I'm running ettercap (with Moxie Marlinspike's sslstrip), and I can't interpret a huge amount of the username / password output I get. I get a huge amount of traffic through my network that looks like bruteforce & spam attempts, so I see lots of authentication attempts, but I don't understand them. Some of it if obvious plaintext user/pass pairs, but I also see what look like md5 hashes and base64 strings.
However, the md5 hashes don't seem to be found on any rainbow tables (and most of these passwords look like they're bruteforce attempts anyway), and the (what I'm assuming are) base64 strings translate to garbage characters (nothing alphanum or hashlike). The md5 hashes that ARE on tables are just 4-8 digit numeric strings, which would be kind of weird for a password to a website.
I'm becoming somewhat convinced these aren't actually even passwords, but are some kind of cookie descriptors or something.
Could someone help me make some sense of the output? I've included real (in theory, but anonymized) examples below:
GROUP A
A1)
USER: martusovamarina PASS: 68b4cyku
USER: TRIAL-62614546 PASS: 7fmu7v2vux
USER: RanaeApt PASS: mCWZMLFi
A2)
PASS: ckYxiOAu
PASS: Gssj5wlL
PASS: bfqRSZgM
PASS: BkEJjALH
PASS: nwAirv1Z
PASS: CbcU56g2
PASS: QxNVeu48
PASS: UKU2E387
PASS: yZJJ8jpu
PASS: boRnWQDi
A3)
USER: ndcvhyta@kikqipim.com PASS: eynxDonm
USER: rdinsmji@pkiwyoys.com PASS: B8DTJnkm
USER: xpuohjsv@jlxewhdg.com PASS: QzNliFXH
GROUP B
PASS: 379ef78aebaf18d51ed4c509cbfe9c92 USER: 720180
PASS: de20078c4db0a8ab1bc66c7e931a3d6e INFO: mailsite
PASS: de09a63a1810a6982292528304250de1
PASS: 7321104456c812861a0203014138554e
PASS: 9a5ed1090c107aa7b5b91e6e4e9301b4
PASS: 53aea018d1607212ee2e8bedda99c0a8
PASS: d451e1de46ff721aeffcd85b512c241f
PASS: 3b1cb06364b0a74db6fcb8918440b6f6
PASS: 245510ff8de361ebd9dc51348d63b382
PASS: 4cbc4145d2e916f615d25a7ebfa77df2
PASS: 6f9027ba632fb413dc3f7ebcee879f51
PASS: dca0113e61385d13954042e44fa880dc
PASS: 21a0126d4a7f66fbdd0f57b438ced77c
PASS: c10607ffcc14ffa7f08afcc4896d4c2a
PASS: e7ebe64d697bf325febea6fcb36b92f3
PASS: 69d4c78f22584dd2d05301c7a3f0ea0f
PASS: 593768bd3805566d2b6d3bbbd39c42fb
PASS: 4f8274281cce4ba79d6363116bb93d57
PASS: 3b6fd80e2e6dad4a9372c4b95e93ceba
PASS: 1de550c91899cbaa0b289cc13bb1e38d
PASS: 7852bcc2bd400e8a978fd60ee1292e81
PASS: 90cfee3dc2fc5fa06dfe59ce25fbf4f9
C)
USER: 11014124 PASS: KsZ84lMxScuvFRw2x6XgiLgDZ70=
USER: 13950767 PASS: TTSmfhxSzAfkgj8ayUOH/DPLEs8=
USER: 17407901 PASS: IEflx+h3nusbmAb0CVo0f7w76/4=
D)
PASS: V2WmQDXcRtTZ2hSHtSWd6pH/n1KmgP3dTa4HOorTAgW5pzL2eB+RA5vU8HrVuP5WNQoNfyZEoknv
PASS: nzWlddimRUwLFQ35AfCEBy0tvaFFW4zL70oZqEaN+gW1cO2qhqHpe58iC/KznXvnpvAz7mPoC+Jr
PASS: Ttc5twJvo6f/mkCHpix9IbmmLXtLNX9oIxut5dllNGQTagYCRj3ZJAZjxMSNvh3o28CZtEjK/GPI
PASS: e0JL0QtQrhqnD4su0We2cXHvNegAG2+BDMx8oaBc9WW9nsMLSrprOvBIoblwiKwZfVmzttAmQ1Ga
Questions:
1) Do you guys agree these are passwords, or have I made a mistake in my assumptions? Group B looks like MD5, while Group A looks like base64, but neither translate to anything meaningful, even when running them against online hash translators. I don't even know where to start with group C. Maybe ettercap is just mangling the packets and pulling out things it THINKS are passwords that aren't passwords at all.
I'm particularly interested in the Group A Base 64 "looking" stuff, because I see a lot of this.
2) Assuming these are actually encoded data, how would one recover the plaintext?
Thank you and have a good day
