Scribd Logo
Upload

Welcome to Scribd!

  • 93 views

    Dsniff

    Uploaded by

    Lovely Green
    This document describes dsniff, a tool for sniffing passwords and monitoring network traffic. It consists of several modules that intercept passwords from protocols like FTP, HTTP, and others. It works by spoofing ARP entries to perform man-in-the-middle attacks, selectively killing TCP connections, and decoding intercepted traffic. The document advocates for its use to publicly shame networks with insecure authentication and analyze sniffed web traffic and email.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Dsniff

    Uploaded by

    Lovely Green
    93 views15 pages
    This document describes dsniff, a tool for sniffing passwords and monitoring network traffic. It consists of several modules that intercept passwords from protocols like FTP, HTTP, and others. It works by spoofing ARP entries to perform man-in-the-middle attacks, selectively killing TCP connections, and decoding intercepted traffic. The document advocates for its use to publicly shame networks with insecure authentication and analyze sniffed web traffic and email.

    Original Description:

    dsniff

    Original Title

    dsniff

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document describes dsniff, a tool for sniffing passwords and monitoring network traffic. It consists of several modules that intercept passwords from protocols like FTP, HTTP, and others. It works by spoofing ARP entries to perform man-in-the-middle attacks, selectively killing TCP connections, and decoding intercepted traffic. The document advocates for its use to publicly shame networks with insecure authentication and analyze sniffed web traffic and email.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    93 views15 pages

    Dsniff

    Uploaded by

    Lovely Green
    This document describes dsniff, a tool for sniffing passwords and monitoring network traffic. It consists of several modules that intercept passwords from protocols like FTP, HTTP, and others. It works by spoofing ARP entries to perform man-in-the-middle attacks, selectively killing TCP connections, and decoding intercepted traffic. The document advocates for its use to publicly shame networks with insecure authentication and analyze sniffed web traffic and email.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 15

    Passwords Found on a Wireless Network

    "Dont sue me - honey made me do this"


    Dug Song
    dugsong@monkey.org
    University of Michigan CITI
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 1
    Why?
    Insecure network authentication is just so passe
    Virtual tar and feathers: better security through
    public humiliation
    Were not the bad guys, were the network police
    (BOFH)
    We even eat our own:
    http://www.citi.umich.edu/dsniff.html
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 2
    How?
    dsniff - the mother of all password sniffers, plus
    snif ng tools for penetration testing
    arpredirect
    macof
    tcpkill
    tcpnice
    dsniff
    lesnarf
    mailsnarf
    urlsnarf
    webspy
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 3
    arpredirect
    Facilitates man-in-the-middle snif ng via ARP
    spoo ng
    Enables snif ng on switched networks
    Can be used to poison the ARP caches of all, or
    arbitrary hosts on the LAN
    Plays well with others - will restore the original
    ARP mapping on exit
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 4
    macof
    Floods the LAN with random MAC addresses
    Some network switches fail open in repeating
    mode
    Zen koan: Switch becomes hub, snif ng is good.
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 5
    tcpkill
    Selectively kills TCP connections
    Useful in "initializing" connection state on a LAN
    for stateful, TCP/IP reassembling sniffers
    OK, so maybe this is a little evil
    It was just line noise, er, radio interference!
    Honest!
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 6
    tcpnice
    "Youre talking too fast, slow down!"
    Slows down selected TCP connections via "active"
    traf c shaping (shrinking TCP window
    advertisements and ICMP source quenches)
    In theory, could be abused to enforce local
    (unilateral) QoS policy, e.g. to hog bandwidth for
    my Napster downloads
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 7
    dsniff
    The mother of all password sniffers
    Decodes 30 major protocols and their variants: FTP,
    Telnet, HTTP, POP, poppass, NNTP, IMAP, SNMP,
    LDAP, Rlogin, RIP, OSPF, NFS, YP, SOCKS, X11,
    CVS, IRC, AIM, ICQ, Napster, PostgreSQL,
    Meeting Maker, Citrix ICA, Symantec
    pcAnywhere, NAI Sniffer, Microsoft SMB, Oracle
    SQL*Net, Sybase and Microsoft SQL
    HTTP module also does QUERY_STRING and x-
    www-form-urlencoded parsing, to catch most CGI-
    based auth schemes (all major webmail services
    except Hotmail, unencrypted e-commerce sites,
    etc.)
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 8
    dsniff (cont.)
    Supports magic(5)-style automatic protocol
    detection - telnet on port 3000 wont help you!
    Supports full TCP/IP reassembly, and best-effort
    half-duplex TCP reassembly (in case of lossy
    snif ng, or asymmetric routing)
    Uses Berkeley DB for storage, only saving unique
    auth info
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 9
    lesnarf
    Sucks down les sniffed from cleartext NFS v2, v3,
    UDP or TCP traf c
    Practical exploit for theoretical attacks against X11,
    SSH, PGP
    e.g. /.Xauthority, /.ssh/identity,
    /.pgp/secring.pgp
    CIFS, AFS, youre next
    Were working on NFSv4 - heres your motivation
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 10
    mailsnarf
    Output e-mail sniffed from POP, SMTP traf c in
    Berkeley mbox format
    Supports regular expression matching against mail
    header and body
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 11
    urlsnarf
    Output URLs sniffed from HTTP traf c in
    Common Log Format (e.g. Apache access_log)
    Crunch through your favorite log analyzer,
    determing web sur ng trends
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 12
    webspy
    Watch someones web sur ng in real-time, on your
    own browser
    Fun party trick!
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 13
    Conclusions
    Wireless and switched networks are still easily
    sniffed
    Insecure network authentication is still widespread
    Public humiliation may help
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 14
    Availability
    dsniff is freely available under a BSD-style license
    http://www.monkey.org/dugsong/dsniff/
    CITI - USENIX 2000 WIP Jun 22, 19100
    Page 15

    You might also like