+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Network Hacking (https://sinister.ly/Forum-Network-Hacking)
+--- Thread: Network Sniffing with ETTERCAP (GUI) fully explained(part-1) (/Thread-Network-Sniffing-with-ETTERCAP-GUI-fully-explained-part-1)
Network Sniffing with ETTERCAP (GUI) fully explained(part-1) - Anonymous-g33k - 09-20-2012
Sniffing With Ettercap
1. What is Sniffing
Ans. Sniffing is a data interception technology. Sniffer is a program that monitor or reading all network traffic passing in and out over a network. Telnet, Relogin, FTP, NNTP, SMTP, HTTP, IMAP that all protocol are vulnerable for sniffing because it send data and password in clear text. Sniffing can be use both the ways legally or illegally like for monitor network traffic, network security and for stealing information like password, files from the network. Sniffing can be done both way one is from command line utility and other is from GUI interface. Sniffing is Used In LAN OR WAN Network. In sniffing we can do
• MITM(man in the middle ATTACK)
• DNS Poisoning
• HTTP and HTTPS Sniffing
• Fake Authentication
So LET’s start With MITM
To intercept Information coming, or going to the router by spoofing your physical and logical Addresses is called MITM.
Now What we want.
1. Backtrack operating System.
2. Ettercap tool
3. Company Network LAN or WAN
So let’s start
• Start Backtrack Machine
• Open Terminal
![[Image: arp.png]](http://s19.postimage.org/xpwkdy1o3/arp.png)
• Type -“ettercap-G”
• Click “sniff”
• Click “unified Sniffing”
![[Image: arp2.png]](http://s19.postimage.org/4c0tycyyb/arp2.png)
![[Image: arp3.png]](http://s19.postimage.org/i6z4gttdf/arp3.png)
• Under hosts tab click “scan for hosts”
![[Image: arp4.png]](http://s19.postimage.org/ubedxt69f/arp4.png)
• After hosts is scaned click on “hosts list”
![[Image: arp6.png]](http://s19.postimage.org/yykfzktmb/arp6.png)
• Then click on router ip Eg.192.168.1.1 and click on “add to target 2”
• Then click victim eg.192.168.1.10 which you want to poison click on “add to target 1”
![[Image: arp7.png]](http://s19.postimage.org/g8sgiu0vn/arp7.png)
• Under MITM tab click “arp poisoning”
![[Image: arp8.png]](http://s19.postimage.org/45n4v9ptf/arp8.png)
• Then Click “sniff remote connections”
![[Image: arp9.png]](http://s19.postimage.org/4xpsugu0j/arp9.png)
• Then under the start tab Click on “start sniffing”
![[Image: arp10.png]](http://s19.postimage.org/fypjd8bn7/arp10.png)
• Now On victim Machine When User open any non https website and login there username password is sniffed.
• Eg.When user Open non-https site
![[Image: arp12.png]](http://s19.postimage.org/c3m5anshf/arp12.png)
• Types username and password
![[Image: arp13.png]](http://s19.postimage.org/4owtia6lv/arp13.png)
• We Got the user name And Password Here.
![[Image: arp14.png]](http://s19.postimage.org/yi3tqvv8z/arp14.png)
So That is Called Man in the middle attack we can do same thing in HTTPS service. Next part on HTTPS wait for my next part..
Enjoy The ARP Poisoning..........:headbash:
:dance::wub::bye:
RE: **[TUT]Network Sniffing with ETTERCAP (GUI) fully explained(part-1)*** - Shining White - 09-20-2012
Nice and Smart thread , definetly wait for next part !!
RE: **[TUT]Network Sniffing with ETTERCAP (GUI) fully explained(part-1)*** - elipsses12 - 09-21-2012
nice one bro waiting to the next step and hope u can send me the link thank you
RE: **[TUT]Network Sniffing with ETTERCAP (GUI) fully explained(part-1)*** - kaptaan - 10-07-2012
wowoow....perfect ....thnx for sharing
RE: **[TUT]Network Sniffing with ETTERCAP (GUI) fully explained(part-1)*** - loonatic - 11-24-2012
i installed ettercap 7.4.1 in windows 7 , however everytime i do this step
"• Click “sniff”
• Click “unified Sniffing”"
eth0 dont appear and oly this appear: http://prntscr.com/kfos2
then i click OK and ettercap always stop working :/ what is the main problem ? ....
thank you ,
loonatic
RE: **[TUT]Network Sniffing with ETTERCAP (GUI) fully explained(part-1)*** - LightX - 11-24-2012
Nice tutorial. very detailed!
RE: **[TUT]Network Sniffing with ETTERCAP (GUI) fully explained(part-1)*** - Faner - 11-24-2012
http://www.youtube.com/watch?v=n9Ouc5Wsr08
Good video about arp poisoning: first explains what exactly is and then shows it in practice.
By the way, some time ago I was trying this on bt5. Both computers were connected via cable, and on the router there were only those 2 pc -> mine and victim's (also mine).
Whenever I tried to poison arp, it showed "Arp poisoning successfull.", but when I checked it with plugin "Check_poison" or smth like that, it returns "No arp poison were found."
And of course sniffing also wasn't successful, only thing I got were a bunch of errors. Any idea why it happened?
RE: **[TUT]Network Sniffing with ETTERCAP (GUI) fully explained(part-1)*** - hunt3r972 - 11-24-2012
I just want to say that if the network has a good secured gateway and if the victim has a good antivirus, the MITM attack will not work. I don't know yet how to bypass this problem but I think that the best way to do a successfull MITM attack is to bypass the antivirus with an exploit with metaploit to avoid any blocking from the antivirus then try the MITM attack (more chance to work)
I tried MITM attack on a friend computer on the university network and it didn't work so ... ^^
But I have a question: how to do a host scan with command line only ?
RE: **[TUT]Network Sniffing with ETTERCAP (GUI) fully explained(part-1)*** - Anonymous-g33k - 11-25-2012
(11-24-2012, 03:24 PM)Faner Wrote: http://www.youtube.com/watch?v=n9Ouc5Wsr08you don't have any gateway or router connected in physical machine.
Good video about arp poisoning: first explains what exactly is and then shows it in practice.
By the way, some time ago I was trying this on bt5. Both computers were connected via cable, and on the router there were only those 2 pc -> mine and victim's (also mine).
Whenever I tried to poison arp, it showed "Arp poisoning successfull.", but when I checked it with plugin "Check_poison" or smth like that, it returns "No arp poison were found."
And of course sniffing also wasn't successful, only thing I got were a bunch of errors. Any idea why it happened?
use this in vmware and use NAT network.. it have virtual router..
RE: **[TUT]Network Sniffing with ETTERCAP (GUI) fully explained(part-1)*** - Asuna_mybb_import7736 - 11-25-2012
Cain&Abel is much easier to use! Much noob-friendly gui. Works on pretty much everything!