Example Web Packet Sniffer

What is This?

These are a pair of Perl scripts that together will:
  1. Listen to all TCP/IP traffic on a subnet.
  2. Intercept all outgoing requests for Web documents and display them.
  3. Intercept all incoming requests for Web documents and display them.
  4. Decode the Basic authentication passwords, if any.
These scripts (totalling just 39 lines of code) were demoed the WWW6 conference in Santa Clara, CA in April 1997, at a tutorial I gave on Web security. The idea wasn't to show how to write a great packet sniffer (heaven forbid!) but to show how vulnerable the Web is to sniffing.

Example Output

Here's the output I got when I plugged a laptop running sniffer into the subnet that included the conference public access kiosks (the passwords have been modified to protect the innocent).
207.218.76.48 -> pasture.ecn.purdue.edu	GET /~agenhtml/agenmc/icons/balls/red.gif HTTP/1.0
207.218.76.48 -> pasture.ecn.purdue.edu	GET /~agenhtml/agenmc/icons/balls/red.gif HTTP/1.0
207.218.76.108 -> vrml.organic.com	GET /VRML2.0/FINAL/Overview.html HTTP/1.0
207.218.76.108 -> vrml.organic.com	GET /VRML2.0/FINAL/Overview.html HTTP/1.0
207.218.76.106 -> www.DTAG.DE	GET /classes/ticker1.gif HTTP/1.0
207.218.76.106 -> gfx.hotmail.com	GET /spacer.gif HTTP/1.0
207.218.76.106 -> www.hotmail.com	POST /cgi-bin/start/paulxhogan/207.82.250.70_d5 HTTP/1.0
207.218.76.70 -> ice.wco.com	GET /cgi-bin/www6/ice/main.pl HTTP/1.0
207.218.76.70 -> ice.wco.com	Authorization: Basic hmisttxc:wombat
207.218.76.42 -> tmstv.com	GET /cgi-bin/tvcgi.sjm/gridref+s0+g040712000?51,11 HTTP/1.0
207.218.76.67 -> ice.wco.com	POST /cgi-bin/www6/ice/main.pl HTTP/1.0
207.218.76.67 -> ice.wco.com	Authorization: Basic brucecr:Saint
207.218.76.106 -> www.hotmail.com	GET /logo.html HTTP/1.0
207.218.76.106 -> www.hotmail.com	GET /cgi-bin/generate_ad?disk=207.82.250.70_d5&login=paulxhogan&f=1025&curmbox=ACTIVE HTTP/1.0
207.218.76.42 -> tmstv.com	GET /sjmimages/AdvertGif_Zifban.gif HTTP/1.0
207.218.76.42 -> tmstv.com	GET /sjmimages/brtrn2gd.gif HTTP/1.0
207.218.76.106 -> www.hotmail.com	GET /cgi-bin/HoTMaiL?disk=207.82.250.70_d5&login=paulxhogan&f=1025&curmbox=ACTIVE&noad=1 HTTP/1.0
207.218.76.40 -> ice.wco.com	GET /cgi-bin/www6/ice/main.pl?x-a=v&x-id=2386 HTTP/1.0
207.218.76.40 -> ice.wco.com	Authorization: Basic kareng:alpaca23
207.218.76.106 -> www.hotmail.com	GET /cgi-bin/menu?disk=207.82.250.70_d5&login=paulxhogan&f=1025&curmbox=ACTIVE HTTP/1.0

How Do I Use It

The scripts are really only a wrapper around the Unix tcpdump network debugging utility. This utility comes preinstalled in many Unix distributions (including Linux). If you don't have it, you can easily find it on the Web. The scripts will not work on Windows or Macintosh systems because tcpdump is not available on those platforms.

You'll need Perl version 5.003 or higher, and the Perl LWP library.

  1. Download these two Perl scripts:
    1. sniffer.pl
    2. fixup.pl
  2. Examine the source code and make any system-dependent you need (such as the path to tcpdump).
  3. Become root.
  4. Type ./sniffer.pl > results.out
  5. This will record a maximum of 5000 Web accesses to the file results.out. To record more or fewer accesses, provide sniffer.pl with a numeric argument.
  6. The resulting file will contain IP addresses and UUencoded passwords. To look up the hostnames and translate the passwords into human-readable text, run the output through fixup.pl.

What if it Doesn't Work

You're stuck. Please don't write to me for support on these scripts.

What is the Legality of This?

This tool is intended as a demonstration to be used on your own subnet only. I do not condone the use of these scripts for any activity that is illegal or that infringes on the privacy of others.

Lincoln Stein's Home Page


Lincoln D. Stein, lstein@genome.wi.mit.edu
Whitehead Institute/MIT Center for Genome Research
Last modified: Mon Jul 21 14:55:16 EDT 1997