Attacks and sniffing
- -M,--mitm
- ARP spoofing, parameter-m ARP
- Remote # bidirectional mode, while spoofing both sides of the communication,-M arp:remote.
- OneWay #单向模式, only ARP deceives the first target to the second target communication,-M arp:oneway.
- ICMP spoofing, parameter-M ICMP: (MAC/IP)
- DHCP spoofing, parameter-m DHCP: (IP_POOL/NETMASK/DNS), such as- m dhcp:192.168.0.30,35,50-60/255.255.255.0/192.168.0.1 is to provide IP addresses, subnet masks, and gateways to newly-accessed hosts, and-m dhcp:/255.255.255.0/192.168.0.1 does not provide IP addresses, only spoofing subnet masks and gateways.
- Port stealing: Check the previous section for writing.
- -O,--only-mitm #只进行中间人攻击, no sniffing
- -F,--pcapfilter #加载过滤器
- -B,--bridge #Bridged sniffing
General Options
- -B,--broadcast #嗅探广播地址
- -I., Iface #选择网卡
- -I,--iflist #列出可用网卡
- -Y,--Secondary #后备网卡
- -A,--address #ip地址, for a network of IP cases
- -N,--netmask
- -r,--reversed
- -Z,--silent #不进行arp毒化和主机扫描
- -P,--Nopromisc
- -S,--nosslmitm #不使用ssl中间人攻击
- -T,--proto #协议, Tcp/udp/all, default to All
- -U,--unoffensive
- -j,--load-hosts #加载保存的主机地址
- -K,--save-hosts #保存扫描到的主机地址
- -P,--plugin #载入插件
- -F,--filter #载入过滤器文件
- -A,--config #载入并使用一个非默认配置文件
- --certificate #ssl攻击使用指定的证书文件
- --private-key #ssl攻击使用指定的私钥文件
- -W,--wifi-key #载入wifi密码:
- --wifi-key Wep:128:p:secret
- --wifi-key wep:128:s:ettercapwep0
- --wifi-key ' wep:64:s:\x01\x02\x03\x04\x05 '
- --wifi-key Wpa:pwd:ettercapwpa:ssid
- --wifi-key Wpa:psk:663eb260e87cf389c6bd7331b28d82f5203b0cae4e315f9cbb7602f3236708a6
Visualization parameters
- -E,--regex #使用一个正则表达式
- -V,--visual #显示方式
- Hex
- Ascii
- Hext
- Ebcdic
- Html
- Utf8
- -D,--dns #把ip地址转化为主机名
- -E,--ext-headers
- -Q,--superquiet #超级安静模式, save only
Logging options
- -L,--log #把所有数据包保存log文件
- -L,--log-info #读取离线log文件信息
- -M,--log-msg #显示存储在log文件里所有用户ettercap抓取的信息.
- -C,--compress #通过gzip算法压缩log文件
- -O,--only-local #只存储本地局域网主机配置信息
- -O,--only-remote #只存储远程主机配置信息
Common combinations of parameters
- ETTERCAP-TQI eth0-m ARP///#arp毒化eth0所在网段, Quiet mode text display
- Ettercap-tzq/10.0.0.1/21,22,23-w hack.pcap #监听10.0.0.1 ftp,ssh,telnet Information and save it locally.
- Ettercap-tq-p dns_spoof-m arp/192.168.1.120///#对192.168.1.120 for DNS spoofing, using default NIC eth0, text mode, quiet display
- ETTERCAP-TQI eht0-l sniffed_data-f filter.ef-m arp:remote/10.0.0.2/80//#使用过滤并监听10.0.0.2 All traffic on port 80, Quiet mode text display, save data to this To
Ettercap man-in-the-middle attack-parameter introduction
