ETTERCAP(8) System Manager's Manual ETTERCAP(8) (NAME) ettercap - (IMPORTANT NOTE) ettercap NG ( 0.7.0) . . . (SYNOPSIS) ettercap [OPTIONS] [TARGET1] [TARGET2] IPv6: TARGET MAC/IPs/IPv6/PORTs TARGET MAC/IPs/PORTs IPs PORTs ( /192.168.0.1-30,40,50/20,22,25) (DESCRIPTION) Ettercap ( ) (man-in-the-middle) . ( ) ( OS fingerprint) . : UNIFIED (): . (promisc) ( -p). ettercap (forward) . ettercap . ip_forwarding ettercap . ( ettercap ) . (gateways) . ettercap (UNOFFENSIVE MODE ENABLED) . ettercap . BRIDGED (): . . mitm . . (bridge) . : (drop) . ettercap (inline IPS) ;) . mitm . mitm . mac ip ettercap ( ). ettercap : SSH1: SSH1 . ettercap SSH (FULL-DUPLEX) . SSL: SSL ... . : ( ) ( ) !! : ( ) TCP UDP . ( etterfilter(8) ). : (Linux cooked interfaces) . : (API) ettercap . : TELNET FTP POP RLOGIN SSH1 ICQ SMB MySQL HTTP NNTP X11 NAPSTER IRC RIP BGP SOCKS 5 IMAP 4 VNC LDAP NFS SNMP HALF LIFE QUAKE 3 MSN YMSG ( ...) (Passive OS fingerprint): ( ) LAN : IP . (Kill a connection): . (TARGET SPECIFICATION) (SOURCE) (DEST) . Ettercap ( ) . TARGET MAC/IPs/PORTs . : IPv6 TARGET MAC/IPs/IPv6/PORTs . ANY ( ) . : "//80" 80. "/10.0.0.1/" 10.0.0.1 . MAC 00:11:22:33:44:55 . IPs IP . (-) (,) . - (;) IP . : "10.0.0.1-5;10.0.1.33" 10.0.0.1 2 3 4 5 10.0.1.33 . PORTs . (-) (,) . : "20-25,80,110" 20 21 22 23 24 25 80 110 . : -R TARGET . 10.0.0.1 : "./ettercap -R /10.0.0.1/" : TARGET . . . << >> "//" << >> . (PRIVILEGES DROPPING) ettercap (Link Layer) (root) . root ettercap UID = 65535 ( nobody) . ettercap ( ) ( /tmp/) . uid EC_UID ( export EC_UID=500) etter.conf . (SSL MITM ATTACK) SSL TCP ettercap . redir_command_on redir_command_off ( "etter.conf(5)" ). ettercap ettercap SSL . . ettercap . SSL ettercap SSL . . (issuer) 'etter.ssl.crt' . . : openssl genrsa -out etter.ssl.crt 1024 openssl req -new -key etter.ssl.crt -out tmp.csr openssl x509 -req -days 1825 -in tmp.csr -signkey etter.ssl.crt -out tmp.new cat tmp.new >> etter.ssl.crt rm -f tmp.new tmp.csr : SSL ( ) (bridged) . : etter.ssl.crt --certificate/--private-key . (OPTIONS) . ettercap . (SNIFFING AND ATTACK OPTIONS) ettercap NG . ip_forwarding ettercap . ettercap . ettercap . ettercap . . ettercap . (promisc) . : ettercap (gateway) ettercap ip_forwarding . ettercap ip_forwarding . -M, --mitm ( MITM) . mitm . ettercap . . mitm . mitm ( -M dhcp:ip_pool,netmask,etc). : arp ([remote],[oneway]) ARP . ARP ARP ( ARP cache) . . ( -z) -j . 'ANY' ( ) . ( arp) . "remote" . TARGETS ettercap ettercap . "oneway" ettercap TARGET1 TARGET2 . ( ARP ). : : /10.0.0.1-5/ /10.0.0.15-20/ : 10.0.0.1 10.0.0.3 10.0.0.16 10.0.0.18 : 1 16 1 18 3 16 3 18 . : GW . . icmp (MAC/IP) ICMP ( ICMP redirection) . icmp . . (HALF- DUPLEX) . . (PAYLOAD LENGTH) . tcp . MAC IP . . arp . : TARGET . : -M icmp:00:11:22:33:44:55/10.0.0.1 . dhcp (ip_pool/netmask/dns) DHCP ( DHCP spoofing) . DHCP . ettercap GW . (HALF- DUPLEX) . ( ICMP ). (ip pool) DNS . ettercap . . . dhcp ( ) ettercap (ack) gw . dhcp ( dhcp discovery) ettercap . . ettercap dhcp . request/ack dhcp ip_pool . : ! ! (lease) ettercap ... : -M dhcp:192.168.0.30,35,50-60/255.255.255.0/192.168.0.1 DHCP. -M dhcp:/255.255.255.0/192.168.0.1 DHCP. port ([remote],[tree]) (Port Stealing) . ARP ( ARP ) . ( port_steal_delay etter.conf) ARP (flood) . "tree" MAC <<>> ( ) MAC . <<>> . MAC <<>> . ARP . ARP << >> ettercap . . "tree" MAC ( ). ( ) ( port_steal_delay) . "remote" mitm "arp" . ettercap ARP . . : mitm . . : ( -o) . : mitm . : mitm Solaris Windows libpcap libnet ioctl() . ( ...) : : /10.0.0.1/ /10.0.0.15/ 10.0.0.1 10.0.0.15 10.0.0.1 10.0.0.15 . : /10.0.0.1/ 10.0.0.1 . ndp ([remote],[oneway]) : MITM IPv6 . NDP IPv6 . (ND) (neighbor cache) . IPv6 . ( -z) -j . 'ANY' ( ) . ( arp) . "remote" . TARGETS ettercap ettercap . "oneway" ettercap TARGET1 TARGET2 . ( arp ). : : //fe80::260d:afff:fe6e:f378/ //2001:db8::2:1/ IPv6 . : GW . . : IPv6 - (link-local) . link-local (global-unicast) IPv6 NDP . -o, --only-mitm (thread) . ettercap mitm ( wireshark) . ettercap . "ip forwarding" . -f, --pcapfilter pcap. tcpdump(1) . mitm ettercap . ettercap . -B, --bridge (BRIDGED sniffing) . ettercap . . (passive) . (transparent proxy) <<>> . (OFF LINE SNIFFING) -r, --read ettercap pcap . tcpdump wireshark ( ) . <<>> ( arp ) . -w, --write pcap <<>> ( arp) tcpdump wireshark . . : TARGET . ettercap . : -w -r . WEP . (USER INTERFACES OPTIONS) -T, --text printf ;) 'h' . -q, --quiet . . . pcap ettercap . : ettercap -Tq -L dumpfile -r pcapfile -s, --script ettercap . ettercap . : s(x). x . : ettercap -T -s 'lq' . ettercap -T -s 's(300)olqq' . -C, --curses Ncurses. ettercap_curses(8) . -G, --gtk GTK2 ( Daten...). -D, --daemonize (). ettercap . "log" . "./ettercap_daemonized.log" ettercap . ettercap (debug mode) . (GENERAL OPTIONS) -b, --broadcast Ettercap ( ) . -i, --iface . ( libnet >= 1.1.2) MITM unoffensive . -I, --iflist ettercap . / . -Y, --secondary ( ) . -A, --address
. IP . -n, --netmask . B ( arp) C . -R, --reversed TARGET. not(TARGET) TARGET . -t, --proto PROTO ( TCP + UDP ). TARGET tcp udp . PROTO "tcp" "udp" "all" . -6, --ip6scan ICMPv6 IPv6 . all-nodes IPv6 . . : IPv6 . -z, --silent ARP . : . ARP TARGETs . -p, --nopromisc ettercap (promisc) . . -S, --nosslmitm ettercap https SSL . . -u, --unoffensive ettercap (ip forwarding) . ip . ettercap . ( -u) . . . . ( ) . ettercap (gateway) . -j, --load-hosts -k ( ). -k, --save-hosts . ettercap ARP . -j . -P, --plugin PLUGIN. TARGET . . ( -C) . (Hook) . "list" ( ) ( ./ettercap -P list). : ( "h" ). ettercap_plugins(8) . --plugin-list [,,...] -P plugin --plugin-list ( ./ettercap --plugin-list plugin1,plugin2). -F, --filter . etterfilter(8) . ettercap . etterfilter(8) . . :0 . : --pcapfilter . ettercap . Pcap . : pcapfile ettercap mtu (snaplen) . -W, --wifi-key (WEP WPA) . . : type:bits:t:string. 'type' wep wpa-pws wpa-psk 'bits' (64 128 256) 't' ('s' 'p' ). 'string' . : --wifi-key wep:128:p:secret --wifi-key wep:128:s:ettercapwep0 --wifi-key 'wep:64:s:\x01\x02\x03\x04\x05' --wifi-key wpa:pwd:ettercapwpa:ssid --wifi-key wpa:psk: 663eb260e87cf389c6bd7331b28d82f5203b0cae4e315f9cbb7602f3236708a6 -a, --config /etc/etter.conf. . --certificate Ettercap SSL . --private-key Ettercap SSL . (VISUALIZATION OPTIONS) -e, --regex . -L . REGEX . . . -V, --visual . FORMAT : hex (). : "HTTP/1.1 304 Not Modified" : 0000: 4854 5450 2f31 2e31 2033 3034 204e 6f74 HTTP/1.1 304 Not 0010: 204d 6f64 6966 6965 64 Modified ascii << >> '.' . text << >> . ebcdic EBCDIC ASCII. html html . < > . : This is the title, but the following will not be displayed. : This is the title, but the following will not be displayed. utf8 UTF-8. etter.conf(5) . -d, --dns (DNS resolution). : ettercap . dns . Ettercap dns . : ettercap dns . dns ... ;) -E, --ext-headers ( ). -Q, --superquiet (Super quiet). . . ettercap (dissectors) . . : -q . : ettercap -TzQP finger /192.168.0.1/22 (LOGGING OPTIONS) -L, --log (). etterlog(8) . ettercap ( + ) . LOGFILE ettercap LOGFILE.ecp ( ) LOGFILE.eci ( ) . : ( ) . log ettercap uid = 65535 uid = EC_UID . : deflate -c . -l, --log-info -L + . LOGFILE.eci . -m, --log-msg ettercap . ettercap . . -c, --compress gzip . etterlog(8) . -o, --only-local (LAN) . : . . etterlog(8) . -O, --only-remote (remote) . (STANDARD OPTIONS) -v, --version . -h, --help . (EXAMPLES) ettercap . ettercap -Tp (promisc). . ettercap -Tzq ARP . . ettercap -T -j /tmp/victims -M arp /10.0.0.1-7/ /10.0.0.10-20/ /tmp/victims ARP . ARP . ettercap -T -M arp // // ARP . !! ettercap -T -M arp:remote /192.168.1.1/ /192.168.1.2-10/ ARP . 'remote' . ettercap -Tzq //110 pop3 . ettercap -Tzq /10.0.0.1/21,22,23 telnet ftp ssh 10.0.0.1. ettercap -P list . (FILES) ~/.config/ettercap_gtk ( ) . (ORIGINAL AUTHORS) Alberto Ornaghi (ALoR) Marco Valleri (NaGA) (PROJECT STEWARDS) Emilio Escobar (exfil) Eric Milam (Brav0Hax) (OFFICIAL DEVELOPERS) Mike Ryan (justfalter) Gianfranco Costamagna (LocutusOfBorg) Antonio Collarino (sniper) Ryan Linn Jacob Baines (CONTRIBUTORS) Dhiru Kholia (kholia) Alexander Koeppe (koeppea) Martin Bos (PureHate) Enrique Sanchez Gisle Vanem Johannes Bauer Daten (Bryan Schneiders) (SEE ALSO) etter.conf(5) ettercap_curses(8) ettercap_plugins(8) etterlog(8) etterfilter(8) ettercap-pkexec(8) (AVAILABILITY) (GIT) git clone git://github.com/Ettercap/ettercap.git git clone https://github.com/Ettercap/ettercap.git (BUGS) . . ;) (KNOWN-BUGS) - ettercap (fragmented) ... . . + . + README.BUGS . (PHILOLOGICAL HISTORY) << ...>> (Ettercap) Advanced Dungeons & Dragons. "ettercap" "ethercap" << >> (ethernet capture ettercap ) ... arp... ;) (The Lord Of The (Token)Ring) ( / the fellowship of the packet) "One Ring to link them all, One Ring to ping them, one Ring to bring them all and in the darkness sniff them." (<< .>>) (Last words) << . .>> - ettercap 0.8.4.1 ETTERCAP(8)