Date: Thu, 7 Feb 2013 01:15:10 -0500 From: Rich Rumble <richrumble@...il.com> To: john-dev@...ts.openwall.com Subject: Re: New tool (comments wanted). pcap2john On Wed, Feb 6, 2013 at 11:01 PM, <jfoug@....net> wrote: > Here was the post from magnum: > > <quote> > what we need next is a pcap2john that doesn't miss a beat. Speaking of that: We should have a generic pcap2john that finds *any* JtR supported format in a pcap file, and output hashes accordingly. So for one single pcap file, you could end up with DMD5 hashes, wpapsk hashes, ntlmv1, krb5 and so on. That would be mighty cool for pentests. It should be written so it's easy to add new formats. I haven't sniffed wlan for years though - isn't that one level lower? So perhaps you couldn't really find wpapsk handshakes and pop3 authentications in the same file. Or maybe nowadays you can? </quote> > > One thing that would be nice for a tool like this, is initially a list of what hashes can be found in this way, and what packet(s) are needed to produce the hash, what data on these packets are needed to make the input hash. We have (or had?) the VNC handshakes (vncpcap2john), and recently the NTLMv1 talk has begun again, I'm sure there are more off the wire/pcap we could get. Taking the "*any* JtR supported format in a pcap file" to it's conclusion, it may involve file carving as jumbo supports office documents, pdf, zip/rar etc... Suricata IDS has a very nice file carver, there are many out there already I just thought I'd mention it since they are open source, I'm not sure how much of that is based on previous works like tcpextract. https://lists.openinfosecfoundation.org/pipermail/oisf-devel/2010-January/000066.html Cain&Abel sniffs out quite a few as well, but is closed source. I work with IDS and Pcap's all the time, wireshark/libpcap understands protocols and handshakes etc very well, the technical stuff is probably out of my reach as far as coding, but I can certainly contribute pcaps and testing. There is also a tool out there rule2alert that goes the other way, snort rule to generate traffic/pcaps, based on Scapy. http://code.google.com/p/rule2alert/ http://www.secdev.org/projects/scapy/ I know that's the opposite direction, but somewhere in mind I think it'd be beneficial to johns' ends'. It could also be I need sleep... so in closing I like the idea- how can I help :) -rich
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.