Keine Antworten in diesem Thema

[grayhats]

Ettercap supports active and passive dissection of many protocols

(even encrypted ones) and includes many feature for network and host

analysis.

 

Data injection in an established connection and filtering (substitute

or drop a packet) on the fly is also possible, keeping the connection

synchronized.

 

Many sniffing modes are implemented, for a powerful and complete

sniffing suite. It is possible to sniff in four modes: IP Based, MAC Based,

ARP Based (full-duplex) and PublicARP Based (half-duplex).

 

Ettercap also has the ability to detect a switched LAN, and to use OS

fingerprints (active or passive) to find the geometry of the LAN.

 

This package contains the Common support files, configuration files,

plugins, and documentation.  You must also install either

ettercap-graphical or ettercap-text-only for the actual GUI-enabled

or text-only ettercap executable, respectively.

 

Ettercap has many built-in tools to allow all sorts of network activity from sniffing to ARP spoofing. It also has the ability to use filters to focus its activity. For example, we want to block a host from the network, the simplest way to do that is to not allow any packets to be sent to or from the host we wish to block. Ettercap filters allow us to do just that.

 

Open a text-editor and type in this block of text, replacing †˜Target IP†™ with the IP address of the host you wish to keep from sending or receiving packets, save it as dos.elt in the /usr/local/share/ettercap directory.

 

if (ip.src == 'Target IP' || ip.dst == 'Target IP')

{

drop();

kill();

msg("Packet Dropped\n");

}

This scripting language is fairly straight forward. Our script looks to see if the Source IP OR  the Destination IP matches our target. If it does it drops the packet and sents a RST signal to the other machine our target was attempting to communicate with. It then outputs a message to our screen so we know a Packet Dropped.

 

 

Now we have our file dos.elt saved in /usr/local/share/ettercap/ and are ready to compile it. Ettercap uses a program called etterfilter to compile filter scripts into files usable by the program. To run it and compile our script we simply type:

 

root@ DDosOnlyLoose > etterfilter dos.elt -o dos.ef

 

Tutorial: