Default HOWTO: Use dsniff, driftnet, urlsnarf, msgsnarf with 802.11 capture files.
So you captured some wifi data (802.11) with airodump-ng like this, for example:
slax ~ # airmon-ng start ath0
slax ~ # airodump-ng -w dump -c 11 ath0
(Or you captured with kismet, etc.)
Now you want to go back and pull out passwords, urls, instant messages and images from your capture file: dump.cap.
It used to be no problem to get passwords from a capture with dsniff, but with Backtrack v.1.0 Final, dsniff will read just fine from a network interface, but it won't read from a file anymore (at least dsniff on my HDD install has this problem):
slax ~ # dsniff -r dump.cap
dsniff: record_init: Invalid argument
And the other fun programs (driftnet, msgsnarf, urlsnarf, etc.) don't read files at all, they only work in real time listening on network interfaces. Driftnet won't even listen on 802.11 interfaces in rfmon mode:
slax ~ # driftnet -i ath0
driftnet: unknown data link type 119
The solution: Use tcpreplay to play back the packets on a network interface so all the fun programs can work.
One problem: tcpreplay is broken in Backtrack v.1.0 Final. If tcpreplay in your version of Backtrack is broken and you're using the HDD installed version of Backtrack, its easy to fix:
Dowload the latest stable release of tcpreplay (currently tcpreplay-2.3.5.tar.gz) here:
http://tcpreplay.synfin.net/trac/wiki/Download
Install like usual:
slax ~ # tar xzvf tcpreplay-2.3.5.tar.gz
slax ~ # cd tcpreplay-2.3.5
slax tcpreplay-2.3.5 # ./configure
slax tcpreplay-2.3.5 # make
slax tcpreplay-2.3.5 # make install
slax tcpreplay-2.3.5 # cd
slax ~ #
Another small problem, tcpreplay doesn't understand 802.11 headers:
slax ~ # tcpreplay -i lo dump.cap
sending on: lo
validate_l2(): Unsupported datalink type: 802.11 (0x69)
No to worry, airdecap-ng can convert the capture to straight ethernet. Normally you use this program to decrypt encrypted 802.11 data, but you can also use it just to strip the 802.11 headers:
slax ~ # airdecap-ng dump.cap
Total number of packets read 256828
Total number of WEP data packets 315
Total number of WPA data packets 0
Number of plaintext data packets 42287
Number of decrypted WEP packets 0
Number of decrypted WPA packets 0
This creates a file named dump-dec.cap. If you need to decrypt the data as well, just include the necessary parameters (for example -e and -w) in the airdecap-ng command.
Now we're going to replay the data on the local loopback ethernet interface (lo). This gives us an interface to send the data on without actually sending it out over the air or on the local network.
First start your programs to listen on the local interface (in different sessions of course, so you can see the output of each):
slax ~ # dsniff -i lo
slax ~ # driftnet -i lo
slax ~ # urlsnarf -i lo
slax ~ # msgsnarf -i lo
Then run tcpreplay (the -R option speeds up the replay):
slax ~ # tcpreplay -i lo -R dump-dec.cap
sending on: lo
42287 packets (20751892 bytes) sent in 4.67 seconds
4435909.0 bytes/sec 33.84 megabits/sec 9039 packets/sec
Each sniffer sees the packets as they are replayed on the local interface. Hopefully, you will get a lot of interesting data!
slax ~ # airmon-ng start ath0
slax ~ # airodump-ng -w dump -c 11 ath0
(Or you captured with kismet, etc.)
Now you want to go back and pull out passwords, urls, instant messages and images from your capture file: dump.cap.
It used to be no problem to get passwords from a capture with dsniff, but with Backtrack v.1.0 Final, dsniff will read just fine from a network interface, but it won't read from a file anymore (at least dsniff on my HDD install has this problem):
slax ~ # dsniff -r dump.cap
dsniff: record_init: Invalid argument
And the other fun programs (driftnet, msgsnarf, urlsnarf, etc.) don't read files at all, they only work in real time listening on network interfaces. Driftnet won't even listen on 802.11 interfaces in rfmon mode:
slax ~ # driftnet -i ath0
driftnet: unknown data link type 119
The solution: Use tcpreplay to play back the packets on a network interface so all the fun programs can work.
One problem: tcpreplay is broken in Backtrack v.1.0 Final. If tcpreplay in your version of Backtrack is broken and you're using the HDD installed version of Backtrack, its easy to fix:
Dowload the latest stable release of tcpreplay (currently tcpreplay-2.3.5.tar.gz) here:
http://tcpreplay.synfin.net/trac/wiki/Download
Install like usual:
slax ~ # tar xzvf tcpreplay-2.3.5.tar.gz
slax ~ # cd tcpreplay-2.3.5
slax tcpreplay-2.3.5 # ./configure
slax tcpreplay-2.3.5 # make
slax tcpreplay-2.3.5 # make install
slax tcpreplay-2.3.5 # cd
slax ~ #
Another small problem, tcpreplay doesn't understand 802.11 headers:
slax ~ # tcpreplay -i lo dump.cap
sending on: lo
validate_l2(): Unsupported datalink type: 802.11 (0x69)
No to worry, airdecap-ng can convert the capture to straight ethernet. Normally you use this program to decrypt encrypted 802.11 data, but you can also use it just to strip the 802.11 headers:
slax ~ # airdecap-ng dump.cap
Total number of packets read 256828
Total number of WEP data packets 315
Total number of WPA data packets 0
Number of plaintext data packets 42287
Number of decrypted WEP packets 0
Number of decrypted WPA packets 0
This creates a file named dump-dec.cap. If you need to decrypt the data as well, just include the necessary parameters (for example -e and -w) in the airdecap-ng command.
Now we're going to replay the data on the local loopback ethernet interface (lo). This gives us an interface to send the data on without actually sending it out over the air or on the local network.
First start your programs to listen on the local interface (in different sessions of course, so you can see the output of each):
slax ~ # dsniff -i lo
slax ~ # driftnet -i lo
slax ~ # urlsnarf -i lo
slax ~ # msgsnarf -i lo
Then run tcpreplay (the -R option speeds up the replay):
slax ~ # tcpreplay -i lo -R dump-dec.cap
sending on: lo
42287 packets (20751892 bytes) sent in 4.67 seconds
4435909.0 bytes/sec 33.84 megabits/sec 9039 packets/sec
Each sniffer sees the packets as they are replayed on the local interface. Hopefully, you will get a lot of interesting data!