Ettercap

Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis. ... so please excuse us for every typo in the documentation, man pages or code, btw fixes and patches are welcome. REQUIRED PROGRAMS C compiler flex (or other lex-compatible parser generator) for .l files bison (or other yacc-compatible parser generator) for .y files cmake (build tool) Use ccmake . to change options such as disabling IPv6 support, add plugins support, etc). Read INSTALL for further details... and README.PLATFORMS for any issue regarding your operating system. Please read the man pages ettercap(8) and ettercap curses(8) to learn how to use ettercap. Sending one ARP REQUEST for each ip in the lan (looking at the current ip and netmask), it is possible to get the ARP REPLIES and then make the list of the hosts that are responding on the lan. With this method even windows hosts, reply to the call-for-reply (they don't reply on broadcast-ping). Be very careful if the netmask is a class B (255.255.0.0) because ettercap will send 255 255 = 65025 arp requests (the default delay between two requests is 1 millisecond, can be configured in etter.conf) Ettercap NG uses the unified sniffing method which is the base for all the attacks. The kernel ip forwarding is always disabled and this task is accomplished by ettercap itself. Packet that needs to be forwarded are packets with destination mac address equal to the attacker's one, but with different ip address. Those packets are re-sent back to the wire to the real destination. This way, you can plug in various mitm attacks at a time. You can even use external attacker/poisoner, they only have to redirect packets to ettercap's host and the game is over ;) HINT: You can use the content filtering engine to drop packets that should not pass. This way ettercap will work as an inline IPS ;) When you select this method, ettercap will poison the arp cache of the two hosts, identifying itself as the other host respectively (see the next section for this). Once the arp caches are poisoned, the two hosts start the connection, but their packets will be sent to us, and we will record them and, next, forward them to the right side of the connection. So the connection is transparent to the victims, not arguing that they are sniffed. The only method to discover that there is a man-in-the-middle in your connection, is to watch at the arp cache and check if there are two hosts with the same mac address! That is how we discover if there are others poisoning the arp cache in our LAN, thus being warned, that our traffic is under control! =) The arp protocol has an intrinsic insecurity. In order to reduce the traffic on the cable, it will insert an entry in the arp cache even if it wasn't requested. In other words, EVERY arp reply that goes on the wire will be inserted in the arp table. So, we take advantage of this "feature", sending fake arp replies to the two hosts we will sniff. In this reply we will tell that the mac address of the second host is the one hard-coded on OUR ethernet card. This host will now send packets that should go to the first host, to us, because he carries our mac address. The same process is done for the first host, in inverse manner, so we have a perfect man-in-the-middle connection between the two hosts, legally receiving their packets!! these kernels use a special neighbor system to prevent unsolicited arp replies (what ettercap sends to the victim). Good gracious, is ettercap unusable with that kernel ? the answer is NO ! let's view why... in the same source code we find: ettercap 0.6.0 and later has this new ARP REQUEST POISONING method. it will alternate request and replies on poisoning because other OS doesn't have this "feature"... This attack implements ICMP redi