FAQ: Wireless Tools & Sniffers

tomjones · 09-09-2002

Hello,

It seems like there are always new tools coming out. Just wondering if you all wouldn't mind adding to the list. I'd like to make sure I'm up to date on the latest wlan (or related e.g. sniffers supporting wireless) utilities.

All platforms (commercial and free)....
I'll start:

netstumbler (ministumbler)
airsnort
kismet
airopeek
@stake wap toolkit
aptools
iss wireless scanner
sniffer pro
ethereal
wellenreiter
nsspyglass
airsnare
airjack

I know there are apps I'm missing. Not too familiar with handheld apps yet.

Thanks for any additions.

Chris_Schear · 09-09-2002

I would also have to recommend AirMagnet. An excellent commercial grade package. With regards to Airopeek, I would ensure you include the "NX" version, as it contains some significant enhancements.

Chris · 09-09-2002

This came across one of the mailing lists the other day:

The list is at http://www.networkintrusion.co.uk/wireless.htm
The products (in no particular order (yet))

BSD - Airtools -- http://www.dachb0den.com/projects/bsd-airtools.html
NetStumbler -- http://www.netstumbler.com/
Kismet -- http://www.kismetwireless.net/
Fake AP -- http://www.blackalchemy.to/Projects/fakeap/fake-ap.html
Wellenreiter -- http://www.remote-exploit.org
AirSnort -- http://airsnort.shmoo.com/
WaveStumbler -- http://www.cqure.net/tools08.html
Wireless Scanner --
http://www.iss.net/products_services...r_wireless.php
Airosniff -- http://www.wildpackets.com/products/airopeek
AiroPeek -- http://www.wildpackets.com/products/airopeek
StumbVerter -- http://www.sonar-security.com
AP Scanner -- http://homepage.mac.com/typexi/Personal1.html
Sniffer Wireless -- http://www.sniffer.com/products/wire...efault.asp?A=5
WEPcrack -- http://wepcrack.sourceforge.net/
Prism2 -- http://hostap.epitest.fi/
Mini Stumbler -- http://www.netstumbler.org/download.php?op=getit&lid=21
SSIDsniff -- http://www.bastard.net/~kos/wifi/
MacStumbler -- http://homepage.mac.com/macstumbler/
WaveMon -- http://www.jm-music.de/projects.html
PrismStumbler -- http://prismstumbler.sourceforge.net/
AirTraf -- http://airtraf.sourceforge.net/
MogNet -- http://chocobospore.org/mognet/
AirMagnet -- http://www.airmagnet.com/products.htm
Isomair -- http://www.isomair.com/products.html
Air-Jack -- http://802.11ninja.net/
AirDefense -- http://www.airdefense.net/products/index.shtm
WiFiScanner -- http://sourceforge.net/projects/wifiscanner/

The Others · 09-09-2002

Ettercap is pretty cool.

Chris · 09-09-2002

Here's another link to another list:

http://www.personaltelco.net/index.c...show&redirect=

g0tr00t · 09-25-2002

This is pretty good. Enjoy.

Sniff this bad boy

blackwave · 09-25-2002

Thanks g0tr00t,

Adding to FAQ
http://rr.sans.org/wireless/test_80211b.php
from http://forums.netstumbler.com/showth...&threadid=1577

g0tr00t · 09-26-2002

Quote:

Originally posted by Eyecannon
Q: Is there a sniffer for windows that decodes HTTP packets to an actual webpage so you can surf as the other person surfed?

I think it is IRIS

nashr · 09-26-2002

Quote:

Originally posted by Eyecannon
Q: Is there a sniffer for windows that decodes HTTP packets to an actual webpage so you can surf as the other person surfed?

There's a package called dsniff that was ported to windows. It includes:

dsniff
simple password sniffer. handles FTP, Telnet, HTTP, POP, NNTP, IMAP, SNMP, LDAP, Rlogin, NFS, SOCKS, X11, IRC, AIM, CVS, ICQ, Napster, Citrix ICA, Symantec pcAnywhere, NAI Sniffer, Microsoft SMB, and Oracle SQL*Net auth info. goes beyond most sniffers in that it minimally parses each application protocol, only saving the "interesting" bits. uses Berkeley DB as its output file format, logging only unique auth info. supports full TCP/IP reassembly, courtesy of libnids (all of the following tools do, as well).

mailsnarf
a fast and easy way to violate the Electronic Communications Privacy Act of 1986 (18 USC 2701-2711), be careful. outputs all messages sniffed from SMTP traffic in Berkeley mbox format, suitable for offline browsing with your favorite mail reader (mail -f, pine, etc.).

urlsnarf
output all requested URLs sniffed from HTTP traffic in CLF (Common Log Format, used by almost all web servers), suitable for offline post-processing with your favorite web log analysis tool (analog, wwwstat, etc.).

webspy
sends URLs sniffed from a client to your local Netscape browser for display, updated in real-time (as the target surfs, your browser surfs along with them, automagically). a fun party trick. :-)

Nice little package of tools that I use in pen testing, vulnerabilitiy assessments, etc. This package can be found at:

http://www.datanerds.net/~mike/dsniff.html

ENJOY!!!

g0tr00t · 09-27-2002

Quote:

Originally posted by TheSovereign
has anyone had any luck sniffing remote hosts?
on the same subnet like in cable modems?
i dont want to do it im just asking if it was possibe because they seem to be on a sort of lan

You like sniffing my box?

Eyecannon · 09-27-2002

I found a more compact (and cheaper) version of Iris made by Effetech called HTTP Sniffer... reconstructs HTML perfectly (unless it's been SSL'd!)

Thanks for more toys to play with though

EDIT: hey for dsniff for win32, it wants it compiled... is there a lean C++ compilier I can get with out getting an entire suite?

Eyecannon · 09-29-2002

Iris http://eeye.com/html/Products/Iris/index.html
HTTP Sniffer http://www.effetech.com/sniffer/

Both can reconstruct HTML

uzurpatorul · 04-02-2005

http://www.rostudent.com/robert/VLADescu.html

09-09-2002	#1 (permalink)
tomjones Registered Member Join Date: May 2002 Posts: 61	Compile a List of Wireless Tools Hello, It seems like there are always new tools coming out. Just wondering if you all wouldn't mind adding to the list. I'd like to make sure I'm up to date on the latest wlan (or related e.g. sniffers supporting wireless) utilities. All platforms (commercial and free).... I'll start: netstumbler (ministumbler) airsnort kismet airopeek @stake wap toolkit aptools iss wireless scanner sniffer pro ethereal wellenreiter nsspyglass airsnare airjack I know there are apps I'm missing. Not too familiar with handheld apps yet. Thanks for any additions.

09-09-2002	#3 (permalink)
Chris Bad as Can Join Date: Jul 2002 Posts: 1,141	This came across one of the mailing lists the other day: The list is at http://www.networkintrusion.co.uk/wireless.htm The products (in no particular order (yet)) BSD - Airtools -- http://www.dachb0den.com/projects/bsd-airtools.html NetStumbler -- http://www.netstumbler.com/ Kismet -- http://www.kismetwireless.net/ Fake AP -- http://www.blackalchemy.to/Projects/fakeap/fake-ap.html Wellenreiter -- http://www.remote-exploit.org AirSnort -- http://airsnort.shmoo.com/ WaveStumbler -- http://www.cqure.net/tools08.html Wireless Scanner -- http://www.iss.net/products_services...r_wireless.php Airosniff -- http://www.wildpackets.com/products/airopeek AiroPeek -- http://www.wildpackets.com/products/airopeek StumbVerter -- http://www.sonar-security.com AP Scanner -- http://homepage.mac.com/typexi/Personal1.html Sniffer Wireless -- http://www.sniffer.com/products/wire...efault.asp?A=5 WEPcrack -- http://wepcrack.sourceforge.net/ Prism2 -- http://hostap.epitest.fi/ Mini Stumbler -- http://www.netstumbler.org/download.php?op=getit&lid=21 SSIDsniff -- http://www.bastard.net/~kos/wifi/ MacStumbler -- http://homepage.mac.com/macstumbler/ WaveMon -- http://www.jm-music.de/projects.html PrismStumbler -- http://prismstumbler.sourceforge.net/ AirTraf -- http://airtraf.sourceforge.net/ MogNet -- http://chocobospore.org/mognet/ AirMagnet -- http://www.airmagnet.com/products.htm Isomair -- http://www.isomair.com/products.html Air-Jack -- http://802.11ninja.net/ AirDefense -- http://www.airdefense.net/products/index.shtm WiFiScanner -- http://sourceforge.net/projects/wifiscanner/ __________________ perl -e 'print pack(c5, (412), sqrt(7056), (unpack(c,H)-2), oct(115), 10)' Last edited by Chris : 09-09-2002 at 09:09 AM.*

09-09-2002	#4 (permalink)
The Others PeaceDriver Join Date: Apr 2002 Location: Dos Palabras, Mandoras Posts: 2,920	Ettercap is pretty cool. __________________ all good ends all ?u=273

09-09-2002	#5 (permalink)
Chris Bad as Can Join Date: Jul 2002 Posts: 1,141	Here's another link to another list: http://www.personaltelco.net/index.c...show&redirect= __________________ perl -e 'print pack(c5, (41*2), sqrt(7056), (unpack(c,H)-2), oct(115), 10)'

09-25-2002	#6 (permalink)
g0tr00t Welcome to my nightmare Join Date: May 2002 Location: r00ting y0ur b0x. Posts: 352	Sniffer FAQ This is pretty good. Enjoy. Sniff this bad boy __________________ g0tr00t "Its all fun and games until someone gets killed."

09-09-2002	#2 (permalink)
Chris_Schear Packetmonkey Join Date: Aug 2002 Location: WDM, Iowa Posts: 243	I would also have to recommend AirMagnet. An excellent commercial grade package. With regards to Airopeek, I would ensure you include the "NX" version, as it contains some significant enhancements.

09-25-2002	#7 (permalink)
blackwave Do I look like I'm joking Join Date: Apr 2002 Location: SoCal, OC Posts: 4,507	Thanks g0tr00t, Adding to FAQ http://rr.sans.org/wireless/test_80211b.php from http://forums.netstumbler.com/showth...&threadid=1577 __________________ -=BW=-

09-27-2002	#11 (permalink)
Eyecannon Ward River Join Date: Aug 2002 Location: Santa Monix Posts: 679	I found a more compact (and cheaper) version of Iris made by Effetech called HTTP Sniffer... reconstructs HTML perfectly (unless it's been SSL'd!) Thanks for more toys to play with though EDIT: hey for dsniff for win32, it wants it compiled... is there a lean C++ compilier I can get with out getting an entire suite? __________________ No, officer, YOU are under arrest! http://eyecannon.com/wardrive.html Last edited by Eyecannon : 09-27-2002 at 12:16 PM.

09-29-2002	#12 (permalink)
Eyecannon Ward River Join Date: Aug 2002 Location: Santa Monix Posts: 679	Iris http://eeye.com/html/Products/Iris/index.html HTTP Sniffer http://www.effetech.com/sniffer/ Both can reconstruct HTML __________________ No, officer, YOU are under arrest! http://eyecannon.com/wardrive.html

04-02-2005	#13 (permalink)
uzurpatorul Registered Member Join Date: Apr 2005 Posts: 3	tcp content sniffer (jpeg, gif & mp3) http://www.rostudent.com/robert/VLADescu.html

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode