written 2.3 years ago by | modified 2.3 years ago by |
Ettercap
- Ettercap isatool made by Alberto Ornaghi (ALOR) and Marco Valleri (NaGA) and is basicallyasuite for man in the middle attacks onaLAN.
- What isa"man in the middle" attack?
- This is an attack whereapirate put its machine in the logical way between two machines speaking together as shown in the picture below.
Once in this position, the pirate can launchalot of different very dangerous attacks because he/she is in the way between to two normal machines.
Attacks are not always simple; most of them are complex and it isa big challenge for security researchers and companies that offera solution for them. An attack can be active or passive.
- Active attack: In this kind of attack, The Attacker attempts to alter system resources or destroy the data. The Attacker can change the data, etc.
- Passive attack: In this kind of attack, The Attacker attempts to gain information from the system without destroying the information. This attack is more like monitoring and recognition of the target.
Ettercap offers four modes of operation:
- IP-based: packets are filtered based on IP source and destination.
- MAC-based: packets are filtered based on MAC address, useful for sniffing connections through a gateway.
- ARP-based: uses ARP poisoning to sniff on a switched LAN between two hosts.
- PublicARP-based: uses ARP poisoning to sniff on a switched LAN from a victim host to all other hosts.
Ettercap offers following features:
Character injection into an established connection. Characters can be injected into a server or to a client while maintaining a live connection.
It supports sniffing of a password and username and even the data of an SSH1 connection.
It supports sniffing of HTTP SSL secured data-even when the connection is made through a proxy.
It supports in setting up a filter that searches for a particular string in the TCP or UDP payload and replaces it with a custom string or drops the entire packet.
It can determine the OS of the victim host and its network adapter.
It can kill connections of choices from the connection-list.
It can hijack DNS requests.
It can also find other poisoners on the LAN actively or passively.