A suite for man in the middle attacks

Copyright 2001-Current The Ettercap Dev Team

INTRODUCTION

Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.

[!NOTE] Aoccdrnig to rscheearch at an Elingsh uinervtisy, it deosn't mttaer in waht oredr the ltteers in a wrod are, the olny iprmoetnt tihng is taht the frist and lsat ltteer are in the rghit pclae. The rset can be a toatl mses and you can sitll raed it wouthit a porbelm. Tihs is bcuseae we do not raed ervey lteter by it slef but the wrod as a wlohe and the biran fguiers it out aynawy.

... so please excuse us for every typo in the documentation, man pages or code, btw fixes and patches are welcome.

REQUIRED PROGRAMS

• C compiler
• flex (or other lex-compatible parser generator) for *.l files
• bison (or other yacc-compatible parser generator) for *.y files
• cmake (build tool)

REQUIRED LIBRARIES

MANDATORY:

• libpcap >= 0.8.1
• libnet >= 1.1.2.1 (>= 1.1.5 for IPv6 support)
• openssl >= 0.9.7
• libpthread
• zlib
• libmaxminddb (successor of libgeoip)
• CMake 2.8
• Curl >= 7.26.0 to build SSLStrip plugin

[!TIP] If you don't want to enable SSLStrip plugin you have to disable it. (more information about disabling a plugin in the README.GIT file)

OPTIONAL:

• To avoid use of our internal strlcat and strlcpy implementation: libbsd
• To enable PDF documentation generation (enable via ENABLE_PDF_DOCS=On): groff
• To enable plugins: libltdl (part of libtool)
• To have perl regexp in the filters: libpcre
• For the cursed GUI: ncurses >= 5.3
• For the GTK GUI, pick one toolkit with -DGTK_BUILD_TYPE= (default GTK3):
  • GTK3 (default) — -DGTK_BUILD_TYPE=GTK3:
    • Glib >= 2.2.2
    • Gtk+3 >= 3.12.0 (recommended >= 3.22.0)
    • Atk >= 1.2.4
    • Pango >= 1.2.3
  • GTK4 + libadwaita — -DGTK_BUILD_TYPE=GTK4:
    • Gtk4 >= 4.12
    • libadwaita >= 1.5
    • Requires a reasonably recent distribution (e.g. Ubuntu >= 24.04, Debian >= 13, Fedora >= 39); older releases ship libadwaita < 1.5.
  • GTK2 is still selectable (-DGTK_BUILD_TYPE=GTK2) but deprecated.

[!TIP] If you are running on debian, or any debian based distro you can install the required dependencies by running:

apt-get install build-essential debhelper bison check cmake flex groff libbsd-dev \
     libcurl4-openssl-dev libmaxminddb-dev libgtk-3-dev libltdl-dev libluajit-5.1-dev \
     libncurses5-dev libnet1-dev libpcap-dev libpcre2-dev libssl-dev

For the GTK4 interface (-DGTK_BUILD_TYPE=GTK4) install libgtk-4-dev and libadwaita-1-dev instead of (or in addition to) libgtk-3-dev. These are only available on Ubuntu >= 24.04 / Debian >= 13:

apt-get install libgtk-4-dev libadwaita-1-dev

LICENSE

see LICENSE file for details...

AUTHORS

• Alberto Ornaghi (ALoR) [email protected]
• Marco Valleri (NaGA) [email protected]
• Emilio Escobar (exfil) [email protected]
• Eric Milam (J0hnnyBrav0) [email protected]
• Gianfranco Costamagna (LocutusOfBorg) [email protected]
• Alexander Koeppe (koeppea) <format_c AT online DOT de>

INSTALLATION

The easiest way to compile ettercap is in the form:

mkdir build && cd build

cmake ..

[!TIP] Use ccmake . to change options such as disabling IPv6 support, add plugins support, etc).

sudo make install

[!NOTE] Read INSTALL for further details... and README.PLATFORMS for any issue regarding your operating system.

HOW TO USE IT

You can choose between 3 User Interfaces: Text mode, Curses, GTK.

Please read the man pages ettercap(8) and ettercap_curses(8) to learn how to use ettercap.

TECHNICAL PAPER

THE HOST LIST

Sending one ARP REQUEST for each ip in the lan (looking at the current ip and netmask), it is possible to get the ARP REPLIES and then make the list of the hosts that are responding on the lan. With this method even windows hosts, reply to the call-for-reply (they don't reply on broadcast-ping). Be very careful if the netmask is a class B (255.255.0.0) because ettercap will send 255*255 = 65025 arp requests (the default delay between two requests is 1 millisecond, can be configured in etter.conf)

UNIFIED SNIFFING

Ettercap NG uses the unified sniffing method which is the base for all the attacks. The kernel ip forwarding is always disabled and this task is accomplished by ettercap itself. Packet that needs to be forwarded are packets with destination mac address equal to the attacker's one, but with different ip address. Those packets are re-sent back to the wire to the real destination. This way, you can plug in various mitm attacks at a time. You can even use external attacker/poisoner, they only have to redirect packets to ettercap's host and the game is over ;)

BRIDGED SNIFFING

Uses two network interfaces and forwards the traffic between them while performing sniffing and content filtrating. This sniffing method is very stealthy as there is no way to to detect that someone is in the middle. You can look at this as a layer one attack. Don't use it on gateways or it will transform your gateway into a bridge.

HINT: You can use the content filtering engine to drop packets that should not pass. This way ettercap will work as an inline IPS ;)

This is the beginning of the README. Read the rest at the original. Read the full README ↗