Ettercap (computing)

Infobox Software
name = Ettercap



caption =
author = ALoR and NaGA
developer =
released = January 25, 2001
latest release version = NG-0.7.3
latest release date = release date and age|2005|05|29
programming language = C
operating system = Cross-platform
platform =
language = English
status = Active
genre = Computer security
license = GNU General Public License
website = [http://ettercap.sourceforge.net/ ettercap.sourceforge.net]

Ettercap is an open source software Unix and Microsoft Windows tool for computer network protocol analysis and security auditing. It is capable of intercepting traffic on a network segment, capturing passwords, and conducting man-in-the-middle attacks against a number of common protocols.

It is free software, licensed under the terms of the GNU General Public License.

Features

Ettercap supports active and passive dissection of many protocols (including ciphered ones) and provides many features for network and host analysis. Ettercap offers four modes of operation:

* IP-based: packets are filtered based on IP source and destination.
* MAC-based: packets are filtered based on MAC address, useful for sniffing connections through a gateway.
* ARP-based: uses ARP poisoning to sniff on a switched LAN between two hosts (full-duplex).
* PublicARP-based: uses ARP poisoning to sniff on a switched LAN from a victim host to all other hosts (half-duplex).

In addition, the software also offers the following features:

* Character injection into an established connection: characters can be injected into a server (emulating commands) or to a client (emulating replies) while maintaining a live connection.

* SSH1 support: the sniffing of a username and password, and even the data of an SSH1 connection. Ettercap is the first software capable of sniffing an SSH connection in full duplex.

* HTTPS support: the sniffing of HTTP SSL secured data--even when the connection is made through a proxy.

* Remote traffic through a GRE tunnel: the sniffing of remote traffic through a GRE tunnel from a remote Cisco router, and perform a man-in-the-middle attack on it.

* Plug-in support: creation of custom plugins using Ettercap's API.

* Password collectors for: TELNET, FTP, POP, IMAP, rlogin, SSH1, ICQ, SMB, MySQL, HTTP, NNTP, X11, Napster, IRC, RIP, BGP, SOCKS 5, IMAP 4, VNC, LDAP, NFS, SNMP, Half-Life, Quake 3, MSN, YMSG

* Packet filtering/dropping: setting up a filter that searches for a particular string (or hexadecimal sequence) in the TCP or UDP payload and replaces it with a custom string/sequence of choice, or drops the entire packet.

* OS fingerprinting: determine the OS of the victim host and its network adapter.

* Kill a connection: killing connections of choice from the connections-list.

* Passive scanning of the LAN: retrieval of information about hosts on the LAN, their open ports, the version numbers of available services, the type of the host (gateway, router or simple PC) and estimated distances in number of hops.

* Hijacking of DNS requests.

Ettercap also has the ability to actively or passively find other poisoners on the LAN.

External links

* [http://ettercap.sourceforge.net Official website]