Developing a theory (automated arp spoof)

[Grahf]

Hey all,

I'm trying to develop this theory I've been thinking about. The setup is a gateway with an unsecured network and an https authentication page. The gateway uses an invalid SSL certificate.

My theory is to packet sniff for a DHCP request and newly assigned IP. On detection of said packet, launch Ettercap in arp spoofing and SSL dissection mode and quit automatically after successful capture of credentials.

The problem is converting my theory into a working method. First, is it possible to get either Wireshark or Ettercap to launch a script or program on detection of a certain packet? Second, is it possible to get Ettercap to automatically quit after it captures a set of credentials?

It's been bugging me lately. Anyone have any ideas?

[scottm99]

Well, I'll take a crack at answering your first question. There's a command line version of Wireshark, called tshark, that may fit your needs. It's installed in BT5, and seems scriptable. You could probably use some combination of looping, along with send & awk, to look for an ARP request. Tshark has a pretty good man page.