RE: extracting passwords from ethereal dump

From: Steve A (pen.test.mail_at_logicallysecure.org)
Date: 06/21/05

  • Next message: Gwanghoon Kim: "wireless WEP crack."
    To: <pen-test@securityfocus.com>
    Date: Tue, 21 Jun 2005 00:49:08 +0100
    
    

    Mak

    TCPFlow (http://www.circlemud.org/~jelson/software/tcpflow/) will
    extract the various connections between systems based upon their IP
    address and the port they use. It is not a finished product but I have
    never had any problems with it. I like the output as it places data in
    folders based upon the connection IP addresses and direction eg : x-> y
    is different from y -> x. If you know the server IP address you should
    be able to parse the dump file for connections to that and then look in
    the first few packets in each folder for the initial authentication.

    Now I may be grasping at straws here but . . . I believe LoftCrack (or
    LC4 / LC5) has the ability to sniff the authentication from a live
    connection. You could try this in conjunction with snort to replay the
    traffic.

    Steve A

    steve<at>logicallysecure.org

    -----Original Message-----
    From: Mohamed Abdel Kader [mailto:makster12@hotmail.com]
    Sent: 20 June 2005 17:15
    To: pen-test@securityfocus.com
    Subject: extracting passwords from ethereal dump

    I was on a assessment and decided to get some of the traffic moving
    along the network. i got it using ethereal. now i want a program (other
    than ettercap) that can take this dump and extract the passwords. It
    would be helpful if the program can tell me the source and destination
    as well as the protocol in use for each detected password.

    thanks in advance pen-testers :o)
    MAK


  • Next message: Gwanghoon Kim: "wireless WEP crack."

    Relevant Pages

    • Re: Figure Causing Multiple Stamped Connections
      ... DRC, Extract and LVS. ... I am currently doing layout of an 10 phase oscillator circuit. ... Figure Causing Multiple Stamped Connections ... VDD Rail ...
      (comp.cad.cadence)
    • Re: Oracle Discoverer 3.1 wont connect on Windows XP
      ... java used connections like host:port:sid? ... Hey good catch, different program (java.exe vs the discoverer ... executable in the other extract) as well as different address. ...
      (comp.databases.oracle.server)
    • Unable to successfully setu p and use .Remote Desktop Connection.
      ... I haveWinXP PRO and WinXP SE OS's with Remote desktop installed. ... to successfully log on to the RDC. ... Remote connections might not be enabled or the computer might be too busy to ... I went back and added passwords under users as administrator. ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: How the Chicom got my IP address???
      ... WHY ARE YOU ALLOWING CONNECTIONS FROM THAT BLOCK OF ADDRESSES? ... Administrator and common stupid passwords. ... valid username. ...
      (comp.security.misc)
    • Re: Network connections are lost from time to time
      ... John Baldwin ... There are some fixes to handle out of order packets on transmit that ... could break new connections in some cases. ... that drops you can get wireshark to only display the packets for that dump). ...
      (freebsd-net)