Ettercap (software)

Functionality

Features

• IP-based: packets are filtered based on IP source and destination.
• MAC-based: packets are filtered based on MAC address, useful for sniffing connections through a gateway.
• ARP-based: uses ARP poisoning to sniff on a switched LAN between two hosts.
• PublicARP-based: uses ARP poisoning to sniff on a switched LAN from a victim host to all other hosts.

• Character injection into an established connection: characters can be injected into a server or to a client while maintaining a live connection.
• SSH1 support: the sniffing of a username and password, and even the data of an SSH1 connection. Ettercap is the first software capable of sniffing an SSH connection in full duplex.
• HTTPS support: the sniffing of HTTP SSL secured data—even when the connection is made through a proxy.
• Remote traffic through a GRE tunnel: the sniffing of remote traffic through a GRE tunnel from a remote Cisco router, and perform a man-in-the-middle attack on it.
• Plug-in support: creation of custom plugins using Ettercap's API.
• Password collectors for: TELNET, FTP, POP, IMAP, rlogin, SSH1, ICQ, SMB, MySQL, HTTP, NNTP, X11, Napster, IRC, RIP, BGP, SOCKS 5, IMAP 4, VNC, LDAP, NFS, SNMP, MSN, YMSG
• Packet filtering/dropping: setting up a filter that searches for a particular string in the TCP or UDP payload and replaces it with a custom string/sequence of choice, or drops the entire packet.
• OS fingerprinting: determine the OS of the victim host and its network adapter.
• Kill a connection: killing connections of choice from the connections-list.
• Passive scanning of the LAN: retrieval of information about hosts on the LAN, their open ports, the version numbers of available services, the type of the host and estimated distances in number of hops.
• Hijacking of DNS requests.