Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/hackerschoice/dsniff


https://github.com/hackerschoice/dsniff

Last synced: about 2 months ago
JSON representation

Awesome Lists containing this project

README 

        

dsniff-2.3

----------



i wrote these tools with honest intentions - to audit my own network,

and to demonstrate the insecurity of cleartext / weakly-encrypted

network protocols and ad-hoc PKI. please do not abuse this software.



these programs require:



      Berkeley DB - http://www.sleepycat.com/

      OpenSSL - http://www.openssl.org/

      libpcap - http://www.tcpdump.org/

      libnids - http://www.packetfactory.net/Projects/Libnids/

      libnet - http://www.packetfactory.net/Projects/Libnet/



built and tested on OpenBSD, Linux, and Solaris. YMMV.



what's here:



arpspoof

	redirect packets from a target host (or all hosts) on the LAN

	intended for another local host by forging ARP replies. this

	is an extremely effective way of sniffing traffic on a switch.

	kernel IP forwarding (or a userland program which accomplishes

	the same, e.g. fragrouter :-) must be turned on ahead of time.



dnsspoof

	forge replies to arbitrary DNS address / pointer queries on

	the LAN. this is useful in bypassing hostname-based access

	controls, or in implementing a variety of man-in-the-middle

	attacks (HTTP, HTTPS, SSH, Kerberos, etc).



dsniff

	password sniffer. handles FTP, Telnet, SMTP, HTTP, POP,

	poppass, NNTP, IMAP, SNMP, LDAP, Rlogin, RIP, OSPF, PPTP

	MS-CHAP, NFS, VRRP, YP/NIS, SOCKS, X11, CVS, IRC, AIM, ICQ,

	Napster, PostgreSQL, Meeting Maker, Citrix ICA, Symantec

	pcAnywhere, NAI Sniffer, Microsoft SMB, Oracle SQL*Net, Sybase

	and Microsoft SQL auth info.



	dsniff automatically detects and minimally parses each

	application protocol, only saving the interesting bits, and

	uses Berkeley DB as its output file format, only logging

	unique authentication attempts. full TCP/IP reassembly is

	provided by libnids(3) (likewise for the following tools as

	well).



filesnarf

	saves selected files sniffed from NFS traffic in the current

	working directory.



macof

	flood the local network with random MAC addresses (causing

	some switches to fail open in repeating mode, facilitating

	sniffing). a straight C port of the original Perl Net::RawIP

	macof program.



mailsnarf

	a fast and easy way to violate the Electronic Communications

	Privacy Act of 1986 (18 USC 2701-2711), be careful. outputs

	selected messages sniffed from SMTP and POP traffic in Berkeley

	mbox format, suitable for offline browsing with your favorite

	mail reader (mail -f, pine, etc.).



msgsnarf

	record selected messages from sniffed AOL Instant Messenger,

	ICQ 2000, IRC, and Yahoo! Messenger chat sessions.



sshmitm

	SSH monkey-in-the-middle. proxies and sniffs SSH traffic

	redirected by dnsspoof(8), capturing SSH password logins, and

	optionally hijacking interactive sessions. only SSH protocol

	version 1 is (or ever will be) supported - this program is far

	too evil already.



sshow

	SSH traffic analysis tool. analyzes encrypted SSH-1 and SSH-2

	traffic, identifying authentication attempts, the lengths of

	passwords entered in interactive sessions, and command line

	lengths.



tcpkill

	kills specified in-progress TCP connections (useful for

	libnids-based applications which require a full TCP 3-whs for

	TCB creation).



tcpnice

	slow down specified TCP connections via "active" traffic

	shaping. forges tiny TCP window advertisements, and optionally

	ICMP source quench replies.



urlsnarf

	output selected URLs sniffed from HTTP traffic in CLF

	(Common Log Format, used by almost all web servers), suitable

	for offline post-processing with your favorite web log

	analysis tool (analog, wwwstat, etc.).



webmitm

	HTTP / HTTPS monkey-in-the-middle. transparently proxies and

	sniffs web traffic redirected by dnsspoof(8), capturing most

	"secure" SSL-encrypted webmail logins and form submissions.



webspy

	sends URLs sniffed from a client to your local Netscape

	browser for display, updated in real-time (as the target

	surfs, your browser surfs along with them, automagically).

	a fun party trick. :-)



-d.



---

http://www.monkey.org/~dugsong/