ETTERCAP-PLUGINS(8) System Manager's Manual ETTERCAP-PLUGINS(8) (NAME) ettercap_plugins - ettercap (DESCRIPTION) ettercap(8) . (plugin) (tarball) . -DENABLE_PLUGINS=OFF cmake . ettercap ( roper banshee ) . . (interactive) "Start Sniff" . : ettercap -P list : arp_cop (passive) ARP ARP . ARP (ARP poisoning) IP (IP-conflicts) IP . . : ettercap -TQP arp_cop // autoadd (mitm) ARP . ARP (LAN) TARGET . ARP :) chk_poison ARP ettercap . ICMP echo . ICMP MAC . . . (silent) . . . dns_spoof DNS (spoofed) . etter.dns (TTL) . A AAAA PTR MX WINS SRV TXT . A IP ( wildcard ). AAAA . TTL etter.dns . TTL 0 2^31-1 (RFC 2181 ). TTL . TTL 3600 (1 ) . PTR IP ( ). PTR IPv4 IPv6 . MX . 'mail.host' IP 'mail.host' . . IP MX IPv4 IPv6 . WINS IP . SRV . 'srv.host' IP 'srv.host' . IP SRV IPv4 IPv6 . TXT . (double quotes) . (wildcard) . 'undefined address' IP A AAAA . . (dual-stacked) . ANY A AAAA MX TXT . 'undefined address' A AAAA . mdns_spoof dns_spoof mDNS (Multicast DNS) UDP 5353 . etter.mdns . mDNS A AAAA PTR SRV . mdns_spoof etter.mdns dns_spoof mdns_spoof TTL . TTL mDNS 3600 (1 ) . dos_attack (d.o.s.) IP . (scan) "" (phantom) IP SYN . ARP . SYN-ACK ACK ESTABLISHED . "" IP ( find_ip ). (unoffensive) . Naptha DoS (http://razor.bindview.com/publish/advisories/adv_NAPTHA.html) : ettercap -TQP dos_attack dummy . find_conn ARP . (LAN) . : ettercap -TQzP find_conn ettercap -TQu -i eth0 -P find_conn find_ettercap ettercap (LAN) . ettercap . / . find_ip IP . ( gre_relay) "" IP LAN . IP dhcp . find_conn IP find_ip . . IP ( 192.168.0.0/24 10.0.0.1 IP ) . . : ettercap -TQP find_ip // ettercap -TQP find_ip /192.168.0.1-254/ finger (passive fingerprint) . ()connect (kernel) SYN SYN+ACK . . ()connect connect_timeout etter.conf(5) . . ( ettercap(8) ). IP . : ettercap -TzP finger /192.168.0.1/22 ettercap -TzP finger /192.168.0.1-50/22,23,25 finger_submit ettercap . ettercap . . . : ettercap -TzP finger_submit fraggle_attack (DoS) UDP echo chargen IP () target2 . (192.168.0.5 ): ettercap -i eth1 -Tq /192.168.0.5/ // -P fraggle_attack gre_relay GRE . GRE ettercap . "" ettercap ( "" smb_down ssh ) GRE . "" . IP "" . gre_relay "" (impersonate) . IP "" find_ip . Tunnelx Anthony C. Zboralski (http://www.phrack.org/archives/issues/56/10.txt). gw_discover TCP SYN (gateway) . IP MAC . ettercap SYN+ACK MAC . 'host list' . : ettercap -TP gw_discover /192.168.0.1-50/ isolate isolate (LAN) . ARP MAC . . . : target1 target2 . : ettercap -TzqP isolate /192.168.0.1/ // ettercap -TP isolate /192.168.0.1/ /192.168.0.2-30/ krb5_downgrade Kerberos V5 etype AS-REQ . John the Ripper (JtR) . "" . (dissector) kerberos . link_type ARP ( ) . . . : ettercap -TQP link_type /192.168.0.1/ ettercap -TQP link_type // pptp_chapms1 pptp MS-CHAPv2 MS- CHAPv1 ( LC4). "" . ppp . pptp_clear / pptp . ( ) . "" . ppp . pptp_pap pptp PAP (cleartext) . PAP pap_secret "authomatic use of domain account" . ( ). "" . ppp . pptp_reneg pptp . . pptp_pap pptp_chapms1 pptp_clear ( ). "" . ppp . rand_flood (LAN) MAC . (repeating mode) . port_steal_send_delay etter.conf . . : ettercap -TP rand_flood remote_browser URL HTTP . . etter.conf(5) . GET . :) reply_arp ARP. ARP MAC . : ettercap -TQzP reply_arp /192.168.0.1/ ettercap -TQzP reply_arp // repoison_arp ( ) (broadcast) . : Group1 Host2 . Host2 ARP Host3 Group1 MAC Host2 ARP . Group1 ( ) ARP . ARP . reply_arp repoison_arp ARP . : ettercap -T -M arp:remote -P repoison_arp /192.168.0.10-20/ /192.168.0.1/ scan_poisoner . MAC . . proxy-arp . . icmp echo MAC IP . IP . . : ettercap -TQP scan_poisoner // search_promisc (promisc mode) . ARP . (NIC) . . . arp arp . : ettercap -TQP search_promisc /192.168.0.1/ ettercap -TQP search_promisc // smb_clear smb (clear-text) . "" . smb . . smbclient (*nix) :) smb_down smb NTLM2 . LC4 . "" . smb . smurf_attack Smurf (DoS) ICMP () IP () target1 target2 . target2 ICMP () . (192.168.0.5 ): ettercap -i eth1 -Tq /192.168.0.5/ // -P fraggle_attack sslstrip SSL ettercap ssl . . (issuer) 'etter.ssl.crt' . . : openssl genrsa -out etter.ssl.crt 1024 openssl req -new -key etter.ssl.crt -out tmp.csr openssl x509 -req -days 1825 -in tmp.csr -signkey etter.ssl.crt -out tmp.new cat tmp.new >> etter.ssl.crt rm -f tmp.new tmp.csr : SSL ( ) (bridged) . : etter.ssl.crt --certificate/--private-key . stp_mangler BPDU Spanning Tree . "" (root) Spanning Tree ettercap "" . STP . MAC . : ettercap -TP stp_mangler (ORIGINAL AUTHORS) Alberto Ornaghi (ALoR) Marco Valleri (NaGA) (PROJECT STEWARDS) Emilio Escobar (exfil) Eric Milam (Brav0Hax) (OFFICIAL DEVELOPERS) Mike Ryan (justfalter) Gianfranco Costamagna (LocutusOfBorg) Antonio Collarino (sniper) Ryan Linn Jacob Baines (CONTRIBUTORS) Dhiru Kholia (kholia) Alexander Koeppe (koeppea) Martin Bos (PureHate) Enrique Sanchez Gisle Vanem Johannes Bauer Daten (Bryan Schneiders) (SEE ALSO) ettercap(8) ettercap_curses(8) etterlog(8) etterfilter(8) etter.conf(5) ettercap-pkexec(8) ettercap 0.8.4.1 ETTERCAP-PLUGINS(8)