Script for sniffing traffic.

[comaX]

Comax, I have never have any problem with with script, no matter what version, I think its wonderful and as long as you keep updating it, I'll keep on using.[...]

Thanks Comax

i used this script against my smart phone and laptop win 7 with the latest security software and did not let me down. i have said thank you thank you before and here i am again saying big thanks to comax :-)

Gentlemen, I am humbled. Thanks for the positive feedback !

[ShadowMaster]

I'm still not giving up on my dream of seeing ettercap filters as one of the options comaX. How's that coming along?

[comaX]

Oh man... I am so f'ing swamped right now... I started writing a new version (and not update) of Yamas a while back but haven't had the time to do much on it... This year was supposed to be easier study-wise, but guess what? It absolutely is not. It's worse. If I get the time during the holidays I'll try to work on it, but I'm supposed to be preparing exams for early January.

I'll keep you guys posted.

[aronian]

Hi, first of all... awesome script !! Now, I was just wondering, is there is a way to know exactly from which IP address the logs are coming if you are poisoning a whole network? And is it possible to stop the ARP poisoning on just the selected IP, but continuing poisoning the whole network?

I am asking this because there a lots of SSL pages (like facebook or hotmail) that after running the script, they send to us the username and password information but the user is not able to correctly access them, for example in hotmail the user returns to the login page again and again, and in facebook the user can access to his account but it doesn't load properly.

So my idea was to stop the ARP poisoning on just the selected IP address once I got his credentials, so he will now be able to correctly access to all pages.

Of course I am not intending to do this for the wrong purposes, I just think that if you are going to test your network doing a MITM, you should do it right without anyone noticing what you are doing, even you have their authorization to do so.

[FettMaster]

Hi. The Script itś great, but since I use BT5R3 the scripts doesnt works fine.

Itś run smooth, but the password windows doesnt show anything. I'm triying facebook, twitter, gmail, etc. and nothing. anyone can help me? Thanks a lot.

[comaX]

Hi, first of all... awesome script !! Now, I was just wondering, is there is a way to know exactly from which IP address the logs are coming if you are poisoning a whole network? And is it possible to stop the ARP poisoning on just the selected IP, but continuing poisoning the whole network?

That is not possible, unfortunately. What you can do is attack all connected equipment independently, and then stop them separately. And, nope, sslstrip doesn't log lan IP. You could run wireshark aside to check for matching packets.

I am asking this because there a lots of SSL pages (like facebook or hotmail) that after running the script, they send to us the username and password information but the user is not able to correctly access them, for example in hotmail the user returns to the login page again and again, and in facebook the user can access to his account but it doesn't load properly.

Yeahp, that's because of sslstrip I think. Have you tried with ettercap ? (yamas -e)

So my idea was to stop the ARP poisoning on just the selected IP address once I got his credentials, so he will now be able to correctly access to all pages.
Of course I am not intending to do this for the wrong purposes, I just think that if you are going to test your network doing a MITM, you should do it right without anyone noticing what you are doing, even you have their authorization to do so.

I hear you, but nope, that's just not possible, afaik. Sorry!

[wewe73]

Hi. The Script itś great, but since I use BT5R3 the scripts doesnt works fine.

Itś run smooth, but the password windows doesnt show anything. I'm triying facebook, twitter, gmail, etc. and nothing. anyone can help me? Thanks a lot.

it works just fine over here using BT5-R3

[bahaeddine4]

i haven't tried this yet but does it work in the secure mode (https) ?

[KillerKenny]

The "password" window is only saying

"Parsing /tmp/yamas.txt for credentials."

What does it mean?

[comaX]

i haven't tried this yet but does it work in the secure mode (https) ?

You should know more about how it works. Hint : sslstrip.

The "password" window is only saying

"Parsing /tmp/yamas.txt for credentials."

What does it mean?

Means it hasn't found anything yet.