https://github.com/pilebones/etterfiltersamples

Some FONCTIONNAL sample of filter for Ettercap (some Etterfilter)
https://github.com/pilebones/etterfiltersamples

Last synced: 17 days ago
JSON representation

Some FONCTIONNAL sample of filter for Ettercap (some Etterfilter)

• Host: GitHub
• URL: https://github.com/pilebones/etterfiltersamples
• Owner: pilebones
• License: gpl-2.0
• Created: 2014-12-10T22:18:35.000Z (about 10 years ago)
• Default Branch: master
• Last Pushed: 2014-12-12T23:48:45.000Z (about 10 years ago)
• Last Synced: 2023-02-27T08:05:31.383Z (almost 2 years ago)
• Language: Shell
• Size: 137 KB
• Stars: 1
• Watchers: 0
• Forks: 1
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
etterfilterSamples

==================

Some FONCTIONNAL sample of filter for Ettercap (some Etterfilter) 

## Introduction

This project is associated to another mine : 

- https://github.com/pilebones/backdoorBash

- https://github.com/pilebones/hostingBackdoorInstaller

The main goals of this project is to implement an attack scenario as below : 

- Implement backdoor like remote-shell with Bash

- Attack Man In the middle with Ettercap (like ARP Spoofing)

- Hosting a backdoor installer

- Automate data alteration to inject our backdoor inside the computer of target by a browser

- If the target run (naively) the script (ie: the backdoor installer) without reading code source the computer is infected and the attacker can obtain a remote access command

- Detect and prevent this kind of attack with NIDS tool as Snort

Notice :

- The programming language was choose only for a Proof of Concept (POC)

- The socket layer is assumed by a portable version of Netcat. I compiled Netcat for i686 and x86_64 computer architecture a put the binary inside this project.

- The transmited data were encrypted with AES-128 (without using Cryptocat). The data are encrypted on the fly via OpenSSL.

## Requirements

- ettercap (v0.8.1)

- etterfilter (v0.8.1)

## How it work ?

_TODO_