
dsniff-2.2
----------

i wrote these tools with honest intentions - to audit my own network,
and to demonstrate the insecurity of cleartext network protocols.
please do not abuse this software.

these programs require:

      libpcap - http://www.tcpdump.org/
      libnet - http://www.packetfactory.net/Projects/Libnet/
      libnids - http://www.packetfactory.net/Projects/Libnids/
      libdb - http://www.sleepycat.com/

built and tested on OpenBSD, Linux, and Solaris. YMMV.

what's here:

arpredirect
	redirect packets from a target host (or all hosts) on the LAN
	intended for another host on the LAN by forging ARP replies.
	this is an extremely effective way of sniffing traffic on a
	switch. kernel IP forwarding (or a userland program which
	accomplishes the same, e.g. fragrouter :-) must be turned on
	ahead of time.

macof
	flood the local network with random MAC addresses (causing
	some switches to fail open in repeating mode, facilitating
	sniffing). a straight C port of the original Perl Net::RawIP
	macof program.

tcpkill
	kill specified in-progress TCP connections (useful for
	libnids-based applications which require a full TCP 3-whs for
	TCB creation).

tcpnice
	slow down specified in-progress TCP connections via "active"
	traffic shaping (useful for sniffing fast networks). forges
	tiny TCP window advertisements, and optionally ICMP source
	quench replies.

dsniff
	password sniffer. handles FTP, Telnet, HTTP, POP, poppass,
	NNTP, IMAP, SNMP, LDAP, Rlogin, RIP, OSPF, NFS, YP, SOCKS,
	X11, CVS, IRC, AIM, ICQ, Napster, PostgreSQL, Meeting Maker,
	Citrix ICA, Symantec pcAnywhere, NAI Sniffer, Microsoft SMB,
	Oracle SQL*Net, Sybase and Microsoft SQL auth info.

	dsniff automatically detects and minimally parses each
	application protocol, only saving the interesting bits, and
	uses Berkeley DB as its output file format, only logging
	unique authentication attempts. full TCP/IP reassembly is
	provided by libnids(3) (likewise for the following tools as
	well).

filesnarf
	saves files sniffed from network file system traffic in the
	current working directory.

mailsnarf
	a fast and easy way to violate the Electronic Communications
	Privacy Act of 1986 (18 USC 2701-2711), be careful. outputs
	all messages sniffed from SMTP and POP traffic in Berkeley
	mbox format, suitable for offline browsing with your favorite
	mail reader (mail -f, pine, etc.).

urlsnarf
	output all requested URLs sniffed from HTTP traffic in CLF
	(Common Log Format, used by almost all web servers), suitable
	for offline post-processing with your favorite web log
	analysis tool (analog, wwwstat, etc.).

webspy
	sends URLs sniffed from a client to your local Netscape
	browser for display, updated in real-time (as the target
	surfs, your browser surfs along with them, automagically).
	a fun party trick. :-)

-d.

---
http://www.monkey.org/~dugsong/
