Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Ettercap (software)
open-in-new
<h2 id="functionality">Functionality</h2> <p>Ettercap works by putting the network interface into <a href="/facts/Promiscuous_mode/DBcSVsK4">promiscuous mode</a> and by <a href="/facts/ARP_poisoning/NcWv5skQ">ARP poisoning</a> the target machines. Thereby it can act as a 'man in the middle' and unleash various attacks on the victims. Ettercap has plugin support so that the features can be extended by adding new plugins. </p> <h2 id="features">Features</h2> <p>Ettercap supports active and passive dissection of many <a href="/facts/Protocol_(computing)/5uady7cB">protocols</a> (including ciphered ones) and provides many features for network and host analysis. Ettercap offers four modes of operation: </p> <ul><li>IP-based: packets are filtered based on IP source and destination.</li> <li>MAC-based: packets are filtered based on <a href="/facts/MAC_address/SVcTfgUH">MAC address</a>, useful for sniffing connections through a gateway.</li> <li><a href="/facts/Address_Resolution_Protocol/1QyKybkn">ARP</a>-based: uses ARP poisoning to sniff on a switched LAN between two hosts (full-duplex).</li> <li>PublicARP-based: uses ARP poisoning to sniff on a switched LAN from a victim host to all other hosts (half-duplex).</li></ul> <p>In addition, the software also offers the following features: </p> <ul><li>Character injection into an established connection: characters can be injected into a <a href="/facts/Server_(computing)/dEaYFD7r">server</a> (emulating commands) or to a <a href="/facts/Client_(computing)/u0wlVsWI">client</a> (emulating replies) while maintaining a live connection.</li> <li>SSH1 support: the sniffing of a username and password, and even the data of an SSH1 connection. Ettercap is the first software capable of <a href="/facts/Packet_sniffer/mFQP7gWB">sniffing</a> an <a href="/facts/Secure_Shell/wjVRw5zv">SSH</a> connection in full duplex.</li> <li>HTTPS support: the sniffing of HTTP <a href="/facts/Secure_Sockets_Layer/pGy16TnA">SSL</a> secured data—even when the connection is made through a <a href="/facts/Proxy_server/ArhwQE74">proxy</a>.</li> <li>Remote traffic through a <a href="/facts/Generic_Routing_Encapsulation/0TQRDUMK">GRE</a> tunnel: the sniffing of remote traffic through a GRE tunnel from a remote <a href="/facts/Cisco_Systems/ocDgQt6T">Cisco</a> <a href="/facts/Router_(computing)/Nh5cIyVf">router</a>, and perform a <a href="/facts/Man-in-the-middle_attack/dx4cojdz">man-in-the-middle attack</a> on it.</li> <li>Plug-in support: creation of custom plugins using Ettercap's <a href="/facts/Application_Programming_Interface/GMlN4vUr">API</a>.</li> <li>Password collectors for: <a href="/facts/TELNET/hxT0e85h">TELNET</a>, <a href="/facts/File_Transfer_Protocol/THuWgzfw">FTP</a>, <a href="/facts/Post_Office_Protocol/QCp6qJQm">POP</a>, <a href="/facts/IMAP/QMnyvUwk">IMAP</a>, <a href="/facts/Rlogin/fB8rLwNJ">rlogin</a>, <a href="/facts/Secure_Shell/wjVRw5zv">SSH1</a>, <a href="/facts/ICQ/FnbSJ1GR">ICQ</a>, <a href="/facts/Server_Message_Block/pWM35pl8">SMB</a>, <a href="/facts/MySQL/QEEDNBDP">MySQL</a>, <a href="/facts/Hypertext_Transfer_Protocol/TWtvf7JD">HTTP</a>, <a href="/facts/Network_News_Transfer_Protocol/YTgxGqgR">NNTP</a>, <a href="/facts/X_Window_System/ac2vRIQL">X11</a>, <a href="/facts/Napster/49fjWRT7">Napster</a>, <a href="/facts/Internet_Relay_Chat/oDr3VN9q">IRC</a>, <a href="/facts/Routing_Information_Protocol/xGeIuGk6">RIP</a>, <a href="/facts/Border_Gateway_Protocol/XfYgBzW3">BGP</a>, <a href="/facts/SOCKS/kVEIma4v">SOCKS 5</a>, <a href="/facts/Internet_Message_Access_Protocol/QMnyvUwk">IMAP 4</a>, <a href="/facts/Virtual_Network_Computing/xTmWVgV4">VNC</a>, <a href="/facts/Lightweight_Directory_Access_Protocol/KgpfD8nR">LDAP</a>, <a href="/facts/Network_File_System_(protocol)/jWRRALVo">NFS</a>, <a href="/facts/Simple_Network_Management_Protocol/UNYPVA1C">SNMP</a>, <a href="/facts/MSN_Messenger/Fan8DcWu">MSN</a>, <a href="/facts/Yahoo!_Messenger_Protocol/PnasnCfV">YMSG</a></li> <li>Packet filtering/dropping: setting up a filter that searches for a particular string (or hexadecimal sequence) in the <a href="/facts/Transmission_Control_Protocol/WW4sPrt9">TCP</a> or <a href="/facts/User_Datagram_Protocol/dxLU0D6q">UDP</a> payload and replaces it with a custom string/sequence of choice, or drops the entire packet.</li> <li><a href="/facts/TCP/IP_stack_fingerprinting/2hFXJudG">TCP/IP stack fingerprinting</a>: determine the <a href="/facts/Operating_system/8XTuvMh2">OS</a> of the victim host and its network adapter.</li> <li>Kill a connection: killing connections of choice from the connections-list.</li> <li>Passive scanning of the <a href="/facts/Local_area_network/edUDxJ6J">LAN</a>: retrieval of information about hosts on the LAN, their open <a href="/facts/TCP_and_UDP_port/ygoHVKNC">ports</a>, the version numbers of available <a href="/facts/Network_service/GdLvd2ml">services</a>, the type of the host (<a href="/facts/Gateway_(computer_networking)/YTYSqhqN">gateway</a>, <a href="/facts/Router_(computing)/Nh5cIyVf">router</a> or simple <a href="/facts/Personal_computer/koaYfNce">PC</a>) and estimated distances in number of <a href="/facts/Hop_(telecommunications)/fhPhdaVJ">hops</a>.</li> <li>Hijacking of <a href="/facts/Domain_Name_System/rfxdWFsj">DNS</a> requests.</li></ul> <p>Ettercap also has the ability to actively or passively find other poisoners on the LAN. </p> <h2 id="see-also">See also</h2> <ul> <li>Free and open-source software portal</li></ul> <ul><li><a href="/facts/ArpON/Sd7t6I8C">ArpON</a></li> <li><a href="/facts/Arpwatch/sJ4cpvgM">arpwatch</a></li></ul> <h2 id="external-links">External links</h2> <ul><li><a href="http://www.ettercap-project.org">Official website</a></li> <li><a href="http://www.iemag.ru/analitics/detail.php?ID=16096">An article "Реагирование на инциденты информационной безопасности"</a></li> <li><a href="http://securos.org.ua/ettercap-universalnyj-analizator-trafika/">An article "Ettercap: универсальный анализатор трафика"</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>"The men behind ettercapNG". Linux.com. 2004-11-09. Retrieved 2021-08-20. <a href="https://www.linux.com/news/men-behind-ettercapng/" target="_blank">https://www.linux.com/news/men-behind-ettercapng/</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>Jeffries, Adrianne (2013-09-13). "Meet Hacking Team, the company that helps the police hack you". The Verge. Retrieved 2021-08-20. <a href="https://www.theverge.com/2013/9/13/4723610/meet-hacking-team-the-company-that-helps-police-hack-into-computers" target="_blank">https://www.theverge.com/2013/9/13/4723610/meet-hacking-team-the-company-that-helps-police-hack-into-computers</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> </ol>