<![CDATA[S-T-D - HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?id=2594 Tue, 27 Jul 2010 14:50:58 +0000 PunBB <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=17437#p17437 That's great...I also have to face this same kind of problem like colin...I want to get the solution of it... I hope I will get it...

]]> Tue, 27 Jul 2010 14:50:58 +0000 http://forum.s-t-d.org/viewtopic.php?pid=17437#p17437 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16936#p16936 Great stuffs. I'm new to this security stuffs. I'll keep learning from this site. Thanks

]]> Thu, 10 Apr 2008 11:48:12 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16936#p16936 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16769#p16769 I'm having the same problem Graflus mentions above.  I have verified that firefox (2.0.0.9) is running as the same user as ettercap (root for both).  I am running ettercap NG-0.7.3.

ettercap was launched using: "ettercap -TQM arp:remote -i eth0 /131.107.16.134/ /131.107.16.44/ -P remote_browser" where 131.107.16.134 is the PC being tracked and 131.107.16.44 is the gateway.

I see the captured URLs in the ettercap terminal window.  Each URL captured is in the format: REMOTE COMMAND: mozilla -remote openurl (<captured URL listed here>).

Attempting to launch mozilla from a terminal window (by typing 'mozilla') produces an error so I tried two different things:
1 - alias mozilla='firefox'.  While this does cause firefox to launch when I type 'mozilla' it does not change the lack of tracking in ettercap.
2 - I tried editing line 143 of the etter.conf.  I changed it from "remote_browser = "mozilla - remote openurl(http://%host%url)"" to  "remote_browser = "firefox - remote openurl(http://%host%url)"".

Attempt #2 caused the following error once I restarted ettercap:
(firefox-bin:5476): Gtk-WARNING **: cannot open display:
Xlib: connection to ":0:0" refused by server
Xlib: No protocol specified

(firefox-bin:5488): Gtk-WARNING **: cannot open display:

I'll be grateful for any insight or a suggestion on a way to get this working.

Thanks.


subcoder wrote:

Gralfus, this could be that you are running mozilla (or firefox) as a different user than the user you are running ettercap under.

Example:

- You run your browser by click on an icon as the user 'gralfus'
- You run ettercap from the command line after su to 'root'

This will cause the behavior you describe.

]]> Thu, 15 Nov 2007 04:46:36 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16769#p16769 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16110#p16110 certainly can, i usually use some of the dsniff tools along with it..

]]> Sat, 17 Feb 2007 12:19:06 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16110#p16110 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16109#p16109 That's interesting ... I wonder if you could use ettercap to arp spoof the network - then run driftnet? I've used ettercap to spoof the network and then used wireshark/ethereal to sniff at the same time with great success in the past.

]]> Sat, 17 Feb 2007 09:42:08 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16109#p16109 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16108#p16108 another fun one to experiment with is driftnet. it won't work across a switch like ettercap can, but is entertaining to display all the images on your network segment/hub. in a work environment, sometimes putting a box up with driftnet for all to see can be a good detriment to non work-related surfing.

ettercap can flatten a switch for rebroadcast, but you may need large I/O if there are many clients on the switch.

]]> Sat, 17 Feb 2007 05:47:04 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16108#p16108 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16107#p16107 Although I do like the Ncurses interface - I ended up getting it to work through text mode.

I've heard of etterlog but haven't touched it yet. There's another one - etterfilter that I'd like to try out. I started playing with Nessus today - started with reading the man page, Nessus and Nmap are my next two programs to play with for a while. I find that I'm interested in a lot - but it takes a lot of time to become proficient in one application... never mind a whole suite of them. I guess that would be why experience is valued so much in this field.

I am enjoying this forum because of the great information and how well it is maintained. It's rare that  I even sign up for a forum and actually post things smile

]]> Sat, 17 Feb 2007 03:22:44 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16107#p16107 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16106#p16106 ettercap is an amazing program, and i have only scratched the surface of it. to me, the Ncurses interface is very nice, but since there are so many options sometimes the text interface is a good way to definitely know what you are telling it.

remember that newer versions of ettercap have a special log format, and you need to use the program etterlog to read them. etterlog has it's own manpage, so look through that.

the ettercap forum has some great info, and there's some very detailed tutorials. there's also lots of people re-re-asking things that are explained in the FAQ, and anyone maintaining a forum gets tired of a bad signal/noise ratio.

]]> Fri, 16 Feb 2007 21:13:48 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16106#p16106 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16105#p16105 Their forum, in terms of organization and keeping people and their posts in line... is brutal. Browsing through this forum is headachless - it's organized and you guys seem to make clean cuts to people who are asking questions that do not pertain to S-T-D tools. smile

So I booted up Knoppix 5.1 - and with a little bit of playing around (had to add remote_browser = "mozilla -remote openurl(http://%host%url)" to etter.conf) I got it working quite nicely. It's really not as great as I thought it'd be - doesn't run any script sites (like Wiki or even Google search) - I thought it'd almost act like a "client mirror" - sending all the information it sniffs to the browser - but it seems to almost just filters out the DNS queries and display those with limitations...

Knoppix 5.1 is also running the latest version of Ettercap... and it seems the Ncurses interface on that one is quite different from the one on the S-T-D CD.

Thanks again Picoshark

]]> Fri, 16 Feb 2007 17:29:58 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16105#p16105 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16102#p16102 I assumed it would...

Not sure why  - but I never thought to look on Ettercap's forum! Thanks a bunch.

Well... I think everyone gets annoyed by people who won't put any effort into searching for an answer - "my time is worth more than yours" mentality. I know from experience that I have no problem helping someone who has already tried helping themselves.

Thanks for your time - I'm off to search the Ettercap forum.

]]> Thu, 15 Feb 2007 16:10:49 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16102#p16102 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16101#p16101 i think that the version of Ettercap on the CD has plugins. i won't be able to check until tomorrow evening, probably. there is a lot of information on Ettercap's forum. read/search a lot there before posting, they (like many) get tired of answering  the same n00b/RTFM questions.

Irongeek has some excellent ettercap tutorials as well, search for him.

]]> Thu, 15 Feb 2007 14:38:36 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16101#p16101 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16100#p16100 Ncurses interface... i like it a lot - in fact I like it way better than the GTK gui... much more configurable and straight forward (though... I can't really compare the two - two different levels of knowledge and skill when I tried both).

I can't seem to find any of the plugins for ettercap anywhere on the cd - are they zipped and I need to install them or what? or do I need to download them and install them?

Thanks smile

]]> Thu, 15 Feb 2007 05:47:33 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16100#p16100 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16099#p16099 i think what you are seeing is the Ncurses interface. the p keystroke was perhaps only correct if you started it in text mode with the -T switch. look through the readme and figure out how to use the Ncurses interface/menu system. later versions of ettercap have a nice GTK gui, but the Ncurses interface is very good also.

]]> Wed, 14 Feb 2007 18:18:37 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16099#p16099 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16098#p16098 I just figured out that there's a comprehensive readme file in the rtfm directory! Great! - I'll give that a read next time I have a chance - I'm sure I'll have a more thorough understanding of ettercap afterwards - hopefully enough to figure out what's going on...

]]> Wed, 14 Feb 2007 18:13:19 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16098#p16098 <![CDATA[Re: HOWTO: Ettercap tips and tricks]]> http://forum.s-t-d.org/viewtopic.php?pid=16097#p16097 Hello there Picoshark

it is... I have no problems pinging it (192.168.2.5 - a windows server 2003 box with just AD, DNS and SQL) or the router (192.168.2.1 -  a half decent home router)

See... If I start it by just typing ettercap at the prompt... it scans for hosts... then gives me the txt based (for lack of a better term, "gui" but it's no gui lol) - I got as far as selecting my target (192.168.2.5 was listed) and my gateway (192.168.2.1 was listed), spoofing and now I'm reading the traffic with great success - however I press "p" and it tells me it couldn't find any plugins... am I missing something here? Do I need to install the plugins myself each time i boot the cd?

Thanks again.

]]> Wed, 14 Feb 2007 17:11:20 +0000 http://forum.s-t-d.org/viewtopic.php?pid=16097#p16097