Questions tagged [ettercap]

a tool for performing man-in-the-middle attacks, redirecting traffic via ARP poisoning and DNS spoofing, detection of hosts on the LAN, detection of network traffic, as well as tools to inspect intercepted traffic.

Filter by
Sorted by
Tagged with
-2
votes
2answers
62 views

Dns poisoning for any search [closed]

DNS poisoning works only if we open a certain website. For example, a victim enters 192.168.21.56 in a browser, it will be directed to a phishing page. What if we want to redirect the victim to 192....
1
vote
1answer
270 views

sslstrip gives error “exceptions.AttributeError: 'int' object has no attribute 'splitlines'” when used with ettercap [closed]

I have 3 VM's running in VirtualBox. All 3 VM's are connected to a virtual network created from VirtualBox with the IP 192.168.56.1/24 For all VM's are configured Host only Adapter 1 Linux web ...
0
votes
0answers
81 views

Man in the middle after evil twin

I've set up an Evil twin access point using the aircrack suite, what i'm missing is how to complete the man in the middle access point side like the picture shown below, I've been suggested ettercap ...
0
votes
0answers
86 views

Traffic will not go through Ettercap

I absolutely cannot get traffic to go through Ettercap. I feel like I've done everything correct, but it always just ends up with my targeted machines getting Timeout error when trying to load. I ...
0
votes
0answers
52 views

Ettercap ARP poisoning - theory and practice

I am trying to understand ARP poisoning by using Ettercap on my wlan, in an attempt to sniff HTTP traffic coming from my Android phone. Nmap tells me the gw is at x.x.0.2 and the phone at x.x.0.4 ...
2
votes
0answers
103 views

MitM Attack Fails on Home Wireless Router

I am currently trying to perform a MitM attack on my home wireless network to get a better understanding on how this attack works. I can successfully perform this attack on a NAT network on some ...
0
votes
0answers
16 views

It it possible to have Ettercap spread its work across more than one thread?

Wondering if it's possible to have Ettercap split its processing work up across more than one thread, whether by a manual "jury-rigged" abstraction layer, or if there's a way/option to have it be ...
0
votes
1answer
289 views

ip_forward reverting back to 0 during ettercap subnet scanning [closed]

Im trying to arp spoof a local network but the /proc/sys/net/ipv4/ip_forward is reverting back to 0 when ettercap is performing subnet scan on a network hub. Even if i change it back to 1 after the ...
0
votes
0answers
56 views

What is wrong with this ettercap dump file?

I am trying to read a dump file which is created with ettercap. But when I am trying to read it with ettercap it is saying: Error while capturing: bogus savefile header And I can't read the file with ...
0
votes
1answer
139 views

How can Ettercap act as a client instead of a gateway?

I am trying to execute an attack that requires a full-duplex MiTM position. This is the reason why I choose to use Ettercap. I have picked DHCP spoofing as the attack of choice. The problem that I ...
1
vote
1answer
543 views

DNS Hijack: Only spoofing sites listed in etter.dns

I'm trying to create a more practical DNS Hijack mitm attack. I do the traditional arp poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly ...
1
vote
0answers
552 views

Bettercap/ettercap unable to detect HTTP packets

Basically, I am trying to sniff the network traffic from my other computer. So here's the situation: I am in a network, where: 192.168.1.1 - default gateway 192.168.1.24 - "victim" (my other ...
0
votes
1answer
716 views

Use bettercap to sniff traffic going through a proxy configured in the browser?

Using bettercap, how can I intercept traffic which goes to a proxy server which is configured in browser? With no proxy configured it is working fine. But as soon as a proxy is set in the browser ...
1
vote
1answer
723 views

ettercap filters - drop the packet and inject packet

if (ip.proto == TCP) { if (tcp.src == 2404 || tcp.dst == 2404) { if (DATA.data+6 == 0x64 && DATA.data+8 == 0x07) { msg(" pos activation - drop \n"); ...
2
votes
1answer
874 views

How to “Scan for hosts” only using ettercap CLI?

I've been looking for a command to "Scan for hosts" in the terminal with ettercap CLI. How can I scan the local subnet from the ettercap terminal? The graphical ettercap has the options (see below):...
1
vote
2answers
891 views

Ettercap man in the middle - ARP poison

I am experimenting a bit with Ettercap in my local Wifi Lan. I have a router (R), my pc (P) with Ettercap running on it and my smarthphone (S). In particular am testing the ARP poison MIM attack and ...
0
votes
1answer
859 views

Where is the data generated by ettercap -T -i wlan0 saved? [closed]

I executed this command out of curiosity: ettercap -T -i wlan0 After a couple of seconds, it started flooding my terminal emulator with loads of data (sniffed data, I guess). I think this data is ...
1
vote
0answers
507 views

Replacing HEX data with ettercap filters

I am trying to intercept TCP traffic and alter the data in the packet using an ettercap filter. I am man-in-the-middling communication and have set up the following filter for use with ettercap: if (...
1
vote
0answers
487 views

How to steal a HTTP packet, change and re-send

I'm doing a project to my college and I have this scenario: Arduino (192.168.0.113): Receiving packets and send response My router (192.168.0.2): WPS from my gateway My gateway (192.168.0.1): Receive ...
1
vote
0answers
695 views

How to use Ettercap arp spoofing to log internet traffic (how to resolve ineffective arp spoofing)?

I want to capture all internet traffic on a small network, so I am experimenting with ARP spoofing of the default gateway but I don't see the spoofed ARP cache entries. I am using two Linux machines ...
1
vote
2answers
8k views

Ettercap error - 'ARP poisoning needs a non empty hosts list'

I use Kali linux VirtualBox VM with its network adapter attached to NAT. I checked that it is connected to the internet [made a simple apt-get update]. I run this command in a terminal: for ip in $(...