Ettercap error

[Slimmay]

Ok, I was hoping I could get help with this...

airmon-ng start wifi0

ath1 - monitor mode enabled

nano /usr/local/etc/etter.conf

(then I remove the two #s under ipchains

K menu-Backtrack-Privilege Escalation-Spoofing-Ettercap

Sniff-Unified sniffing

Network interface - ath1

error - "interface "ath1" not supported (802.11 plus BSD radio information header)

So I try wifi0

"Listening on wifi0... (802.11)
Privileges dropped to UID 65543 GID 65543...

28 plugins
29 protocol dissectors
53 ports monitored
7587 mac vendor fingerprint
1698 tcp OS fingerprint
2183 known services"

So I do a "Ctrl S" (scan for hosts)

Nothing happens...

Click hosts list

Nothing happens...

Start sniffing

Started Unified Sniffing...

But it doesn't detect anything even when I connect a wireless client!

Any ideas?

Thanks!

P.S. The main reason I'm trying to get this going is to use urlsnarf to capture my other laptop's searches. Is there a way to do this without ettercap or tcpreplay?

[imported_=Tron=]

You need to be connected to the network you are sniffing on in order for ettercap to work. In other words you want your interface to be in managed mode and properly associated with your AP before you start ettercap. If you want to sniff the traffic without having to connect to the AP you will have to capture all appropriate packets flying by and then replay them using tcpreplay on the loopback interface to dissect the URL information with urlsnarf.

[drakoth777]

Also, when ur ARP poisoning with etter, and you have other computers route their data stream through you, sometimes you need to have some online activity on the other computers so that they can show up as a host on etter.

[Slimmay]

Nope, that doesn't work. Still the same issues even when connected to the AP.

[imported_=Tron=]

Nope, that doesn't work. Still the same issues even when connected to the AP.

Did you use the correct commands to get your card out of monitor mode and have you checked that you are indeed properly connected to the AP and that both you and the client is on the same subnet? Also, post the actual commands that you use so that we can check for any possible errors.

[Slimmay]

Ok, here's the issue, I'm in monitor mode when I connect to the AP because I have to be. I'll explain:

If I'm out of monitor mode I got to wireless assistant and find my AP (NETGEAR) and type the WEP key in. It fails. I try again. It fails. Then

airmon-ng start wifi0
ath1-monitor mode enabled

Without changing anything, I try to connect and this time it works!

Verrrrrrrry strange, eh?

[drakoth777]

Once you find the ap mac, key, and essid in monitor mode, switched to managed mode. Connect to the ap via terminal. If your interface is wlan0, this is how you would do it.

iwconfig wlan0 essid ESSID
iwconfig wlan0 ap MAC
iwconfig wlan0 key KEY
dhclient wlan0

see if it returns a bounded to internal ip message, if so, you're in.
Now you can run ettercap.

[imported_=Tron=]

Ok, here's the issue, I'm in monitor mode when I connect to the AP because I have to be. I'll explain

Sounds like you need to learn the basics of managing wireless connections in Linux before you try your hands on the more advanced tools in BT, like ettercap.

You could try the following commands to connect to your AP using the command line, which is far superior to the wireless assistant.

rm /etc/dhcpc/*
wlanconfig ath0 destroy
wlanconfig ath0 create wlandev wifi0 wlanmode managed
ifconfig ath0 up
iwconfig ath0 essid NameOfAP key YourWEPkey
ifconfig ath0 up 
dhcpcd -d -n ath0

EDIT: Note that I do not own an Atheros based card, nor have I ever used one, so the commands might need some tweaking. But the fact still remains; you cannot actually connect to an AP in monitor mode.

[drakoth777]

Stay away from the GUI ! ! !

[Slimmay]

Ok I connected nicely to the internet, but ettercap still doesn't work. Exact same issue as before...