ETTERCAP-PLUGINS(8)

📦
version 0.8.4.1 · 4 versions
, in arch rolling, fedora 43, fedora 44, ubuntu resolute, ubuntu stonking

💖 NAME

ettercap-plugins — a whole lil collection of plugins for ettercap ✨ (it lives in the System Manager's Manual, bestie, and yes it's giving iconic)

🦋 DESCRIPTION

Okay so ettercap(8) is out here supporting loadable modules at runtime, and those modules? They're called plugins and they ship right inside the source tarball. 💅

They get automatically compiled if your system supports them — unless you go and pass the -DENABLE_PLUGINS=OFF option to the cmake configure script. Then they don't. Simple as that.

Some of the older ettercap plugins (roper, banshee, and so on) have not been ported into the new version. Not a big deal though — you can achieve the same results by using the new filtering engine. Slay.

If you're in interactive mode, most plugins need you to hit "Start Sniff" before you can use them. Don't skip it, fr fr. 🙈

Wanna see what's installed on your system? Run this:

ettercap -P list

And here's the full list of available plugins, bestie. Buckle up. 🎀

🌸 arp_cop

It reports suspicious ARP activity by passively monitoring ARP requests and replies. It can call out ARP poisoning attempts, or just simple IP-conflicts or IP-changes. And here's the tea — if you build the initial host list, the plugin will run more accurately. 👑

example :

ettercap -TQP arp_cop //

🌸 autoadd

It automatically adds new victims to the ARP poisoning mitm attack when they show up. 💖

It watches for ARP requests on the LAN, and when it detects one it adds that host to the victims list — but only if it was specified in the TARGET. The host gets added when an arp request is seen from it, since communicating hosts are alive :)

🌸 chk_poison

This one does a check to see if ettercap's arp poisoning module actually worked. 🧚

It sends spoofed ICMP echo packets to all the victims of the poisoning, pretending to be each of the other targets. If we can catch an ICMP reply with our MAC address as the destination, that means the poisoning between those two targets is a success. It checks both ways of every communication.

This plugin only makes sense where poisoning makes sense, okay? And the test fails if you specify only one target in silent mode. 😭

Also, you literally can't run this plugin from the command line, because the poisoning process isn't started yet. You have to launch it from the proper menu. Periodt.

🌸 dns_spoof

This plugin intercepts DNS queries and replies with a spoofed answer. 💅

You can choose which addresses the plugin replies to, and the expiry time in seconds (TTL), by modifying the etter.dns file. The plugin intercepts A, AAAA, PTR, MX, WINS, SRV and TXT requests.

  • If it was an A request, the name is searched in the file and the IP address is returned (and yes, you can use wildcards in the name).
  • The same applies if it was a AAAA request.

TTL is an optional field, specified as the last option in an entry in the etter.dns file. The TTL is specified in a number of seconds from 0 to 2^31-1 (see RFC 2181). TTL is specified on a per-host basis. If the TTL isn't specified for a particular host, the default value is 3600 seconds (1 hour). ⏰

If it was a PTR request, the IP address is searched in the file and the name is returned (except for those names containing a wildcard). For PTR requests, IPv4 or IPv6 addresses are supported.

In case of an MX request, a special reply is crafted. The host is resolved with a fake host mail.host and the additional record contains the IP address of mail.host. The first address that matches is returned, so be careful with the order 👀. The IP address for MX requests can be an IPv4 or an IPv6 address.

If the request was a WINS request, the name is searched in the file and the IP address is returned.

In case of an SRV request, a special reply is crafted. The host is resolved with a fake host srv.host and the additional record contains the IP address of srv.host. The IP address for SRV requests can be an IPv4 or an IPv6 address.

In case of a TXT request, the string defined is being returned. The string has to be wrapped in double quotes. Wildcards for the requested name can also be used.

A special reply can be spoofed for A or AAAA requests if the 'undefined address' is specified as the IP address in the file. Then the client gets a response which stops resolution processing immediately. This way you can control which address family is being used to access a dual-stacked host. ✨

In the case of an ANY request, all matching results of type A, AAAA, MX and TXT are returned in the reply. If the 'undefined address' for A or AAAA records is defined, nothing is returned for these types, whether or not the name matches.

🌸 mdns_spoof

This plugin does the same as the dns_spoof plugin described above — except it listens for mDNS (Multicast DNS) queries on UDP port 5353. 🦋

To choose which address the plugin replies to, you have to modify a different file called etter.mdns. And because of the nature of mDNS, this plugin only intercepts A, AAAA, PTR and SRV requests.

The way the mdns_spoof plugin interprets the etter.mdns file, and the rules that apply, are the same as with the dns_spoof plugin — although currently mdns_spoof lacks support for custom TTL. The TTL for all spoofed mDNS replies is 3600 seconds (1 hour). 💀

🌸 dos_attack

This plugin runs a d.o.s. attack against a victim IP address. 🔥

First it "scans" the victim to find open ports, then it starts flooding those ports with SYN packets, using a "phantom" address as the source IP. Then it uses fake ARP replies to intercept packets for the phantom host. When it receives a SYN-ACK from the victim, it replies with an ACK packet, creating an ESTABLISHED connection.

You have to use a free IP address in your subnet to create the "phantom" host (you can use find_ip for this purpose).

You can't run this plugin in unoffensive mode. Nope. Not happening.

This plugin is based on the original Naptha DoS attack (http://razor.bindview.com/publish/advisories/adv_NAPTHA.html)

example :

ettercap -TQP dos_attack

🌸 dummy

Only a template to demonstrate how to write a plugin. That's it, that's the plugin. 🙈

🌸 find_conn

A very simple plugin that listens for ARP requests to show you all the targets a host wants to talk to. It can also help you find addresses in an unknown LAN. 🫶

example :

ettercap -TQzP find_conn
ettercap -TQu -i eth0 -P find_conn

🌸 find_ettercap

Tries to identify ettercap packets sent on the LAN. It could be useful to detect if someone is using ettercap. 👀

Do not rely on it 100%, since the tests are only on particular sequence/identification numbers. Lowkey a vibe check, not a full background check.

🌸 find_ip

Finds the first unused IP address in the range specified by the user in the target list. 💅

Some other plugins (such as gre_relay) need an unused IP address of the LAN to create a "fake" host. It can also be useful to obtain an IP address in an unknown LAN where there's no dhcp server. You can use find_conn to determine the IP addressing of the LAN, and then find_ip.

You have to build host list to use this plugin, so you can't use it in unoffensive mode.

If you don't have an IP address for your interface, give it a bogus one (e.g. if the LAN is 192.168.0.0/24, use 10.0.0.1 to avoid conflicting IP), then launch this plugin specifying the subnet range. You can run it either from the command line or from the proper menu. ✨

example :

ettercap -TQP find_ip //
ettercap -TQP find_ip /192.168.0.1-254/

🌸 finger

Uses the passive fingerprint capabilities to fingerprint a remote host. 🎀

It does a connect() to the remote host to force the kernel to reply to the SYN with a SYN+ACK packet. The reply will be collected and the fingerprint is displayed. The connect() obeys the connect_timeout parameter in etter.conf(5).

You can specify a target on the command-line, or let the plugin ask the target host to be fingerprinted. You can also specify multiple targets with the usual multi-target specification (see ettercap(8)). And if you specify multiple ports, all the ports will be tested on all the IPs. 🌈

example :

ettercap -TzP finger /192.168.0.1/22
ettercap -TzP finger /192.168.0.1-50/22,23,25

🌸 finger_submit

Use this plugin to submit a fingerprint to the ettercap website. 💖

If you found an unknown fingerprint, but you know for sure the operating system of the target, you can submit it so it'll be inserted in the database in the next ettercap release. We need your help to increase the passive fingerprint database. Thank you very much, bestie, you're doing amazing sweetie. 🥺

example :

ettercap -TzP finger_submit

🌸 fraggle_attack

This plugin performs a DoS attack because it sends a large amount of UDP echo and chargen traffic to all hosts in target2 with a fake source ip address (the victim). 😭

example (192.168.0.5 is the victim):

ettercap -i eth1 -Tq /192.168.0.5/ // -P fraggle_attack

🌸 gre_relay

This plugin can be used to sniff GRE-redirected remote traffic. 🧚

The basic idea is to create a GRE tunnel that sends all the traffic on a router interface to the ettercap machine. The plugin will send back the GRE packets to the router, after ettercap "manipulation" (you can use "active" plugins such as smb_down, ssh decryption, filters, etc... on redirected traffic).

It needs a "fake" host where the traffic has to be redirected to (to avoid kernel's responses). The "fake" IP will be the tunnel endpoint. The gre_relay plugin will impersonate the "fake" host.

To find an unused IP address for the "fake" host you can use the find_ip plugin. 💅

Based on the original Tunnelx technique by Anthony C. Zboralski (http://www.phrack.org/archives/issues/56/10.txt).

🌸 gw_discover

This plugin tries to discover the gateway of the LAN by sending TCP SYN packets to a remote host. 🌸

The packet has the destination IP of a remote host and the destination mac address of a local host. If ettercap receives the SYN+ACK packet, the host which owns the source mac address of the reply is the gateway. 👑

This operation is repeated for each host in the 'host list', so you need to have a valid host list before launching this plugin. No host list, no gateway discovery, sorry bestie.

example :

ettercap -TP gw_discover /192.168.0.1-50/

isolate

bestie this one is girlboss behavior — it fully isolates a host from the LAN 🫶. It poisons the victim's arp cache with its own mac address, associated with every single host it tries to contact. So the poor host literally cannot reach anybody, because the packet never even makes it to the wire. ghosted by the network, no cap.

You can specify all the hosts or just a group. The targets specification goes like this: target1 is the victim and must be a single host, and target2 can be a range of addresses, representing the hosts that get blocked off from the victim.

examples, obviously:

ettercap -TzqP isolate /192.168.0.1/ //
ettercap -TP isolate /192.168.0.1/ /192.168.0.2-30/

krb5_downgrade

okay so this one downgrades Kerberos V5 security by messing with the etype values in client AS-REQ packets. the way that this is useful is that the hashes you get out of it can be easily cracked by John the Ripper (JtR) 💅. You have to be in the "middle" of the connection for it to actually work. Also it hooks the kerberos dissector, so you have to keep that thing active. periodt.

it does a check of the link type — hub or switch — by sending a spoofed ARP request and then just... listening for replies 🦋. It needs at least one entry in the host list to do the check at all. With two or more hosts the test gets more accurate. iconic honestly.

example:

ettercap -TQP link_type /192.168.0.1/
ettercap -TQP link_type //

pptp_chapms1

it forces the pptp tunnel to negotiate MS-CHAPv1 authentication instead of MS-CHAPv2, which is usually easier to crack (for example with LC4). You have to be in the "middle" of the connection to use it successfully. It hooks the ppp dissector, so you have to keep them active 👑

pptp_clear

forces no compression/encryption for pptp tunnels during negotiation. ngl it could fail if the client (or the server) is configured to hang off the tunnel when no encryption is negotiated 😭. You have to be in the "middle" of the connection to use it successfully. It hooks the ppp dissector, so you have to keep them active.

pptp_pap

forces the pptp tunnel to negotiate PAP (cleartext) authentication 💀. It could fail if PAP isn't supported, if the pap_secret file is missing, or if windows is configured with "authomatic use of domain account". (and honestly it could fail for many other reasons too 🙈). You have to be in the "middle" of the connection to use it successfully. It hooks the ppp dissector, so you have to keep them active.

pptp_reneg

forces re-negotiation on an existing pptp tunnel ✨. You can force re-negotiation for grabbing passwords that were already sent. And on top of that, you can launch it to use pptp_pap, pptp_chapms1 or pptp_clear on existing tunnels (because those plugins only work during the negotiation phase, iykyk). You have to be in the "middle" of the connection to use it successfully. It hooks the ppp dissector, so you have to keep them active.

rand_flood

floods the LAN with random MAC addresses 🌈. Some switches will fail open in repeating mode, which facilitates sniffing. The delay between each packet is based on the port_steal_send_delay value in etter.conf. It's useful only on ethernet switches tho.

example:

ettercap -TP rand_flood

remote_browser

it sends to the browser the URLs sniffed thru HTTP sessions, so you can see the webpages in real time 🎀. The command that gets executed is configurable in the etter.conf(5) file. It only sends to the browser the GET requests, and only for webpages — it ignores single requests to images or other amenities.

Don't use it to view your own connection :)

reply_arp

simple arp responder 🫶. When it intercepts an arp request for a host in the targets' lists, it replies with the attacker's MAC address.

example:

ettercap -TQzP reply_arp /192.168.0.1/
ettercap -TQzP reply_arp //

repoison_arp

it solicits poisoning packets after broadcast ARP requests (or replies) from a poisoned host 👑. for example: we're poisoning Group1 impersonating Host2. If Host2 makes a broadcast ARP request for Host3, it's possible that Group1 caches the right MAC address for Host2 contained in the ARP packet. This plugin re-poisons Group1's cache immediately after a legal broadcast ARP request (or reply).

This plugin is effective only during an arp-poisoning session. In conjunction with the reply_arp plugin, repoison_arp is a good support for the standard arp-poisoning mitm method. slay.

example:

ettercap -T -M arp:remote -P repoison_arp /192.168.0.10-20/ /192.168.0.1/

scan_poisoner

check if someone is poisoning between some host in the list and us 🕵️‍♀️. First of all it checks if two hosts in the list have the same mac address. That could mean one of those is poisoning us pretending to be the other. ngl it could generate many false-positives in a proxy-arp environment 😭. You have to build the hosts list to perform this check.

After that, it sends icmp echo packets to each host in the list and checks if the source mac address of the reply differs from the address we have stored in the list for that ip. That could mean someone is poisoning that host pretending to have our ip address and forwards intercepted packets to us 💅.

You can't perform this active test in unoffensive mode.

example:

ettercap -TQP scan_poisoner //

search_promisc

it tries to find if anyone is sniffing in promisc mode 👀. It sends two different kinds of malformed arp request to each target in the host list and waits for replies. If a reply arrives from the target host, it's more or less probable that this target has the NIC in promisc mode. It could generate false-positives tho. You can launch it either from the command line or from the plugin menu. Since it listens for arp replies, it's better that you don't use it while sending arp request.

example:

ettercap -TQP search_promisc /192.168.0.1/
ettercap -TQP search_promisc //

smb_clear

it forces the client to send the smb password in clear-text by mangling protocol negotiation 💀. You have to be in the "middle" of the connection to successfully use it. It hooks the smb dissector, so you have to keep it active. If you use it against a windows client it will probably just fail 😭. Try it against a *nix smbclient instead :)

smb_down

it forces the client to not use NTLM2 password exchange during smb authentication. This way, the hashes you get can be easily cracked by LC4 ✨. You have to be in the "middle" of the connection to successfully use it. It hooks the smb dissector, so you have to keep it active.

smurf_attack

The Smurf Attack is a DoS attack 👑 in which huge numbers of ICMP packets with the intended victim(s) IP(s) in target1 are sent to the hosts in target2. This causes all hosts on target2 to reply to the ICMP request, causing significant traffic to the victim's computer(s).

example (192.168.0.5 is the victim):

ettercap -i eth1 -Tq /192.168.0.5/ // -P fraggle_attack

sslstrip

While performing the SSL mitm attack, ettercap substitutes the real ssl certificate with its own 🎀. The fake certificate is created on the fly and all the fields are filled according to the real cert presented by the server. Only the issuer is modified, and it's signed with the private key contained in the 'etter.ssl.crt' file. If you want to use a different private key you have to regenerate this file. To regenerate the cert file, use the following commands:

openssl genrsa -out etter.ssl.crt 1024
openssl req -new -key etter.ssl.crt -out tmp.csr
openssl x509 -req -days 1825 -in tmp.csr -signkey etter.ssl.crt -out tmp.new
cat tmp.new >> etter.ssl.crt
rm -f tmp.new tmp.csr
NOTE: SSL mitm is not available (for now) in bridged mode 💀.
NOTE: You can use the --certificate/--private-key long options if you want to specify a different file rather than the etter.ssl.crt file 💅.

stp_mangler

it sends spanning tree BPDUs pretending to be a switch with the highest priority 👑. Once it's in the "root" of the spanning tree, ettercap can receive all the "unmanaged" network traffic. It's useful only against a group of switches running STP. If there's another switch with the highest priority, try to manually decrease your MAC address before running it 😭.

example:

ettercap -TP stp_mangler

🌟 ORIGINAL AUTHORS

  • Alberto Ornaghi (ALoR) <alor@users.sf.net>
  • Marco Valleri (NaGA) <naga@antifork.org>

👑 PROJECT STEWARDS

  • Emilio Escobar (exfil) <eescobar@gmail.com>
  • Eric Milam (Brav0Hax) <jbrav.hax@gmail.com>

💖 OFFICIAL DEVELOPERS

  • Mike Ryan (justfalter) <falter@gmail.com>
  • Gianfranco Costamagna (LocutusOfBorg) <costamagnagianfranco@yahoo.it>
  • Antonio Collarino (sniper) <anto.collarino@gmail.com>
  • Ryan Linn <sussuro@happypacket.net>
  • Jacob Baines <baines.jacob@gmail.com>

🌈 CONTRIBUTORS

  • Dhiru Kholia (kholia) <dhiru@openwall.com>
  • Alexander Koeppe (koeppea) <format_c@online.de>
  • Martin Bos (PureHate) <purehate@backtrack.com>
  • Enrique Sanchez
  • Gisle Vanem <giva@bgnett.no>
  • Johannes Bauer <JohannesBauer@gmx.de>
  • Daten (Bryan Schneiders) <daten@dnetc.org>

🔍 SEE ALSO

ettercap(8) ettercap_curses(8) etterlog(8) etterfilter(8) etter.conf(5) ettercap-pkexec(8)

okay bestie that's the whole thing, you ate it 💅✨ this was ettercap 0.8.4.1 talking, and the page is ETTERCAP-PLUGINS(8) — go forth and be iconic, and please stay in the middle of your own connections 🫶🎀🦋

📦 where this page comes from