Printable View
OK, so I am in a clench here, I use Ethereal and love it. I also use it with Cain. I would like to know if there is a good (hopefully free too) packet capture and recreator program out there for windows (xp). I am sure it has already been listed on here, but agh....boss wants info from a coworkers pc asap. I know ethereal can "recreate" the html, but its not in a pretty little website form. I would hate to decode ALL of the pages captured :(
Thanks (prays for no negs)
Hi
Not sure, what you really try to do, but there are well known tools
out there. Here is a small collection of the ones I best know, which
have the capability to manipulate or craft packets. This might enable
you to achieve what you want.
Burbproxy[1]
Ettercap[2]
Hping2[3]
Packet Excalibur[4]
Proxomitron[5]
Cheers
[1] http://portswigger.net/proxy/
[2] http://ettercap.sourceforge.net/
[3] http://wiki.hping.org/86
[4] http://www.securitybugware.org/excalibur/
[5] http://www.proxomitron.info/
Essentially I want to capture packets, then recreate them to the proper files (for example, capture HTML and have it be recreated into a file)
Try NetworkActiv in windows, I have a video of it here:
http://www.irongeek.com/i.php?page=videos/networkactiv
it should do what you want.
Hey Iron, I am going to presume that this does not require the network to be wifi correct? Other then that, it looks good.
As long as you can sniff it, it can try to put the files together. Wi-fi is not necessary for it to work.
Ok cool. Any hints on how to set this up...
Router IP .0.1
My IP .0.6
IP needed to be monitored .0.2
I am thinking Cain will come in handy...do I need to activate the sniffer AND APR or just one or the other? BTW, thanks for your help with all of this.
If it will let you just APR with Cain.
hi all,
are there any open source tools for that i.e. recreating the streams from packets e.g. like irc conversation, html pages etc.
Thanks
Quote:
Originally posted here by mmkhan
hi all,
are there any open source tools for that i.e. recreating the streams from packets e.g. like irc conversation, html pages etc.
Thanks
The Dsniff package comes with some tools (filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy) that do some of that:
http://www.monkey.org/~dugsong/dsniff/
checkout tcpflow (http://www.circlemud.org/~jelson/software/tcpflow/)
Quote:
tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis.
Thanks
Kudos to Iron for sharing the link to NetworkActiv. I love this program. Its simple and don't use much space/resources or hog the memory. It tells a lot of info also :))
I will second that phatcat. I used this program just a few days ago. Combined with Caine, doing the ARP poisoning...I now am down one less coworker....
A word of advice to those out there...if its something you just maybe shouldnt be doing...dont do it. If your boss wants to find it, he/she will.
Maybe It's just me, but if your boss asked you to observe the actions of a user on the computer i'd assume that you are a net admin or someone similar on that network. So why are you using Cain to sniff the data. Couldn't you just setup a snort box/proxy? I'm also assming that this person is doing bad stuff on the internet or whatever. The reason I ask is because i just read a book about K.M. and he talkes a lot about social engineering and deception and stuff. But then again I assume that many of the users of this site are sketchy characters also and just pretent that the information that they give out is being used as productive and to counter malicious computer users.
Actually, no, Im not a net admin.....my boss knows that I am "in" the hackers/crackers/call it what you want field...meaning I associate with them...not that I do "bad things"....
He presented this more of a challenge than anything else. Setting up a snort box/proxy would take more time then simply firing up Cain, dont ya think?