Script for sniffing traffic.

[comaX]

Yeahp, but you have to patch it or wait for a new release of ettercap. My buddy eric milam took up dev on it and released a patch to correct the bugs. He posted on the forums about it, give it a search
(I'll edit if I remember the post)

[comaX]

Hi everyone !

Following suggestions I just added Driftnet in Yamas. Nothing much you'll say, and I'll agree ; but since I had quite the number of requests for this and it was a very simple implementation... There it is. Next will be URLsnarf (even though I doubt that is really useful).

@ShadowMaster : how's the MITM protection going ?
I re-read your suggestions, and I really have to find a way to use FakeSSL... So, guys, anyone, a little help would be greatly appreciated !

I see this script is used less than it used to (around 50 times a day now), but I actually think this is great ; it means people actually use it on a regular basis. I hope not to play haxor though...

Cheers !

[ShadowMaster]

@ShadowMaster : how's the MITM protection going ?
I re-read your suggestions, and I really have to find a way to use FakeSSL... So, guys, anyone, a little help would be greatly appreciated !

Hey comaX! The MiTM protection is going wonderfully. The two minutes a week I have to spend on it in between frantic, feverish h4x1ng in the PWB course really pay off.
I really am ridiculously busy with that course, hopefully, when I finish I'll devote more time to it. But thank you for the interest, it shows I'm not wasting my time.

I AM looking forward to the implementation of FakeSSL, and I noticed the implementation of the padlock favicon. One down, some to go. Thanks. Your script is a wonderful tool.

[ShadowMaster]

Hey, comaX. Quick Question. I've been using more and more of your script recently and started experimenting with its features. I tried out driftnet, and noticed two problems. One: the window does not shutdown with the rest of your script like the other terms. I know this is not a real problem, but since the rest of the script is so neat, I thought maybe you'd like to keep this the same way, and have it shut down also. Two: the pictures caugt by driftnet are not saved anywhere, nor are we given the option to save them. Any thoughts on how to allow for saving those pics?

[comaX]

Thanks for reporting ! I've already been told about driftnet not completely shutting down and I intend to fix this, but I haven't had much time lately. As for saving the pictures... Well, I don't know. I firstly put 2 options for driftnet but what I thought would not display images but save them all didn't work out, so I left it at the moment. I intend to dig the subject a little bit more so that it can be achieved though !

Thanks for the feedback, it's always appreciated

[VulpiArgenti]

Hi ShadowMaster, The images are downloaded to /tmp, but driftnet deletes them when it closes. If you click on an image displayed in the xterm window, it will be saved to pwd (/). Or you could browse and sort /tmp before closing driftnet. ComaX, I'm sure this is why you let yamas leave driftnet open ;-)

[comaX]

You dear sir might have a good point there. I'll check that. Worst-case scenario, I'll force kill with my hack-fu
No process ever shall resist my killing techniques !

I'll keep you guys posted !

Edit : well, well, well... I had put the driftnet killing in fast_cleanup() instead of cleanup()...
Now it's fixed, with a "greeting message" =D

By the way, if you find a way to save images, please do share.

[TAPE]

Regarding saving the images, I had more success with 'tcpxtract', however am not
sure whether this is included in the stock BT5 ..

Might be an option to look into though.

[ShadowMaster]

comaX, why not grep through the /tmp files and pull out drift-........ or whatever? copy them all into [pwd]/driftnet/ if the users says so? Like the other options...
Also, even thoug I love ascii art, maybe you should update the current header?..

[VulpiArgenti]

Xplico is worth a look too.