Example Web Packet Sniffer
What is This?
These are a pair of Perl scripts that together will:
- Listen to all TCP/IP traffic on a subnet.
- Intercept all outgoing requests for Web documents and display
them.
- Intercept all incoming requests for Web documents and display
them.
- Decode the Basic authentication passwords, if any.
These scripts (totalling just 39 lines of code) were demoed the WWW6 conference in Santa
Clara, CA in April 1997, at a tutorial I gave on Web security. The
idea wasn't to show how to write a great packet sniffer (heaven
forbid!) but to show how vulnerable the Web is to sniffing.
Example Output
Here's the output I got when I plugged a laptop running sniffer into
the subnet that included the conference public access kiosks (the
passwords have been modified to protect the innocent).
207.218.76.48 -> pasture.ecn.purdue.edu GET /~agenhtml/agenmc/icons/balls/red.gif HTTP/1.0
207.218.76.48 -> pasture.ecn.purdue.edu GET /~agenhtml/agenmc/icons/balls/red.gif HTTP/1.0
207.218.76.108 -> vrml.organic.com GET /VRML2.0/FINAL/Overview.html HTTP/1.0
207.218.76.108 -> vrml.organic.com GET /VRML2.0/FINAL/Overview.html HTTP/1.0
207.218.76.106 -> www.DTAG.DE GET /classes/ticker1.gif HTTP/1.0
207.218.76.106 -> gfx.hotmail.com GET /spacer.gif HTTP/1.0
207.218.76.106 -> www.hotmail.com POST /cgi-bin/start/paulxhogan/207.82.250.70_d5 HTTP/1.0
207.218.76.70 -> ice.wco.com GET /cgi-bin/www6/ice/main.pl HTTP/1.0
207.218.76.70 -> ice.wco.com Authorization: Basic hmisttxc:wombat
207.218.76.42 -> tmstv.com GET /cgi-bin/tvcgi.sjm/gridref+s0+g040712000?51,11 HTTP/1.0
207.218.76.67 -> ice.wco.com POST /cgi-bin/www6/ice/main.pl HTTP/1.0
207.218.76.67 -> ice.wco.com Authorization: Basic brucecr:Saint
207.218.76.106 -> www.hotmail.com GET /logo.html HTTP/1.0
207.218.76.106 -> www.hotmail.com GET /cgi-bin/generate_ad?disk=207.82.250.70_d5&login=paulxhogan&f=1025&curmbox=ACTIVE HTTP/1.0
207.218.76.42 -> tmstv.com GET /sjmimages/AdvertGif_Zifban.gif HTTP/1.0
207.218.76.42 -> tmstv.com GET /sjmimages/brtrn2gd.gif HTTP/1.0
207.218.76.106 -> www.hotmail.com GET /cgi-bin/HoTMaiL?disk=207.82.250.70_d5&login=paulxhogan&f=1025&curmbox=ACTIVE&noad=1 HTTP/1.0
207.218.76.40 -> ice.wco.com GET /cgi-bin/www6/ice/main.pl?x-a=v&x-id=2386 HTTP/1.0
207.218.76.40 -> ice.wco.com Authorization: Basic kareng:alpaca23
207.218.76.106 -> www.hotmail.com GET /cgi-bin/menu?disk=207.82.250.70_d5&login=paulxhogan&f=1025&curmbox=ACTIVE HTTP/1.0
How Do I Use It
The scripts are really only a wrapper around the Unix
tcpdump network debugging utility. This utility comes
preinstalled in many Unix distributions (including Linux). If you
don't have it, you can easily find it on the Web. The scripts will
not work on Windows or Macintosh systems because tcpdump is not
available on those platforms.
You'll need Perl version
5.003 or higher, and the Perl LWP library.
- Download these two Perl scripts:
- sniffer.pl
- fixup.pl
- Examine the source code and make any system-dependent you need
(such as the path to tcpdump).
- Become root.
- Type ./sniffer.pl > results.out
- This will record a maximum of 5000 Web accesses to the file
results.out. To record more or fewer accesses, provide
sniffer.pl with a numeric argument.
- The resulting file will contain IP addresses and UUencoded
passwords. To look up the hostnames and translate the passwords
into human-readable text, run the output through fixup.pl.
What if it Doesn't Work
You're stuck. Please don't write to me for support on these scripts.
What is the Legality of This?
This tool is intended as a demonstration to be used on your own subnet
only. I do not condone the use of these scripts for any activity that
is illegal or that infringes on the privacy of others.
Lincoln Stein's Home Page
Lincoln D. Stein, lstein@genome.wi.mit.edu
Whitehead Institute/MIT Center for Genome Research
Last modified: Mon Jul 21 14:55:16 EDT 1997