DSniff

Template:Short description Template:Lowercase {{#invoke:Infobox|infobox}}Template:Template other{{#invoke:Check for unknown parameters | check | showblankpositional=1 | unknown = Template:Main other | preview = Page using Template:Infobox software with unknown parameter "_VALUE_"|ignoreblank=y | AsOf | author | background | bodystyle | caption | collapsetext | collapsible | developer | discontinued | engine | engines | genre | included with | language | language count | language footnote | latest preview date | latest preview version | latest release date | latest release version | latest_preview_date | latest_preview_version | latest_release_date | latest_release_version | licence | license | logo | logo alt | logo caption | logo upright | logo size | logo title | logo_alt | logo_caption | logo_upright | logo_size | logo_title | middleware | module | name | operating system | operating_system | other_names | platform | programming language | programming_language | released | replaced_by | replaces | repo | screenshot | screenshot alt | screenshot upright | screenshot size | screenshot title | screenshot_alt | screenshot_upright | screenshot_size | screenshot_title | service_name | size | standard | title | ver layout | website | qid }}Template:Main other

dSniff is a set of password sniffing and network traffic analysis tools written by security researcher and startup founder Dug Song to parse different application protocols and extract relevant information. dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a network for interesting data (passwords, e-mail, files, etc.). arpspoof, dnsspoof, and macof facilitate the interception of network traffic normally unavailable to an attacker (e.g., due to layer-2 switching). sshmitm and webmitm implement active man-in-the-middle attacks against redirected SSH and HTTPS sessions by exploiting weak bindings in ad-hoc PKI.<ref>dsniff</ref><ref name=Russel2001>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

Overview

The applications sniff usernames and passwords, web pages being visited, contents of an email, etc. As the name implies, dsniff is a network sniffer, but it can also be used to disrupt the normal behavior of switched networks and cause network traffic from other hosts on the same network segment to be visible, not just traffic involving the host dsniff is running on.

It handles FTP, Telnet, SMTP, HTTP, POP, poppass, NNTP, IMAP, SNMP, LDAP, Rlogin, RIP, OSPF, PPTP MS-CHAP, NFS, VRRP, YP/NIS, SOCKS, X11, CVS, IRC, AIM, ICQ, Napster, PostgreSQL, Meeting Maker, Citrix ICA, Symantec pc Anywhere, NAI Sniffer, Microsoft SMB, Oracle SQL*Net, Sybase and Microsoft SQL protocols.

The name "dsniff" refers both to the package as well as an included tool. The "dsniff" tool decodes passwords sent in cleartext across a switched or unswitched Ethernet network. Its man page explains that Dug Song wrote dsniff with "honest intentions - to audit my own network, and to demonstrate the insecurity of cleartext network protocols." He then requests, "Please do not abuse this software."

These are the files that are configured in dsniff folder /etc/dsniff/

/etc/dsniff/dnsspoof.hosts

Sample hosts file.<ref>dnsspoof(8) - Linux man page</ref>

If no host file is specified, replies will be forged for all address queries on the LAN with an answer of the local machine’s IP address.

/etc/dsniff/dsniff.magic

Network protocol magic

/etc/dsniff/dsniff.services

Default trigger table

The man page for dsniff explains all the flags. To learn more about using dsniff, you can explore the Linux man page.<ref>dsniff(8): password sniffer - Linux man page</ref>

This is a list of descriptions for the various dsniff programs. This text belong to the dsniff “README” written by the author, Dug Song.

See also

• Comparison of packet analyzers
• EtherApe, a network mapping tool that relies on sniffing traffic
• netsniff-ng, a free Linux networking toolkit
• Network tap
• Ngrep, a tool that can match regular expressions within the network packet payloads
• tcpdump, a packet analyzer
• Tcptrace, a tool for analyzing the logs produced by tcpdump
• Wireshark, a GUI based alternative to tcpdump

External links

• Official website
• Dunston, Duane, Linuxsecurity.com, “And away we spoof!!!” http://www.linuxsecurity.com/docs/PDF/dsniff-n-mirror.pdf