1. Overview
This article analyzes in detail several sniffing devices that hackers often use in Linux, which are often planted on victim servers after being infiltrated by intruders. These sniffing devices have different characteristics. Some are simple to capture user names and passwords, while others are very powerful to record all network data streams. This article will analyze the following sniffer types:
Linsniffer
Linuxsniffer
Hunt
Sniffit
2. linsniffer
Linsniffer is a simple and practical sniffer. Its main feature is to capture the user name and password, which is outstanding in this regard.
By Mike Edulla
Condition: C and IP header file
Configuration File: None
Location: http://agape.trilidun.org/hack/network-sniffers/linsnifferc
Security history: None
Note: It is easy to use. However, lnsniffer requires a complete IP header file, including the header files that are often stored in/usr/include/net and/usr/include/netinet. Before compilation, ensure that the PATH variable contains/usr/include.
Use the following command to compile lnsniffer:
$ Cc linsniffer. c-o linsniffer
To run linsniffer, run the following command:
$ Linsniffer
After the startup, linsniffer will create an empty file: tcp. log to store the sniffing result.
In the test, I created a user named hapless with the password "unaware. Then, use this user to log on to the Linux server and perform some common user operations. The following is an ftp process:
GPS $ ftp 192.168.0.2
Connected to 192.168.0.2.
220 linux.test.net FTP server Wed Aug 19 02:55:52 MST 1998) ready.
Name (192.168.0.2: root): hapless
331 Password required for hapless.
Password:
230 User hapless logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
Ftp> ls-al
200 PORT command successful.
150 Opening ASCII mode data connection for/bin/ls.
Total 14
Drwxrwxr-x 4 hapless 1024 May 20 19:35.
Drwxr-xr-x 6 root 1024 May 20 ..
-Rw-r -- 1 hapless 96 May 20 19:56. bash_history
-Rw-r -- 1 hapless 49 Nov 25 1997. bash_logout
-Rw-r -- 1 hapless 913 Nov 24 1997. bashrc
-Rw-r -- 1 hapless 650 Nov 24 1997. cshrc
-Rw-r -- 1 hapless 111 Nov 3 1997. inputrc
-Rwxr-xr-x 1 hapless 186 Sep 1 1998. kshrc
-Rw-r -- 1 hapless 392 Jan 7 1998. login
-Rw-r -- 1 hapless 51 Nov 25 1997. logout
-Rw-r -- 1 hapless 341 Oct 13 1997. profile
-Rwxr-xr-x 1 hapless 182 Sep 1 1998. profile. ksh
Drwxr-xr-x 2 hapless 1024 May 14 12:16. seyon
Drwxr-xr-x 3 hapless 1024 May 14 12:15 lg
226 Transfer complete.
Ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for/bin/ls.
Total 14
Drwxrwxr-x 4 hapless 1024 May 20 19:35.
Drwxr-xr-x 6 root 1024 May 20 ..
-Rw-r -- 1 hapless 96 May 20 19:56. bash_history
-Rw-r -- 1 hapless 49 Nov 25 1997. bash_logout
-Rw-r -- 1 hapless 913 Nov 24 1997. bashrc
-Rw-r -- 1 hapless 650 Nov 24 1997. cshrc
-Rw-r -- 1 hapless 111 Nov 3 1997. inputrc
-Rwxr-xr-x 1 hapless 186 Sep 1 1998. kshrc
-Rw-r -- 1 hapless 392 Jan 7 1998. login
-Rw-r -- 1 hapless 51 Nov 25 1997. logout
-Rw-r -- 1 hapless 341 Oct 13 1997. profile
-Rwxr-xr-x 1 hapless 182 Sep 1 1998. profile. ksh
Drwxr-xr-x 2 hapless 1024 May 14 12:16. seyon
Drwxr-xr-x 3 hapless 1024 May 14 12:15 lg
226 Transfer complete.
Ftp> ls-F
200 PORT command successful.
150 Opening ASCII mode data connection for/bin/ls.
Total 14
Drwxrwxr-x 4 hapless 1024 May 20 19:35 ./
Drwxr-xr-x 6 root 1024 May 20 ../
Rw-r -- 1 hapless 96 May 20 :56. bash_history
-Rw-r -- 1 hapless 49 Nov 25 1997. bash_logout
-Rw-r -- 1 hapless 913 Nov 24 1997. bashrc
-Rw-r -- 1 hapless 650 Nov 24 1997. cshrc
-Rw-r -- 1 hapless 111 Nov 3 1997. inputrc
-Rwxr-xr-x 1 hapless 186 Sep 1 1998. kshrc *
-Rw-r -- 1 hapless 392 Jan 7 1998. login
-Rw-r -- 1 hapless 51 Nov 25 1997. logout
-Rw-r -- 1 hapless 341 Oct 13 1997. profile
-Rwxr-xr-x 1 hapless 182 Sep 1 1998. profile. ksh *
Drwxr-xr-x 2 hapless 1024 May 14 12:16. seyon/
Drwxr-xr-x 3 hapless 1024 May 14 12:15 lg/
226 Transfer complete.
Ftp> cd lg
250 CWD command successful.
Ftp> ls-F
200 PORT command successful.
150 Opening ASCII mode data connection for/bin/ls.
Total 8
Drwxr-xr-x 3 hapless 1024 May 14 ./
Drwxrwxr-x 4 hapless 1024 May 20 :35 ../
Rw-r -- 1 hapless 70 Aug 22 1998 lg3_colors
-Rw-r -- 1 hapless 629 Aug 22 1998 lg3_prefs
-Rw-r -- 1 hapless 728 Aug 22 1998 lg3_soundPref
-Rw-r -- 1 hapless 2024 Aug 22 1998 lg3_startup
Drwxr-xr-x 2 hapless 1024 May 14 12:15 lg_layouts/
226 Transfer complete.
Ftp> cd lg_layouts
250 CWD command successful.
This is a typical user operation process. Now let's look at the sniffing result generated by linsniffer:
[Content navigation] |
Page 1: detailed descriptions of common sniffing tools used by hackers in Linux |
Page 1: detailed descriptions of common sniffing tools used by hackers in Linux |
Page 1: detailed descriptions of common sniffing tools used by hackers in Linux |
Page 1: detailed descriptions of common sniffing tools used by hackers in Linux |