it, by forwarding it:		If you watch in Wireshark, you'll notice, among other things, a bunch of black packets. This is because your computer is duplicating every packet that reaches it, by forwarding it:

Admin: /* Remaining Questions */

2016-08-21T19:40:42Z

Remaining Questions

← Older revision		Revision as of 19:40, 21 August 2016
Line 150:		Line 150:

	Several questions remain about this process. Here are a few:		Several questions remain about this process. Here are a few:
			* What's generating all of this TCP dup ack and keep-alive ack traffic?
	* Where do the sniffed goodies get printed and logged to? Are they saved by default? Where?		* Where do the sniffed goodies get printed and logged to? Are they saved by default? Where?
	* Does or can ettercap create pcap files?		* Does or can ettercap create pcap files?

Admin: /* Flags */

2016-08-21T19:38:13Z

Flags

← Older revision		Revision as of 19:38, 21 August 2016
Line 146:		Line 146:

	This is something that is symptomatic of every [[Man in the Middle]] attack that involves ARP spoofing, and is the reason why a physical network tap (a Layer 1 bridge) is much preferred to ARP spoofing (a Layer 2/Layer 3 bridge).		This is something that is symptomatic of every [[Man in the Middle]] attack that involves ARP spoofing, and is the reason why a physical network tap (a Layer 1 bridge) is much preferred to ARP spoofing (a Layer 2/Layer 3 bridge).

			=Remaining Questions=

			Several questions remain about this process. Here are a few:
			* Where do the sniffed goodies get printed and logged to? Are they saved by default? Where?
			* Does or can ettercap create pcap files?

	=Flags=		=Flags=