Sniffer name. The best pen tester tools: sniffers and working with packages

Youtube

Each member of the ][ team has their own preferences regarding software and utilities for
pen test. After consulting, we found out that the choice varies so much that it is possible
create a real gentleman's set of proven programs. That's it
decided. In order not to make a hodgepodge, we divided the entire list into topics - and in
This time we’ll touch on utilities for sniffing and manipulating packets. Use it on
health.

Wireshark

Netcat

If we talk about data interception, then Network Miner will be taken off the air
(or from a pre-prepared dump in PCAP format) files, certificates,
images and other media, as well as passwords and other information for authorization.
A useful feature is to search for those sections of data that contain keywords
(for example, user login).

Scapy

Website:
www.secdev.org/projects/scapy

A must-have for any hacker, it is a powerful tool for
interactive packet manipulation. Receive and decode packets of the most
different protocols, respond to the request, inject the modified and
a package created by yourself - everything is easy! With its help you can perform a whole
a number of classic tasks such as scanning, tracorute, attacks and detection
network infrastructure. In one bottle we get a replacement for such popular utilities,
like: hping, nmap, arpspoof, arp-sk, arping, tcpdump, tetheral, p0f, etc. At that
it's about time Scapy allows you to perform any task, even the most specific
a task that can never be done by another developer already created
means. Instead of writing a whole mountain of lines in C to, for example,
generating the wrong packet and fuzzing some daemon is enough
throw in a couple of lines of code using Scapy! The program does not have
graphical interface, and interactivity is achieved through the interpreter
Python. Once you get the hang of it, it won’t cost you anything to create incorrect
packets, inject the necessary 802.11 frames, combine different approaches in attacks
(say, ARP cache poisoning and VLAN hopping), etc. The developers themselves insist
to ensure that Scapy's capabilities are used in other projects. Connecting it
as a module, it’s easy to create a utility for various types of local area research,
search for vulnerabilities, Wi-Fi injection, automatic execution of specific
tasks, etc.

packeth

Website:
Platform: *nix, there is a port for Windows

An interesting development that allows, on the one hand, to generate any
ethernet packet, and, on the other hand, send sequences of packets with the purpose
bandwidth checks. Unlike other similar tools, packeth
has a graphical interface, allowing you to create packages as simply as possible
form. Further more. The creation and sending are especially elaborated
sequences of packets. You can set delays between sending,
send packets at maximum speed to test throughput
section of the network (yep, this is where they’ll be filing) and, what’s even more interesting -
dynamically change parameters in packets (for example, IP or MAC address).

Any online tracking is based on the use of sniffer technologies (network packet analyzers). What is a sniffer?

A sniffer is a computer program or a piece of computer equipment that can intercept and analyze traffic passing through a digital network or part of it. The analyzer captures all streams (intercepts and logs Internet traffic) and, if necessary, decodes the data, sequentially storing the transmitted user information.

Nuances of using online tracking through sniffers.

On the broadcast channel of the user’s computer network LAN (Local Area Network), depending on the structure of the network (switch or hub), sniffers intercept traffic of either the entire or part of the network coming from one laptop or computer. However, using various methods (for example, ARP spoofing) it is possible to achieve Internet traffic and other computer systems connected to the network.

Sniffers are also often used to monitor computer networks. Performing constant, continuous monitoring, network packet analyzers identify slow, faulty systems and transmit (via email, phone or server) the resulting failure information to the administrator.

Using network taps, in some cases, is a more reliable way to monitor Internet traffic online than monitoring ports. At the same time, the probability of detecting faulty packets (flows) increases, which has a positive effect under high network load.
In addition, sniffers are good at monitoring wireless single- and multi-channel local networks (the so-called Wireless LAN) when using several adapters.

On LAN networks, a sniffer can effectively intercept both one-way traffic (transfer of a packet of information to a single address) and multicast traffic. In this case, the network adapter must have a promiscuous mode.

On wireless networks, even when the adapter is in “promiscuous” mode, data packets that are not redirected from the configured (main) system will be automatically ignored. To monitor these information packets, the adapter must be in a different mode - monitoring.

Sequence of intercepting information packets.

1. Intercepting headers or entire content.

Sniffers can intercept either the entire contents of data packets or just their headers. The second option allows you to reduce the overall requirements for storing information, as well as avoid legal problems associated with the unauthorized removal of users’ personal information. At the same time, the history of transmitted packet headers may have a sufficient amount of information to identify the necessary information or diagnose faults.

2. Decoding packets.

The intercepted information is decoded from a digital (unreadable form) into a type that is easy to perceive and read. The sniffer system allows protocol analyzer administrators to easily view information that has been sent or received by a user.

Analyzers differ in:

data display capabilities(creating timing diagrams, reconstructing UDP, TCP data protocols, etc.);
type of application(to detect errors, root causes or to track users online).

Some sniffers can generate traffic and act as a source device. For example, they will be used as protocol testers. Such test sniffer systems allow you to generate the correct traffic necessary for functional testing. In addition, sniffers can purposefully introduce errors to test the capabilities of the device under test.

Hardware sniffers.

Traffic analyzers can also be of a hardware type, in the form of a probe or a disk array (the more common type). These devices record information packets or parts thereof onto a disk array. This allows you to recreate any information received or transmitted by the user to the Internet or promptly identify a malfunction in Internet traffic.

Methods of application.

Network packet analyzers are used for:

analysis of existing problems in the network;
detecting network intrusion attempts;
determining traffic abuse by users (inside and outside the system);
documenting regulatory requirements (possible login perimeter, traffic distribution endpoints);
obtaining information about network intrusion possibilities;
isolation of operating systems;
monitoring the loading of global network channels;
used to monitor network status (including user activity both within and outside the system);
monitoring of moving data;
WAN monitoring and endpoint security status;
collecting network statistics;
filtering suspicious content coming from network traffic;
creating a primary data source for monitoring the status and management of the network;
online tracking as a spy collecting confidential user information;
debugging server and client communications;
checking the effectiveness of internal controls (access control, firewalls, spam filters, etc.).

Sniffers are also used by law enforcement agencies to monitor the activities of suspected criminals. Please note that all ISPs and ISPs in the US and Europe comply with the CALEA.

Popular sniffers.

The most functional system analyzers for online tracking:

The NeoSpy spy program, whose main activity is monitoring online user actions, includes, in addition to the universal sniffer program code, keylogger (keylogger) codes and other hidden tracking systems.

All articles posted in these sections are the property of their authors.
The site administration does not always agree with the position of the authors of articles and is not responsible for the content of materials posted on the site in the “Reviews” and “Articles” sections.
The site administration is not responsible for the accuracy of the information published in the “Reviews” section.

Promotion! 10% discount for liking VKontakte!

Click "Like" and get a 10% discount on any version of NeoSpy for PC.

2) Click the "Like" button and "Tell friends" at the bottom of the main page;

3) Go to the purchase page, select a version and click "Buy";

4) Enter your VKontakte ID in the “Discount coupon” field, for example, your id is 1234567, in this case you need to enter “id1234567” without quotes in the field.
It is necessary to enter the page ID, and not a short text address.

To see your ID, go to your

SmartSniff is a TCP/IP sniffer that allows you to capture packets that pass through your network adapter and view the captured data as a sequence of communication between the client and server. Viewing the contents of packages is possible in ASCII format (for text protocols such as HTTP, SMTP, POP3 and FTP) and as HEX code. No installation is required to use SmartSniff, just unzip the archive and run the program. The developer distributes SmartSniff completely free of charge.

Key Features and Functions

SmartSniff provides three ways to capture TCP/IP packets:

1. Raw Sockets. Allows you to capture network packets without installing a capture driver. But this method has a number of limitations:

outgoing UDP and ICMP packets are not monitored;
in Windows XP SP1 are not tracked at all due to a Microsoft bug that is present in SP1. This bug was fixed in SP2, but has reappeared in Windows Vista;
In Windows Vista SP1, only UDP packets are monitored.

2. Using the WinPсap packet capture driver. Allows you to capture all packages under all Windows operating systems. This is the preferred method and requires the WinPcap driver to be installed.

3. Microsoft Network Monitor Driver (Windows 2000/XP/2003 only). Microsoft provides a free driver for packet capture, but it is not installed by default, so you need to install it. There are two methods available to install Microsoft Network Monitor Driver:

from Windows disk;
download Windows XP Service Pack 2 Support Tools. One of the tools in this package is netcap.exe. Run it and the driver will install automatically.

View mode.
SmartSniff has three packet viewing modes: Automatic, ASCII, HEX. In automatic mode, SmartSniff checks the first byte of the captured data - if it contains a character less than 0x20, then it outputs the data in HEX mode, otherwise in ASCII mode. The display mode of package contents can be easily switched by selecting the desired one in the menu.

Data export.
Top Bar: You can select the items you want from the top bar, copy to the clipboard, and paste into Excel or an OpenOffice.org spreadsheet. You can also save them in text/HTML/XML format (using "Save Packet Summaries").
Bottom panel: You can select the desired text and paste it into your desired text editor, or save it directly to a text file, HTML file or RAW file using the "Export TCP/IP Streams" option.

What's new in this version?

2.26 (20.07.2016)

now the program automatically downloads the new version of the WinPCap driver from https://nmap.org/npcap/ if it is installed on the system;
SmartSniff now attempts to load the Network Monitor Driver 3.x DLL (NmApi.dll) according to the path designated in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Netmon3. This should resolve the issue loading Network Monitor Driver 3.x on some systems.

A sniffer is not always malicious. In fact, this type of software is often used to analyze network traffic in order to detect and eliminate anomalies and ensure smooth operation. However, the sniffer can be used with malicious intent. Sniffers analyze everything that passes through them, including unencrypted passwords and credentials, so hackers with access to the sniffer can obtain users' personal information. In addition, the sniffer can be installed on any computer connected to the local network, without the need to install it on the device itself - in other words, it cannot be detected during the entire connection time.

Where do sniffers come from?

Hackers use sniffers to steal valuable data by monitoring network activity and collecting personal information about users. Typically, attackers are most interested in user passwords and credentials to gain access to online banking and online store accounts. Most often, hackers install sniffers in places where unsecured Wi-Fi connections are distributed, for example, in cafes, hotels and airports. Sniffers can masquerade as a network-connected device in a so-called spoofing attack to steal valuable data.

How to recognize a sniffer?

Unauthorized sniffers are extremely difficult to recognize virtually, as they can be installed almost anywhere, posing a very serious threat to network security. Ordinary users often have no chance of recognizing that a sniffer is tracking their network traffic. It is theoretically possible to install your own sniffer that would monitor all DNS traffic for the presence of other sniffers, but for the average user it is much easier to install anti-sniffing software or an anti-virus solution that includes network activity protection to stop any unauthorized intrusion or hide your network activities.

How to remove a sniffer

You can use a highly effective antivirus to detect and remove all types of malware installed on your computer for sniffing purposes. However, to completely remove the sniffer from your computer, you must delete absolutely all folders and files related to it. It is also strongly recommended to use an antivirus with a network scanner, which will thoroughly check the local network for vulnerabilities and instruct on further actions if they are found.

How to avoid becoming a victim of a sniffer

Encrypt all information you send and receive
Scan your local network for vulnerabilities
Use only verified and secure Wi-Fi networks

Protect yourself from sniffers

The first thing a user can do to protect themselves from sniffers is to use a high-quality antivirus, like the free Avast antivirus, which is capable of thoroughly scanning the entire network for security problems. An additional and highly effective way to protect information from sniffing is to encrypt all data sent and received online, including emails. mail. Avast SecureLine allows you to securely encrypt all data exchanges and perform online actions in 100% anonymity.

Sniffers- these are programs that intercept
all network traffic. Sniffers are useful for network diagnostics (for administrators) and
to intercept passwords (it’s clear for whom :)). For example, if you gained access to
one network machine and installed a sniffer there,
then soon all the passwords from
their subnets will be yours. Sniffers set
network card in listening
mode (PROMISC). That is, they receive all packets. Locally you can intercept
all sent packets from all machines (if you are not separated by any hubs),
So
How is broadcasting practiced there?
Sniffers can intercept everything
packages (which is very inconvenient, the log file fills up terribly quickly,
but for a more detailed network analysis it’s perfect)
or only the first bytes from all sorts of
ftp, telnet, pop3, etc. (this is the fun part, usually in about the first 100 bytes
contains username and password :)). Sniffers now
divorced... There are many sniffers
both under Unix and under Windows (even under DOS there is :)).
Sniffers can
support only a specific axis (for example linux_sniffer.c, which
supports Linux :)), or several (for example Sniffit,
works with BSD, Linux, Solaris). Sniffers have gotten so rich because
that passwords are transmitted over the network in clear text.
Such services
a lot. These are telnet, ftp, pop3, www, etc. These services
uses a lot
people :). After the sniffer boom, various
algorithms
encryption of these protocols. SSH appeared (an alternative
telnet supporting
encryption), SSL (Secure Socket Layer - a Netscape development that can encrypt
www session). All sorts of Kerberous, VPN (Virtual Private
Network). Some AntiSniffs, ifstatus, etc. were used. But this is fundamentally not
changed the situation. Services that use
transmitting plain text password
are used to the fullest :). Therefore, they will be sniffing for a long time :).

Windows sniffer implementations

linsniffer
This is a simple sniffer to intercept
logins/passwords. Standard compilation (gcc -o linsniffer
linsniffer.c).
Logs are written to tcp.log.

linux_sniffer
Linux_sniffer
required when you want
study the network in detail. Standard
compilation. Gives out all sorts of extra crap,
like isn, ack, syn, echo_request (ping), etc.

Sniffit
Sniffit - advanced model
sniffer written by Brecht Claerhout. Install(need
libcap):
#./configure
#make
Now let's launch
sniffer:
#./sniffit
usage: ./sniffit [-xdabvnN] [-P proto] [-A char] [-p
port] [(-r|-R) recordfile]
[-l sniflen] [-L logparam] [-F snifdevice]
[-M plugin]
[-D tty] (-t | -s ) |
(-i|-I) | -c ]
Plugins Available:
0 -- Dummy
Plugin
1 -- DNS Plugin

As you can see, sniffit supports many
options. You can use the sniffak interactively.
Sniffit though
quite a useful program, but I don't use it.
Why? Because Sniffit
big problems with protection. For Sniffit a remote root and dos have already been released for
Linux and Debian! Not every sniffer allows itself to do this :).

HUNT
This
my favorite sniff. It is very easy to use,
supports a lot of cool
chips and currently has no security problems.
Plus not much
demanding of libraries (such as linsniffer and
Linux_sniffer). He
can intercept current connections in real time and
clean dump from a remote terminal. IN
in general, Hijack
rulezzz:). I recommend
everyone for enhanced use :).
Install:
#make
Run:
#hunt -i

READSMB
The READSMB sniffer is cut from LophtCrack and ported to
Unix (oddly enough :)). Readsmb intercepts SMB
packages.

TCPDUMP
tcpdump is a fairly well-known packet analyzer.
Written
even more famous person - Van Jacobson, who invented VJ compression for
PPP and wrote a traceroute program (and who knows what else?).
Requires a library
Libpcap.
Install:
#./configure
#make
Now let's launch
her:
#tcpdump
tcpdump: listening on ppp0
All your connections are displayed on
terminal. Here is an example of ping output

ftp.technotronic.com:
02:03:08.918959
195.170.212.151.1039 > 195.170.212.77.domain: 60946+ A?
ftp.technotronic.com.
(38)
02:03:09.456780 195.170.212.77.domain > 195.170.212.151.1039: 60946*
1/3/3 (165)
02:03:09.459421 195.170.212.151 > 209.100.46.7: icmp: echo
request
02:03:09.996780 209.100.46.7 > 195.170.212.151: icmp: echo
reply
02:03:10.456864 195.170.212.151 > 209.100.46.7: icmp: echo
request
02:03:10.906779 209.100.46.7 > 195.170.212.151: icmp: echo
reply
02:03:11.456846 195.170.212.151 > 209.100.46.7: icmp: echo
request
02:03:11.966786 209.100.46.7 > 195.170.212.151: icmp: echo
reply

In general, sniff is useful for debugging networks,
troubleshooting and
etc.

Dsniff
Dsniff requires libpcap, ibnet,
libnids and OpenSSH. Records only entered commands, which is very convenient.
Here is an example of a connection log
on unix-shells.com:

02/18/01
03:58:04 tcp my.ip.1501 ->
handi4-145-253-158-170.arcor-ip.net.23
(telnet)
stalsen
asdqwe123
ls
pwd
who
last
exit

Here
dsniff intercepted the login and password (stalsen/asdqwe123).
Install:
#./configure
#make
#make
install

Protection against sniffers

The surest way to protect against
sniffers -
use ENCRYPTION (SSH, Kerberous, VPN, S/Key, S/MIME,
SHTTP, SSL, etc.). Well
and if you don’t want to give up plain text services and install additional
packages :)? Then it's time to use anti-sniffer packets...

AntiSniff for Windows
This product was released by a famous group
Loft. It was the first product of its kind.
AntiSniff as stated in
Description:
"AntiSniff is a Graphical User Interface (GUI) driven tool for
detecting promiscuous Network Interface Cards (NICs) on your local network
segment". In general, it catches cards in promisc mode.
Supports huge
number of tests (DNS test, ARP test, Ping Test, ICMP Time Delta
Test, Echo Test, PingDrop test). Can be scanned as one car,
and the grid. There is
log support. AntiSniff works on win95/98/NT/2000,
although recommended
NT platform. But his reign was short-lived and would soon
time, a sniffer called AntiAntiSniffer appeared :),
written by Mike
Perry (Mike Perry) (you can find him at www.void.ru/news/9908/snoof.txt). He
based on LinSniffer (discussed below).

Unix sniffer detect:
Sniffer
can be found with the command:

#ifconfig -a
lo Link encap:Local
Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
U.P.
LOOPBACK RUNNING MTU:3924 Metric:1
RX packets:2373 errors:0
dropped:0 overruns:0 frame:0
TX packets:2373 errors:0 dropped:0
overruns:0 carrier:0
collisions:0 txqueuelen:0

ppp0 Link
encap:Point-to-Point Protocol
inet addr:195.170.y.x
P-t-P:195.170.y.x Mask:255.255.255.255
UP POINTOPOINT PROMISC
RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:3281
errors:74 dropped:0 overruns:0 frame:74
TX packets:3398 errors:0
dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:10

How
you see the ppp0 interface is in PROMISC mode. Either operator
uploaded sniff for
network checks, or they already have you... But remember,
that ifconfig can be done safely
spoof, so use tripwire to detect
changes and all sorts of programs
to check for sniffs.

AntiSniff for Unix.
Works for
BSD, Solaris and
Linux. Supports ping/icmp time test, arp test, echo test, dns
test, etherping test, in general an analogue of AntiSniff for Win, only for
Unix:).
Install:
#make linux-all

Sentinel
Also a useful program for
catching sniffers. Supports many tests.
Easy to
use.
Install: #make
#./sentinel
./sentinel [-t
]
Methods:
[ -a ARP test ]
[ -d DNS test
]
[ -i ICMP Ping Latency test ]
[ -e ICMP Etherping test
]
Options:
[ -f ]
[ -v Show version and
exit ]
[ -n ]
[ -I
]

The options are so simple that no
comments.

Here are a few more
utilities to check your network (for
Unix):
packetstorm.securify.com/UNIX/IDS/scanpromisc.c -remote
PROMISC mode detector for ethernet cards (for red hat 5.x).
http://packetstorm.securify.com/UNIX/IDS/neped.c
- Network Promiscuous Ethernet Detector (requires libcap & Glibc).
http://packetstorm.securify.com/Exploit_Code_Archive/promisc.c
- scans system devices to detect sniffs.
http://packetstorm.securify.com/UNIX/IDS/ifstatus2.2.tar.gz
- ifstatus tests network interfaces in PROMISC mode.