net-creds.py: un script en python para obtener las contraseñas y hashes mediante un interfaz o fichero pcap
net-creds.py es un script escrito en python para obtener las contraseñas y hashes esnifando mediante un interfaz o analizando un archivo pcap. Concatena los paquetes fragmentados y no se basa en los puertos para la identificación del servicio. Por el momento soporta:
root@kali:~# git clone https://github.com/DanMcInerney/net-creds.git
root@kali:~# cd net-creds/
root@kali:~/net-creds# pip install -r requirements.txt
Downloading/unpacking scapy==2.3.1 (from -r requirements.txt (line 1))
Downloading scapy-2.3.1.zip (1.1Mb): 1.1Mb downloaded
Running setup.py egg_info for package scapy
Requirement already satisfied (use --upgrade to upgrade): wsgiref==0.1.2 in /usr/lib/python2.7 (from -r requirements.txt (line 2))
Installing collected packages: scapy
Found existing installation: scapy 2.2.0
Uninstalling scapy:
Successfully uninstalled scapy
Running setup.py install for scapy
changing mode of build/scripts-2.7/scapy from 644 to 755
changing mode of build/scripts-2.7/UTscapy from 644 to 755
changing mode of /usr/local/bin/UTscapy to 755
changing mode of /usr/local/bin/scapy to 755
Successfully installed scapy
Cleaning up...
Y también su uso:
Auto-detectar el interfaz a esnifar
sudo python net-creds.py
Elige eth0 como interface
sudo python net-creds.py -i eth0
Ignora paquetes a y desde 192.168.0.2
sudo python net-creds.py -f 192.168.0.2
Lee desde pcap
python net-creds.py -p pcapfile
Github: https://github.com/DanMcInerney/net-creds
- URLs visitadas
- POST enviados
- logins/passwords de formularios HTTP
- logins/passwords de autenticación básica HTTP
- búsquedas HTTP
- logins/passwords FTP
- logins/passwords IRC
- logins/passwords POP
- logins/passwords IMAP
- logins/passwords Telnet
- logins/passwords SMTP
- Cadenas de comunidades SNMP
- protocolo NTLMv1/v2 como HTTP, SMB, LDAP, etc
- Kerberos
root@kali:~# git clone https://github.com/DanMcInerney/net-creds.git
root@kali:~# cd net-creds/
root@kali:~/net-creds# pip install -r requirements.txt
Downloading/unpacking scapy==2.3.1 (from -r requirements.txt (line 1))
Downloading scapy-2.3.1.zip (1.1Mb): 1.1Mb downloaded
Running setup.py egg_info for package scapy
Requirement already satisfied (use --upgrade to upgrade): wsgiref==0.1.2 in /usr/lib/python2.7 (from -r requirements.txt (line 2))
Installing collected packages: scapy
Found existing installation: scapy 2.2.0
Uninstalling scapy:
Successfully uninstalled scapy
Running setup.py install for scapy
changing mode of build/scripts-2.7/scapy from 644 to 755
changing mode of build/scripts-2.7/UTscapy from 644 to 755
changing mode of /usr/local/bin/UTscapy to 755
changing mode of /usr/local/bin/scapy to 755
Successfully installed scapy
Cleaning up...
Y también su uso:
Auto-detectar el interfaz a esnifar
sudo python net-creds.py
Elige eth0 como interface
sudo python net-creds.py -i eth0
Ignora paquetes a y desde 192.168.0.2
sudo python net-creds.py -f 192.168.0.2
Lee desde pcap
python net-creds.py -p pcapfile
Github: https://github.com/DanMcInerney/net-creds
Esta muy bueno, gracias por compartir la info. Lo probe y para las peticiones http anda muy bien, para las peticiones https naranjas, disculpen mi ignorancia pero este tipo de sniffer se puede implementar en una red para ver todos las peticiones get que se realizan dia a dia?
ResponderEliminarSaludos