Script for sniffing passwords and data on lan/wlan using ettercap, sslstrip, urlsnarf

[escucho]

sorry man, the script work in part because when i quit script etterlog didn't show the passwords but only this:

etterlog NG-0.7.3 copyright 2001-2004 ALoR & NaGA

Log file version : NG-0.7.3
Timestamp : Sat May 15 12:28:57 2010
Type : LOG_INFO

but in .log and .txt i see the details of accounts with related passwords. How i can solve this problem? thanks in advance.

hi man, i have a little problem with the script. It work in part i'll explain better: in last part when i stop the script with q i have a problem with etterlog. It didn't show the password but only this:

etterlog NG-0.7.3 copyright 2001-2004 ALoR & NaGA

Log file version : NG-0.7.3
Timestamp : Sat May 15 12:28:57 2010
Type : LOG_INFO

But in .log and .txt files i can read accounts with passwords related so i suppose that the problem is on etterlog. How i can solve this problem? thanks in advance.

[jodeme]

Hi. I wanna point out:
1. tcpxtract -f /root/$SESSION/$SESSION.pcap -d wlan0 (interface (to download images and stuff we have in .pcap) is missing in your script)
2. after tcpxtract actually "exracted" images and html from the .pcap file, there were many duplicates. I googled a program to kill dupes, and found FSlint - Duplicate file finder for linux. It¨s available from default bt4 repos. Then run fslint-gui and find all dupes, merge. Done.
Hints (=
apt-get install tcpxtract
apt-get install fslint
Any other "kill dupes" tool suggestions to be used in the script?

[tedbear]

sorry man, the script work in part because when i quit script etterlog didn't show the passwords but only this:

etterlog NG-0.7.3 copyright 2001-2004 ALoR & NaGA

Log file version : NG-0.7.3
Timestamp : Sat May 15 12:28:57 2010
Type : LOG_INFO

but in .log and .txt i see the details of accounts with related passwords. How i can solve this problem? thanks in advance.

hi man, i have a little problem with the script. It work in part i'll explain better: in last part when i stop the script with q i have a problem with etterlog. It didn't show the password but only this:

etterlog NG-0.7.3 copyright 2001-2004 ALoR & NaGA

Log file version : NG-0.7.3
Timestamp : Sat May 15 12:28:57 2010
Type : LOG_INFO

But in .log and .txt files i can read accounts with passwords related so i suppose that the problem is on etterlog. How i can solve this problem? thanks in advance.

As far as i know, that is because etterlog doesn't recognize those passwords as passwords. You follow me? I have no idea how you can fix that.

Teddy

[escucho]

i understand, so etterlog's line is useless?

[tedbear]

No its not useless. Only in your particular case.
Maybe in another session you'll get usernames/passwords which are recognized by etterlog. You follow? Try to test this on your own network. Run the script and arpspoof your test computer and go to ie. gmail.com. Enter username and password. Those should be in clear text and recognized by etterlog. The same applies for facebook and hotmail.
Be sure that you got sslstrip working properly. You can test that by looking at your target computers urlline while visiting gmail.com: it should show http://gmail.com and NOT https://gmail.com

[killadaninja]

Hi tedbear I am in no way trying to jack your thread, but my script over here, should filter https and non https credientals

[abz89]

Thanks for nice script!

But how should i use sslstrip with a proxy server?

i agree with this. i've follow the tuts, but all i got just the proxy authentification prompt (user and password proxy prompt unencrypted). I cannot see the other user/pass such as facebook,gmail etc, even not with https

thx 4 caring, sorry for my english, that was lack..

[whatsup]

would sites with Extend Validation (EV) give a warning screen about a MITM attack in Firefox?

[Gingbeard]

This may well be me being silly, but I have followed these instructions to the letter - but opening my anything.sh script just opens Wireshark? No questions etc. Could the OP post the script as an attachment?

[maxdd]

Yeah, same prob..the script can open just wireshark to me...any ideas? BT4R1 ofc