Detailed description of common sniffing tools used by hackers in Linux

1. Overview

This article analyzes in detail several sniffing devices that hackers often use in Linux, which are often planted on victim servers after being infiltrated by intruders. These sniffing devices have different characteristics. Some are simple to capture user names and passwords, while others are very powerful to record all network data streams. This article will analyze the following sniffer types:

Linsniffer

Linuxsniffer

Hunt

Sniffit

2. linsniffer

Linsniffer is a simple and practical sniffer. Its main feature is to capture the user name and password, which is outstanding in this regard.

By Mike Edulla

Condition: C and IP header file

Configuration File: None

Location: http://agape.trilidun.org/hack/network-sniffers/linsnifferc

Security history: None

Note: It is easy to use. However, lnsniffer requires a complete IP header file, including the header files that are often stored in/usr/include/net and/usr/include/netinet. Before compilation, ensure that the PATH variable contains/usr/include.

Use the following command to compile lnsniffer:

$ Cc linsniffer. c-o linsniffer

To run linsniffer, run the following command:

$ Linsniffer

After the startup, linsniffer will create an empty file: tcp. log to store the sniffing result.

In the test, I created a user named hapless with the password "unaware. Then, use this user to log on to the Linux server and perform some common user operations. The following is an ftp process:

GPS $ ftp 192.168.0.2

Connected to 192.168.0.2.

220 linux.test.net FTP server Wed Aug 19 02:55:52 MST 1998) ready.

Name (192.168.0.2: root): hapless

331 Password required for hapless.

Password:

230 User hapless logged in.

Remote system type is UNIX.

Using binary mode to transfer files.

Ftp> ls-al

200 PORT command successful.

150 Opening ASCII mode data connection for/bin/ls.

Total 14

Drwxrwxr-x 4 hapless 1024 May 20 19:35.

Drwxr-xr-x 6 root 1024 May 20 ..

-Rw-r -- 1 hapless 96 May 20 19:56. bash_history

-Rw-r -- 1 hapless 49 Nov 25 1997. bash_logout

-Rw-r -- 1 hapless 913 Nov 24 1997. bashrc

-Rw-r -- 1 hapless 650 Nov 24 1997. cshrc

-Rw-r -- 1 hapless 111 Nov 3 1997. inputrc

-Rwxr-xr-x 1 hapless 186 Sep 1 1998. kshrc

-Rw-r -- 1 hapless 392 Jan 7 1998. login

-Rw-r -- 1 hapless 51 Nov 25 1997. logout

-Rw-r -- 1 hapless 341 Oct 13 1997. profile

-Rwxr-xr-x 1 hapless 182 Sep 1 1998. profile. ksh

Drwxr-xr-x 2 hapless 1024 May 14 12:16. seyon

Drwxr-xr-x 3 hapless 1024 May 14 12:15 lg

226 Transfer complete.

Ftp> ls

200 PORT command successful.

150 Opening ASCII mode data connection for/bin/ls.

Total 14

Drwxrwxr-x 4 hapless 1024 May 20 19:35.

Drwxr-xr-x 6 root 1024 May 20 ..

-Rw-r -- 1 hapless 96 May 20 19:56. bash_history

-Rw-r -- 1 hapless 49 Nov 25 1997. bash_logout

-Rw-r -- 1 hapless 913 Nov 24 1997. bashrc

-Rw-r -- 1 hapless 650 Nov 24 1997. cshrc

-Rw-r -- 1 hapless 111 Nov 3 1997. inputrc

-Rwxr-xr-x 1 hapless 186 Sep 1 1998. kshrc

-Rw-r -- 1 hapless 392 Jan 7 1998. login

-Rw-r -- 1 hapless 51 Nov 25 1997. logout

-Rw-r -- 1 hapless 341 Oct 13 1997. profile

-Rwxr-xr-x 1 hapless 182 Sep 1 1998. profile. ksh

Drwxr-xr-x 2 hapless 1024 May 14 12:16. seyon

Drwxr-xr-x 3 hapless 1024 May 14 12:15 lg

226 Transfer complete.

Ftp> ls-F

200 PORT command successful.

150 Opening ASCII mode data connection for/bin/ls.

Total 14

Drwxrwxr-x 4 hapless 1024 May 20 19:35 ./

Drwxr-xr-x 6 root 1024 May 20 ../

Rw-r -- 1 hapless 96 May 20 :56. bash_history

-Rw-r -- 1 hapless 49 Nov 25 1997. bash_logout

-Rw-r -- 1 hapless 913 Nov 24 1997. bashrc

-Rw-r -- 1 hapless 650 Nov 24 1997. cshrc

-Rw-r -- 1 hapless 111 Nov 3 1997. inputrc

-Rwxr-xr-x 1 hapless 186 Sep 1 1998. kshrc *

-Rw-r -- 1 hapless 392 Jan 7 1998. login

-Rw-r -- 1 hapless 51 Nov 25 1997. logout

-Rw-r -- 1 hapless 341 Oct 13 1997. profile

-Rwxr-xr-x 1 hapless 182 Sep 1 1998. profile. ksh *

Drwxr-xr-x 2 hapless 1024 May 14 12:16. seyon/

Drwxr-xr-x 3 hapless 1024 May 14 12:15 lg/

226 Transfer complete.

Ftp> cd lg

250 CWD command successful.

Ftp> ls-F

200 PORT command successful.

150 Opening ASCII mode data connection for/bin/ls.

Total 8

Drwxr-xr-x 3 hapless 1024 May 14 ./

Drwxrwxr-x 4 hapless 1024 May 20 :35 ../

Rw-r -- 1 hapless 70 Aug 22 1998 lg3_colors

-Rw-r -- 1 hapless 629 Aug 22 1998 lg3_prefs

-Rw-r -- 1 hapless 728 Aug 22 1998 lg3_soundPref

-Rw-r -- 1 hapless 2024 Aug 22 1998 lg3_startup

Drwxr-xr-x 2 hapless 1024 May 14 12:15 lg_layouts/

226 Transfer complete.

Ftp> cd lg_layouts

250 CWD command successful.

This is a typical user operation process. Now let's look at the sniffing result generated by linsniffer:

1 2 3 4 Next Page

[Content navigation]
Page 1: detailed descriptions of common sniffing tools used by hackers in Linux	Page 1: detailed descriptions of common sniffing tools used by hackers in Linux
Page 1: detailed descriptions of common sniffing tools used by hackers in Linux	Page 1: detailed descriptions of common sniffing tools used by hackers in Linux