IEFD Ep. 20 - Ettercap - Part 1 of 6

For this episode of Full Disclosure, we illustrate the many features of Ettercap. Ettercap is a program designed to sniff passwords on a LAN. It can recognize several different packets that contain passwords including Http, Telnet, Ftp, Pop, Rlogin, SSH1, ICQ, SMB, MySql, NNTP, X11, IRC, IMAP, VNC, SNMP, MSN, YMSG, etc. Furthermore, Ettercap can utilize Man in the Middle Attacks to hijack packets and redirect them to the attacker computer allowing it to extract passwords. In this episode, we show you how to use Arp Poisoning, DHCP Spoofing, and Port Stealing MITM Attacks and explain how they work. Also, we explain how to configure Ettercap to sniff encrypted passwords over the Secure Sock Layer (SSL and HTTPS). Moreover, Ettercap can be easily programmed to modify network traffic with the use of Filters. We demonstrate how to make many different Ettercap Filters. Ettercap comes with numerous plugins to advance Ettercap's abilities; we explain how to use the Check Poison, Re-Poison, DNS Spoofing, Isolate, DoS Attack, Find IP, Gateway Discover, Search Promisc, Arp Cop, and Scan Poisoners Plugins. Lastly, we demonstrate how to use Ettercap's Passive OS Fingerprinting feature. Ettercap supports passive dissection of many protocols allowing it to identify a host's Operating System and Services.

Part 1 of 6

www.InfinityExists.com

Category:

Howto & Style

Tags:

• Infinity
• Exists
• Ettercap
• hacking
• MITM
• Arp
• poisoning
• Port
• stealing
• dhcp
• spoofing
• HTTPS
• dns
• DoS
• Attacks
• filters

[Xnazel]

Great Vids!

I just have one problem, when ever I use arp Poisoning the victim ( my other computer ) cannot access the internet at all. When i used cain and abel, the speed of loading is really slow but still gets there. Anyway to solve this problem?

[Gregorpm]

Yes, use linux.

[pokerstud001]

ok, well i googled ettercap download, and got it, but when i downloaded it all it was was a bunch of files, and no program to use them! help please?

[Gregorpm]

you probably downloaded the linux version. You want to download the "unofficial binaries" windows version from sourceforge

[stanni1992]

Great vid guys but I have a problem. When I've turned on the ARP poisoning and started sniffing, both the attacker and victim pc's are unable to access any internet site even though they both say they are connected to the internet still.

Both machines are running vista btw, and ettercap is running from backtrack2 in VMWare.

Thnx, Stanni

[Gregorpm]

Don't use VMWare. You are probably getting a DoS because VMWare is unable to forward the packets quick enough. Either try just targeting one computer or use the BT LiveCD.

[MCSpidah]

Please will you start speaking up ,your video's are great but I really struggle to hear you .

[yashuvishnalia]

how will i use ettercap for class A ip addresses...because it crash in midway or it will take very very longtime in BT5

[proUnleash]

I got a problem, my friend who is a dick is on the same hamachi network as me, but when am scanning for hosts the program crashes.. what to do ?

[RussellHallmark]

Hi! Thanks for the video... very helpful. i have one question that seems to be unanswerable everywhere else though. I have Ubuntu 10.10 and i am downloading the newest version of ettercap with the 'ubuntu software center' and when i go to scan for hosts it scans and then closes the program. no matter how i boot the program it always does this. (i did get it to work once, but then it went right back to closing afterwards)??HELP???? what can i do??

[ayoubtidjani]

@rlowe1980 you can use start-network

[davywavy1971]

Hello. I have Ettercap working on Win XP. I can detect all interfaces on my WLAN and set the targets but when I try to poison nothing happens. No messages at all and if I start sniff also nothing. Any ideas anyone?

[kirtandalia]

Hi guys, I've been trying to work this out...but somehow it doesn't. I m using backtrack 4 R1 and winxp in VMware for this. when i start sniffing it works well...but when i use xp to log in my yahoo....i can log in there successfully....but in linux machine.....it doesn't show me the way u showed in this video tat it should.....i can't figure out wat went wrong....it sniffs well...captures other packets tat i can see through connection plugin....but this password thing is not showing up.....help

[DuarteOnTheLine]

In the menu doesnt appear "Host's" (same version of the software..:S)

btw nice vid