Kill a connection: killing connections of choice from the connections-list.TCP/IP stack fingerprinting: determine the OS of the victim host and its network adapter.Packet filtering/dropping: setting up a filter that searches for a particular string (or hexadecimal sequence) in the TCP or UDP payload and replaces it with a custom string/sequence of choice, or drops the entire packet.Password collectors for: TELNET, FTP, POP, IMAP, rlogin, SSH1, ICQ, SMB, MySQL, HTTP, NNTP, X11, Napster, IRC, RIP, BGP, SOCKS 5, IMAP 4, VNC, LDAP, NFS, SNMP, MSN, YMSG.Plug-in support: creation of custom plugins using Ettercap's API.Remote traffic through a GRE tunnel: the sniffing of remote traffic through a GRE tunnel from a remote Cisco router, and perform a man-in-the-middle attack on it.HTTPS support: the sniffing of HTTP SSL secured data-even when the connection is made through a proxy.Ettercap is the first software capable of sniffing an SSH connection in full duplex. SSH1 support: the sniffing of a username and password, and even the data of an SSH1 connection.Character injection into an established connection: characters can be injected into a server (emulating commands) or to a client (emulating replies) while maintaining a live connection.In addition, the software also offers the following features:

PublicARP-based: uses ARP poisoning to sniff on a switched LAN from a victim host to all other hosts (half-duplex).ARP-based: uses ARP poisoning to sniff on a switched LAN between two hosts (full-duplex).MAC-based: packets are filtered based on MAC address, useful for sniffing connections through a gateway.IP-based: packets are filtered based on IP source and destination.Ettercap has plugin support so that the features can be extended by adding new plugins.Įttercap supports active and passive dissection of many protocols (including ciphered ones) and provides many features for network and host analysis. Thereby it can act as a 'man in the middle' and unleash various attacks on the victims. Ettercap works by putting the network interface into promiscuous mode and by ARP poisoning the target machines.

Ettercap kali