Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 7 Feb 2013 12:34:01 +0530
From: Dhiru Kholia <dhiru.kholia@...il.com>
To: john-dev@...ts.openwall.com
Subject: Re: New tool (comments wanted). pcap2john

On Thu, Feb 7, 2013 at 9:31 AM,  <jfoug@....net> wrote:
> On an offlist conversation, Magnum made a wishlist comment. I would like to post this idea here, so that others can also comment. I think this is really a nice idea.  Probably not a trivial project, but a nice idea.   It may be something that starts off smaller (such as the wpapsk2john), but then it grows over time, sort of like how pass_gen.pl has grown over time originally from a few 1 liner perl hacks on a jtr wiki page.
>
> Here was the post from magnum:
>
> <quote>
> what we need next is a pcap2john that doesn't miss a beat. Speaking of that: We should have a generic pcap2john that finds *any* JtR supported format in a pcap file, and output hashes accordingly. So for one single pcap file, you could end up with DMD5 hashes, wpapsk hashes, ntlmv1, krb5 and so on. That would be mighty cool for pentests. It should be written so it's easy to add new formats. I haven't sniffed wlan for years though - isn't that one level lower? So perhaps you couldn't really find wpapsk handshakes and pop3 authentications in the same file. Or maybe nowadays you can? </quote>
>
> One thing that would be nice for a tool like this, is initially a list of what hashes can be found in this way, and what packet(s) are needed to produce the hash, what data on these packets are needed to make the input hash.
>

Are you guys planning to write a new tool from scratch? How about
modifying / extending Ettercap?

I like the extensibility of Ettercap's source code and it works pretty
well too. I have extended Ettercap to output O5LOGON, VNC, MySQL,
MongoDB, PostgreSQL hashes.

An added advantage will be the support we will get from existing
Ettercap developers.

-- 
Dhiru

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ