Script for sniffing traffic.

[comaX]

Hi guys ! I added DNS spoofing, and even though I think I didn't make any mistake since it works, it's very buggy and will work one time in four...
So, any help would be appreciated ! If you think it's better to start a new thread, I'll do !

Meanwhile, you can grab the last version there : http://comax.fr/yamas.php

Btw, a friend from maemo's forums did a very good demo video, you should check it out !

[ericmilam]

Have you check SSLStrip since the BT5r1 update. It's not playing nice with ettercap and I wanted to see if your script is ok. I get nothing but L3 errors when SSLStrip is fired up with ettercap. I haven't narrowed it down, but everything was cool in BT5, only the kernel changed.

Best Regards,
JB

[comaX]

Have you check SSLStrip since the BT5r1 update. It's not playing nice with ettercap and I wanted to see if your script is ok. I get nothing but L3 errors when SSLStrip is fired up with ettercap. I haven't narrowed it down, but everything was cool in BT5, only the kernel changed.

Best Regards,
JB

Nope, I only tried with arpspoof, and everything's alright ! I'll try with ettercap and report back.

Any idea regarding dns spoofing issues ? I'm using dnsspoof by the way.

Cheers !

[Carnacior]

+1 for the L3 errors with SSLstrip...

[comaX]

After a quick try on different sites, I didn't get any error. I believe to be fully up to date since I updated just a few days ago with

apt-get update
apt-get upgrade
apt-get dist-upgrade

I didn't get 5r1 from the image, as you understood.

Edit : I just tried all those commands again, and I was in deed fully up to date !

Edit 2 : DNS spoofing with ettercap seems steadier than with dnsspoof. Both are available form the script though. Waitin for some feedback

[Julius]

Hello very very very thanks for you project I see this with more option : http://code.google.com/p/e asy-creds/and Mod Edit: No links which require registration. Can you include more option in your future release please :-)


thanks a lot

[tuxnator]

Hi comaX,

Firstly, I would like to congratulate you for the very good work with this script.

Secondly, and whether you allow me to say, until version 0.9 there is no need to use wget in this script. The idea of self-update doesn't sound good. You should use a repository, instead. However, worst is the idea of downloading and injecting code in the script on the fly. This is a great security flaw.

Concluding, try to use more the function feature, it'll make your code clearer, less repetitive, easier and safer to be maintained.

[VulpiArgenti]

Hi comaX,

You might be pleased to know there is someone out here using your script to learn bash. The heavy commenting is very helpful.

I notice a small problem running nmap. On my set-up, I get these results:

root@bt:~# ip route show
default via 192.168.0.254 dev wlan0 
192.168.0.0/24 dev wlan0  proto kernel  scope link  src 192.168.0.102 

root@bt:~# ip route show | awk '(NR == 1) { print $1}'
default

Therefore the value "default" is passed to nmap, stopping the script. Not sure if other people have this problem, but the fix for me is to change line 332 to:

search=$(ip route show | awk '(NR == 2) { print $1}')

Regards
Vulpi

[comaX]

Please do ! Regarding security issues, I'm the only one uploading anything, and anyone's free to look at the code before executing it. And I have no interest whatsoever in modifying the code to do some 3v17 haXXor stuff. Yet, I understand your concern ! If I could use some repo I would, but I never bothered trying to be honest... That could be very nice though. About making the code clearer, be my guest ! I've been meaning to do that for a while, but I keep running out of time, or adding new stuff and thinking I'll clean later, when I believe I won't add anything else.

For instance, the whole part concerning sslstrip may now be useless. I just put that regarding migration to BT5, but now it has been a while and I don't think it's necessary anymore.

Don't hesitate to mail, I'd be glad to work on it with you !

[ShadowMaster]

First, amazing script, really cool. Second, when I ran it with arpspoof, the captured password was missing a letter. When I ran it with ettercap, the captured password was fine. Is this an issue with the realtime parsing? Just curious. Also, is there anyway to have the script use ettercap's fake ssl and padlock option as opposed to sslstrip?