From their website, "Ettercap is a suite for man in the middle attacks on LAN. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols (even ciphered ones) and includes many feature for network and host analysis."
Ettercap is a very handy auditing tool when performing a pen-test for an organization. The best feature of Ettercap is its extensibility though the use of plug-ins. The most useful and thus most used plug-ins are included with Ettercap, with my favourites being dns_spoof, arp_spoof, and gw_discover. I selected gw_discover because it's usefulness is applicable to the University of Montana. The gw_discover plug-in finds alternative gateways in situations where users are meant to VPN, much like the University of Montana and it's UMAPS WiFi. The U displays UMAPS as an open wireless access point, however once connected students need Cisco's VPN software package to connect. Gw_discover could potentially find a new gateway, allowing students to use the wifi without authenticating. I don't know how bad it would be if students didn't authenticate before using the U's WiFi, but I do know it would be cool if it worked.
Links:
http://ettercap.sourceforge.net/
http://www.irongeek.com/i.php?page=videos/ettercap-plugins-find-ip-gw-discover-isolate
No comments:
Post a Comment