sniffing with ettercap

hey guys,
today i will explain how to use ettercap for sniffing in your local area network. It's very easy to use, just find out your target's ip and the gateway's ip:

ettercap -Tqi eth0 -M arp:remote /$target-ip/ /$gateway-ip/

thats all you have to do, ettercap will now launch an arp spoofing attack.

"The principle of ARP spoofing is to send fake, or "spoofed", ARP messages to an Ethernet LAN. Generally, the aim is to associate the attacker's MAC address with the IP address of another node (such as the default gateway). Any traffic meant for that IP address would be mistakenly sent to the attacker instead. The attacker could then choose to forward the traffic to the actual default gateway (passive sniffing) or modify the data before forwarding it (man-in-the-middle attack). The attacker could also launch a denial-of-service attack against a victim by associating a nonexistent MAC address to the IP address of the victim's default gateway." http://www.wikipedia.org

ettercap now searches the networktraffic for interesting post-parameters, unfortunately it won't get any passwords, that aren't in the etter.fields config-file, so you may have to alter this list for your needs. (exact matching required)


a good way to do this, is using wireshark with the 'http.request.method == "POST"' filter



now let's try: