I'm running ettercap (with Moxie Marlinspike's sslstrip), and I can't interpret a huge amount of the username / password output I get. I get a huge amount of traffic through my network that looks like bruteforce & spam attempts, so I see lots of authentication attempts, but I don't understand them. Some of it if obvious plaintext user/pass pairs, but I also see what look like md5 hashes and base64 strings.
However, the md5 hashes don't seem to be found on any rainbow tables (and most of these passwords look like they're bruteforce attempts anyway), and the (what I'm assuming are) base64 strings translate to garbage characters (nothing alphanum or hashlike). The md5 hashes that ARE on tables are just 4-8 digit numeric strings, which would be kind of weird for a password to a website.
I'm becoming somewhat convinced these aren't actually even passwords, but are some kind of cookie descriptors or something.
Could someone help me make some sense of the output? I've included real (in theory, but anonymized) examples below:
USER: martusovamarina PASS: 68b4cyku
USER: TRIAL-62614546 PASS: 7fmu7v2vux
USER: RanaeApt PASS: mCWZMLFi
USER: firstname.lastname@example.org PASS: eynxDonm
USER: email@example.com PASS: B8DTJnkm
USER: firstname.lastname@example.org PASS: QzNliFXH
PASS: 379ef78aebaf18d51ed4c509cbfe9c92 USER: 720180
PASS: de20078c4db0a8ab1bc66c7e931a3d6e INFO: mailsite
USER: 11014124 PASS: KsZ84lMxScuvFRw2x6XgiLgDZ70=
USER: 13950767 PASS: TTSmfhxSzAfkgj8ayUOH/DPLEs8=
USER: 17407901 PASS: IEflx+h3nusbmAb0CVo0f7w76/4=
1) Do you guys agree these are passwords, or have I made a mistake in my assumptions? Group B looks like MD5, while Group A looks like base64, but neither translate to anything meaningful, even when running them against online hash translators. I don't even know where to start with group C. Maybe ettercap is just mangling the packets and pulling out things it THINKS are passwords that aren't passwords at all.
I'm particularly interested in the Group A Base 64 "looking" stuff, because I see a lot of this.
2) Assuming these are actually encoded data, how would one recover the plaintext?
Thank you and have a good day