Sniffing Tools
|
- Why Hack and Crack when you can Sniff their login and passwd
|
| Sniffer Scripts |
Linux-Sec.net/Sniffer/Scripts Sniffer.pl scripts
Sniffer/Howto Sniff Contents of the emails
- Sniff emails sent to 1.2.3.4
tcpdump -nnvvvS -s 0 -U -w sniff.smtp.pcap dst 1.2.3.4 and dst port 25
- View the sniffed email data
wireshark -r sniff.smtp.pcap
- click on your "sending email address"
- click on "message text" to view the email contents
- Sniff insecure POP email
tcpdump -nnvvvS -s 0 -U -w sniff.smtp.pcap dst 1.2.3.4 and dst port 110
- Sniff insecure imap email
tcpdump -nnvvvS -s 0 -U -w sniff.smtp.pcap dst 1.2.3.4 and dst port 143
Sniffer/Howto Sniff web connections for login/passwd
tcpdump -nnvvvS -s 0 -U -w sniff.web.pcap dst 1.2.3.4 and dst port 80
wireshark -r sniff.web.pcap
Sniffer/Howto Sniff ftp/telnet connections for login/passwd
tcpdump -nnvvvS -s 0 -U -w sniff.telnet.pcap dst 1.2.3.4 and dst port 21
wireshark -r sniff.telnet.pcap
|
Sniffing email, webmail and html pages
|
- Any unauthorized user with a Sniffer can trivially read all your critical information, such as:
- all your un-encrypted emails to and from your customers, friends and family
- all your un-encrypted emails using web-based emails
- all of your login and password used on your un-encrypted html-based forms
such as shopping carts, domain name registrations, any other website, etc
- Encrypted-Email.net
Email and html Sniffing Demo
|
| Sniffer FAQs |
RobertGraham.com Sniffing FAQ ( original, circa 2000 )
IronGeek.com
ISS.net Sniffer FAQ ( original, circa 1996 ) -- nowhere to be found
- Most all of the protocols are susceptible to sniffing ( its passwd is clear text )
- telnet, ftp, httpd, pop3, imap, snmp, nntp
- Using Secure pop3 and Secure IMAP
- will (?) minimize the odds that the sniffer sees your login and passwd
- will NOT prevent the the sniffer from reading your email in clear text
when it travels around the world and comes into or leaves your mail server
- More importantly, ALL unencrypted data is sniffable ( human readable )
- send and receive only encrypted data for a trivial solution against sniffing
- Using easy to guess login and passwd mitgates any encryption
- it takes a few seconds or minutes to guess your passwd
in the "100,000 word dictionary"
- How do you know if someone is sniffing all your data
- A firewall will NOT prevent sniffing
- a firewall will not help because all user data has to go to the internet
- they can sniff your outgoing emails
- they can sniff your incoming emails
- they can sniff your webpages you browse
- they can sniff your web pages you provide
- They can sniff ALL of your data, login, passwd and all emails
- they can sniff ALL your data from all the routers you passed thru
- they can sniff ALL your data from your ISP
- they can sniff ALL your data from your colo
- they can sniff ALL your data from your local network
- they can sniff ALL your data from your wireless network
- they can sniff ALL your data from your vpn connections at home
- they can sniff ALL your data from the airport, coffee shops, etc
- they can sniff ALL your data from outside your office or home
|
| Sniffer Detectors |
|
| Wireless Sniffers |
|
| Sniffing Across Switches |
Mac Address Spoofing
ARP Poisoning
|
| List of Network Sniffers |
|
| Common Network Sniffers |
Linux.org Aldebaran
Naughty.Monkey.org DSniff, mailsnarf, urlsnarf
DataNerds.net dsniff for windoze
EtherReal.com tethereal both obsolete -- use wireshark instead
EtherReal.Zing.org obsoleted, it is now wireshark.org
EtherApe.sourceforge.net packet sniffer, bw monitor
Ettercap.com ettercap-NG
SourceForge.net IPGrab
LaurentConstantin.com Netwib, Netwox, Netwag
NFR.com Network Flight Recorder
cerias.purdue.edu nfswatch for sniffing NFS packets
morphine.com passlogd
Phencelit.de phoss - sniff HTTP, FTP, LDAP, Telnet, IMAP4, POP3, VPN logins
phenoelit-us.org phoss
Starzetz.de smit
Sniffit.sourceforge.net
Snoop for solaris
snort.org
tcpdump.org
Wireshark.org tshark
cshl.org web sniffer
- Bandwidth Monitor
|
| Howto Write a Sniffer |
|
| Commercial Windoze Sniffers |
|
Keyboard Sniffers - Loggers
|
- if they installed a keyboard logger, you're dead ... gameover .. encryption will NOT help either since they can see your passphrase
- if they installed the keyboardlogger remotely, you have other very serious securityproblems
- if they have physical access, game over... just pull the plug and walk out with the PC or laptop with important data on it
thc.org vLogger ( keyboard logger/sniffer )
teso.scen.at iob - kb sniffer
citefa.gov.ar tecleo
PacketStormSecurity.org keylogger
honeynet.org sebek
SourceForge.net lkl
VNC
|