[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 7 Feb 2013 01:15:10 -0500
From: Rich Rumble <richrumble@...il.com>
To: john-dev@...ts.openwall.com
Subject: Re: New tool (comments wanted). pcap2john
On Wed, Feb 6, 2013 at 11:01 PM, <jfoug@....net> wrote:
> Here was the post from magnum:
>
> <quote>
> what we need next is a pcap2john that doesn't miss a beat. Speaking of that: We should have a generic pcap2john that finds *any* JtR supported format in a pcap file, and output hashes accordingly. So for one single pcap file, you could end up with DMD5 hashes, wpapsk hashes, ntlmv1, krb5 and so on. That would be mighty cool for pentests. It should be written so it's easy to add new formats. I haven't sniffed wlan for years though - isn't that one level lower? So perhaps you couldn't really find wpapsk handshakes and pop3 authentications in the same file. Or maybe nowadays you can? </quote>
>
> One thing that would be nice for a tool like this, is initially a list of what hashes can be found in this way, and what packet(s) are needed to produce the hash, what data on these packets are needed to make the input hash.
We have (or had?) the VNC handshakes (vncpcap2john), and recently the
NTLMv1 talk has begun again, I'm sure there are more off the wire/pcap
we could get. Taking the "*any* JtR supported format in a pcap file"
to it's conclusion, it may involve file carving as jumbo supports
office documents, pdf, zip/rar etc... Suricata IDS has a very nice
file carver, there are many out there already I just thought I'd
mention it since they are open source, I'm not sure how much of that
is based on previous works like tcpextract.
https://lists.openinfosecfoundation.org/pipermail/oisf-devel/2010-January/000066.html
Cain&Abel sniffs out quite a few as well, but is closed source. I work
with IDS and Pcap's all the time, wireshark/libpcap understands
protocols and handshakes etc very well, the technical stuff is
probably out of my reach as far as coding, but I can certainly
contribute pcaps and testing. There is also a tool out there
rule2alert that goes the other way, snort rule to generate
traffic/pcaps, based on Scapy. http://code.google.com/p/rule2alert/
http://www.secdev.org/projects/scapy/ I know that's the opposite
direction, but somewhere in mind I think it'd be beneficial to johns'
ends'. It could also be I need sleep... so in closing I like the idea-
how can I help :)
-rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
