Sniffing Tools
4.4. Sniffing Tools
4.4.1. Dsniff
The dsniff suite has a collection of tools for active/passive sniffing, MitM attacks, and can also monitor the network for data such as passwords, emails, files, and much more.
It is important to understand that dsniff is no longer being actively developed and there will be no further enhancements.
Besides dsniff itself, which is able to capture plaintext passwords on a network, the package also contains the following tools:
Passive
Filesnarf
Mailsnarf
Msgsnard
Urlsnarf
Webspy
Active
Arpspoof
Dnsspoof
Macof
MitM
Sshmitm
Webmitm
Dsniff itself is a password sniffer which handles FTP, Telnet, SMTP, HTTP, POP, popass, NNTP, IMAP, SNMP, LDAP, Rlogin, RIP, OSPF, PPTP MS-CHAP, NFS, VRRP, YP/NIS, SOCKS, X11, CVS, IRC, AIM, ICQ, Napster, PostgreSQL, Meeting Maker, Citrix ICA, Symantec pcAnywhere, and many more.
In this section we will focus on passive tools.
4.4.1.1. Dniff
The command structure for dsniff is the following: dsniff <options> where options include: - -c Perform half-duplex TCP stream reassembly, to handle asymmetrically routed traffic (such as when using arpspoof to intercept client traffic bound for the local gateway) - -d Enable debugging mode - -m Enable automatic protocol detection - -n Do not resolve IP addresses to hostnames - -p Process the contents of the given PCAP capture file - -i Specify the interface to listen on
As you can see from the options listed, dsniff is not only able to capture and save the authentications it sees on the wire, it is also able to analyze files in order to get the same information.
In other words, you can feed dsniff with a pcap (packet capture) file from Wireshark and let it analyze the traffic.
Example: In our example we run dsniff with root privileges. It will automaticaly attach itself to our main interface: eth0. Once the user logs in, dsniff lists the following as output. ``` stduser@els:~$ sudo dsniff dsniff: listening on eth0 ----------------- 12/30/15 04:32:21 tcp 192.168.1.6.43709 -> 192.168.1.1.60 (http) GET /login.cgi?username=admin&password=password HTTP/1.1 Host: 192.168.1.1
Although dsniff is a valid tool, if we want to inspect deeper the traffic and the credentials sent in the network, there are more powerful tools that we can use.
4.4.2. Wireshark
Steps on working with Wireshark:
Select Interface First we start Wireshark and select the interface to use for the sniffing. Be sure to select the correct interface. In case you are attached to the network via Wi-Fi, you will probably use the wireless LAN interface wlan0.
Then, since in our test we are looking at a web application, we will set the capture filter to only watch HTTP traffic.
Pick a Log File In addition to the previous settings, we also want to save our results to a file called eth0_packet_configure_http. Notice that all these options can be configured by clicking on the capture option button.
Start the Capture Notice that with the filter selected, we will see every packet sent and received to and from port 80 (HTTP). If we want to display only HTTP traffic, we can add the word http in the expression field.
Filter Packets Depending on the authentication mechanism implemented on the target web application, we will have to apply specific filters in order to get only the meaningful packets.
For example, if the application implements a basic HTTP authentication mechanism, we can use the http.authbasic filter, which will list all the packets containing credentials sent to the application.
We can apply filters in 2 different ways:
Write the filter in the filter field
Click on Expression and Select HTTP -> http.authasic - Credentials
Study Packets We can inspect the packet in the bottom panel of Wireshark, or we can right click on the packet and select Show Packet in a New Window.
Then, look for the major heading named Hypertext Transfer Protocol
Once there we have to open the child node named Authorization: Basic , and look for the Credentials line. Here we can find the credentials used for the authentication.
4.4.3. TCP DumpManual
tcpdump is a powerful packet sniffer that runs via command line. It allows the user to intercept and display and display TCP/IP and other packets being transmitted or received over a network, to which the computer is attached.
Much like Wireshark, tcpdump has the ability to filter the traffic and save the packets to a file for later analysis.
We will now cover some basic capabilities
Basic syntax: tcpdump [options] [filterexpression]
In our example, we want to see all traffic on our main network interface (eth0), so we will use the following command: sudo tcp dump -i eth0
Last updated
Was this helpful?