ETTERCAP-CURSES(8)

✨ ETTERCAP-CURSES(8) ✨

System Manager's Manual · ettercap-curses · the ncurses era 💅

---

🌸 NAME 🌸

ettercap — the man page for the Ncurses GUI, bestie. yes she has her own page. she's that girl. 👑

---

🦋 GENERAL DESCRIPTION 🦋

okay so the curses GUI? lowkey simple, highkey intuitive. she's menu-driven, which means every flag and every function gets modified or called straight through the upper menu. no scrolling through --help at 3am, we do it with vibes and hotkeys. ✨

all your user messages get printed in the bottom window. and if you wanna peek at the old messages? just scroll that window buffer by pressing the UP, DOWN, PPAGE, NPAGE keys. the middle part is the main character — that's where information and dialogs show up for you. 🫶

the menus open when you press the relative hotkey. and here's the cute part: for the menus, the hotkey is literally the uppercase initial letter of the title (e.g. 'S' for Sniffing, 'T' for Targets — iykyk). the functions inside a menu get called by pressing the hotkey shown right next to the function name, on the right side. and if a hotkey is prefixed with 'C-', that means you use it together with the CTRL key (e.g. 'C-f' means CTRL+f). no cap. ⌨️

you can switch focus between the objects on screen by pressing the TAB key, or by clicking on them with the mouse — but only if you're running ettercap inside an xterm. mouse events are supported only through the xterm, so don't come for her if your fancy terminal isn't playing nice. 🥲 with the mouse you can select objects, open a menu, choose a function, scroll the elevators for the scrolling windows, etc etc. all of it.

when you open multiple windows in the middle part, they will overlap. that's just how it is. use TAB to switch between them, and use CTRL+Q to close the focused window. 🌈

you can also use CTRL+Q to close the input dialog if you wanna cancel the input you were asked for. (like… you selected the wrong function and you just wanna go back. we've all been there. 🙈)

wanna know the shortcuts for whatever window you're in? press the SPACE key and a help window pops up with a whole list of shortcuts you can use against that particular window. and if the window does not appear? that means no shortcuts are available. it's giving "nothing to see here." 💀

---

🎀 HOW TO SELECT IT 🎀

to use the ncurses GUI you have to:

1. compile ettercap with ncurses support (obviously 💅)
2. run it with the -C flag

passing the -C flag is sufficient, but if you want you can pass other flags too and they'll be automatically set for the ncurses GUI. you'll still be able to override them using the menu to change the options. iconic. ⭐

---

🌈 ONCE STARTED 🌈

as soon as ettercap is launched with the Ncurses GUI, you get prompted with multiple choices. the first screen lets you select whether you wanna open a pcap file or dump the sniffed traffic to a file, whether you want unified sniffing or bridged sniffing, and it also permits you to set a pcap file on the captured traffic and enables you to log all the sniffed data. so many options, so little time. ✨

⚠️ once you've selected a sniffing method (from file, unified or bridged), this screen will not be reachable anymore. the only way is to restart ettercap. so choose wisely bestie, no take-backs. 😭

let's analyze each menu in the start screen:

📁 File

• Open... — open a pcap file and analyze it. all the functionalities available for live sniffing are in place, except for those sending or forwarding packets (mitm attacks and so on…). so no mitm here, she said no. 🚫
• Dump to file... — all the traffic sniffed by the live capture gets dumped to that file. the filters, not the targets, have effects on this file, because all the packets received by pcap will be dumped. the only way to not dump a certain packet is to set a proper pcap filter (see below). 🍓
• Exit — exits from ettercap and returns you to the command prompt. bye bestie, see you next sniff. 👋

👃 Sniff

• Unified sniffing... — choosing this function prompts you to select the network interface to be used for sniffing. the first up and running interface is suggested in the input box. for an explanation of what unified sniffing actually is, refer to ettercap(8).

💡 TIP: if you use the 'u' hotkey, this step gets skipped and the default interface is automatically selected. speedrun. 🏃‍♀️

• Bridged sniffing... — after selecting the two interfaces to be used, you enter the Bridged sniffing mode. for an explanation of what bridged sniffing is, refer to ettercap(8).
• Set pcap filter... — here you can insert a tcpdump-like filter for the capturing process.

🚨 IMPORTANT: if you manage to use a mitm attack, remember that if ettercap does not see a packet, it will NOT be forwarded. so be sure of what you're doing by setting a pcap filter. this is not the moment to be casual. 🔥

⚙️ Options

• Unoffensive — this enables/disables the unoffensive flag. the asterisk '*' means "the option is enabled". otherwise, the option is not enabled. simple as that. 💅
• Promisc mode — enable/disable the promisc mode for the live capture on a network interface. this is an "asterisk-option", just like the unoffensive one. ⭐
• Set netmask — use the specified netmask instead of the one associated with the current iface. this option is useful if you have the NIC with an associated netmask of class B and you want to scan (with the arp scan) only a C class. she's niche but she's needed. 🧚

---

🌈 THE INTERESTING PART 🌈

Okay bestie, so once you've picked offline sniffing or live capture, the upper menu gets a glow-up and you can start doing the interesting things... Some of the following menu are only available in live capture.

🚀 Start

• Start sniffing — Starts the sniffing process depending on what you have selected on startup (live or from file).
• Stop sniffing — Stops the sniffing thread.
• Exit — Returns to your favourite shell ;)

🎯 Targets

• Current Targets — Displays a list of hosts in each TARGET. You can selectively remove a host by selecting it and press 'd' or add a new host pressing 'a'. To switch between the two lists, use the ARROWS keys.
• Select TARGET(s) — Lets you select the TARGET(s) as explained in ettercap(8). The syntax is the same as for the command line specification.
• Protocol... — You can choose to sniff only TCP, only UDP or both (ALL).
• Reverse matching — Reverse the matching of a packet. It is equivalent to a NOT before the target specification.
• Wipe Targets — Restores both TARGETS to ANY/ANY/ANY

🖥️ Hosts

• Hosts list — Displays the list of hosts detected through an ARP scan or converted from the passive profiles. This list is used by MITM attacks when the ANY target is selected, so if you want to exclude a host from the attack, simply delete it from the list. You can remove a host from the list by pressing 'd', add it to TARGET1 by pressing '1' or add it to TARGET2 by pressing '2'.
• Scan for hosts — Perform the ARP scan of the netmask if no TARGETS are selected. If TARGETS was specified it only scans for those hosts.
• Load from file... — Loads the hosts list from a file previously saved with "save to file" or hand crafted.
• Save to file... — Save the current hosts list to a file.

👀 View

• Connections — Displays the connection list. To see detailed information about a connection press 'd', or press 'k' to kill it. To see the traffic for a specific connection, select it and press enter. Once the two-panel interface is displayed you can move the focus with the arrow keys. Press 'j' to switch between joined and split visualization. Press 'k' to kill the connection. Press 'y' to inject interactively and 'Y' to inject a file. Note that it is important which panel has the focus as the injected data will be sent to that address.

HINT: connections marked with an asterisk contain account(s) information.

• Profiles — Displays the passive profile hosts list. Selecting a host will display the relative details (including account with user and pass for that host). You can convert the passive profile list into the hosts list by pressing 'c'. To purge remote hosts, press 'l'. To purge local hosts, press 'r'. You can also dump the current profile to a file by pressing 'd'; the dumped file can be opened with etterlog(8).

HINT: profiles marked with an asterisk contain account(s) information.

• Statistics — Displays some statistics about the sniffing process.
• Resolve IP addresses — Enables DNS resolution for all the sniffed IP address. CAUTION: this will extremely slow down ettercap. By the way the passive dns resolution is always active. It sniffs dns replies and stores them in a cache. If an ip address is present in that cache, it will be automatically resolved. It is dns resolution for free... ;)
• Visualization method — Change the visualization method for the sniffed data. Available methods: ascii, hex, ebcdic, text, html.
• Visualization regex — Set the visualization regular expression. Only packets matching this regex will be displayed in the connection data window.
• Set the WiFi key — Set the WiFi key used to decrypt WiFi encrypted packets. See ettercap(8) for the format of the key.

💥 Mitm

• [...] — For each type of attack, a menu entry is displayed. Simply select the attack you want and fill the arguments when asked. You can activate more than one attack at a time.
• Stop mitm attack(s) — Stops all the mitm attacks currently active.

🧚 Filters

• Load a filter... — Load a precompiled filter file. The file must be compiled with etterfilter(8) before it can be loaded.
• Stop filtering — Unload the filter and stop filtering the connections.

📝 Logging

• Log all packets and infos... — Given a file name, it will create two files: filename.eci (for information about hosts) and filename.ecp (for all the interesting packets). This is the same as the -L option.
• Log only infos... — This is used only to sniff information about hosts (same as the -l option).
• Stop logging info — Come on... it is self explanatory.
• Log user messages... — Will log all the messages appearing in the bottom window (same as -m option).
• Compressed file — Asterisk-option to control whether or not the logfile should be compressed.

🧩 Plugins

• Manage the plugins — Opens the plugin management window. You can select a plugin and activate it by pressing 'enter'. Plugins already active can be recognized by the [1] symbol instead of [0]. If you select an active plugin, it will be deactivated.
• Load a plugin... — You can load a plugin file that is not in the default search path. (remember that you can browse directories with EC_UID permissions).

👑 ORIGINAL AUTHORS 👑

• Alberto Ornaghi (ALoR) <alor@users.sf.net>
• Marco Valleri (NaGA) <naga@antifork.org>

🌟 PROJECT STEWARDS 🌟

• Emilio Escobar (exfil) <eescobar@gmail.com>
• Eric Milam (Brav0Hax) <jbrav.hax@gmail.com>

🔥 OFFICIAL DEVELOPERS 🔥

• Mike Ryan (justfalter) <falter@gmail.com>
• Gianfranco Costamagna (LocutusOfBorg) <costamagnagianfranco@yahoo.it>
• Antonio Collarino (sniper) <anto.collarino@gmail.com>
• Ryan Linn <sussuro@happypacket.net>
• Jacob Baines <baines.jacob@gmail.com>

🫶 CONTRIBUTORS 🫶

• Dhiru Kholia (kholia) <dhiru@openwall.com>
• Alexander Koeppe (koeppea) <format_c@online.de>
• Martin Bos (PureHate) <purehate@backtrack.com>
• Enrique Sanchez
• Gisle Vanem <giva@bgnett.no>
• Johannes Bauer <JohannesBauer@gmx.de>
• Daten (Bryan Schneiders) <daten@dnetc.org>

🌈 SEE ALSO 🌈

ettercap(8) ettercap_plugins(8) etterlog(8) etterfilter(8) etter.conf(5) ettercap-pkexec(8)

---

💖 This manual page is out here living its best life as part of ettercap 0.8.4.1, page ETTERCAP-CURSES(8). Stay iconic, bestie. Periodt. 💅✨