Ettercap
Ettercap is a suite for man in the middle attacks on LAN. It
features sniffing of live connections, content filtering on the fly and
many other interesting tricks.
It supports active and passive dissection of many protocols
(even ciphered ones) and includes many feature for network and host
analysis.
Ettercap NG uses the unified sniffing method which is the base
for all
the attacks.
Data
injection in an established connection and filtering (substitute or
drop a packet) on the fly is also possible, keeping the connection
synchronized.
Many sniffing modes were implemented to give you a
powerful and complete sniffing suite. It's possible to sniff in four
modes: IP Based, MAC Based, ARP Based (full-duplex) and PublicARP Based
(half-duplex).
It has the ability to check whether you are in a
switched LAN or not, and to use OS fingerprints (active or passive) to
let you know the geometry of the LAN.
Ettercap
|
|
License
GNU GPL v2
Developer
Alberto Ornaghi and Marco Valleri
Website
ettercap.sourceforge.net
Requirements
libpcap >= 0.8.1
libnet >= 1.1.2.1
libpthread
zlib
Support:
Mailing
Lists
Selected
Reviews:
|
Features include:
- IP-based: packets are filtered based on IP source and
destination
- MAC-based: packets are filtered based on MAC address,
useful for sniffing connections through a gateway
- ARP-based: uses ARP poisoning to sniff on a switched LAN
between two hosts (full-duplex).
- PublicARP-based: uses ARP poisoning to sniff on a switched
LAN from a victim host to all other hosts (half-duplex)
The software also offers the following features:
- Character injection into an
established connection: characters can be injected into a server
(emulating commands) or to a client (emulating replies) while
maintaining a live connection
- SSH1 support: the sniffing of a
username and password, and even the data of an SSH1 connection.
Ettercap is the first software capable of sniffing an SSH connection in
full duplex
- HTTPS support: the sniffing of HTTP
SSL secured data--even when the connection is made through a proxy
- Remote traffic through a GRE tunnel:
the sniffing of remote traffic through a GRE tunnel from a remote Cisco
router, and perform a man-in-the-middle attack on it
- Plug-in support: creation of custom
plugins using Ettercap's API
- Password collectors for: TELNET, FTP,
POP, IMAP, rlogin, SSH1, ICQ, SMB, MySQL, HTTP, NNTP, X11, Napster,
IRC, RIP, BGP, SOCKS 5, IMAP 4, VNC, LDAP, NFS, SNMP, Half-Life, Quake
3, MSN, YMSG
- Packet filtering/dropping: setting up
a filter that searches for a particular string (or hexadecimal
sequence) in the TCP or UDP payload and replaces it with a custom
string/sequence of choice, or drops the entire packet
- OS fingerprinting: determine the OS of
the victim host and its network adapter
- Kill a connection: killing connections
of choice from the connections-list
- Passive scanning of the LAN: retrieval
of information about hosts on the LAN, their open ports, the version
numbers of available services, the type of the host (gateway, router or
simple PC) and estimated distances in number of hops
- Hijacking of DNS(Domain Name System)
requests
- Ettercap also has the ability to actively or passively find
other
poisoners on the LAN.
Return
to Security Home Page
Last Updated Sunday, March 04 2012 @ 02:27 PM EST
|
