Penetration testing - security password auditing for UNIX / Linux systems
If you just want to see how secure your network is or you would like to audit your own network, and to determine the insecurity of cleartext network protocols then you need to use sniffer programs. There are tons of Network protocol analyzer for Unix and Linux exist that allows examination of data from a live network, or from a capture file on disk For example Ethereal is one of such a program.
However, if you just interested in a password related auditing then nothing can beat dsniff program. It is simple and easy to use. dsniff capture passwords through http, ftp, smtp, pop3, telnet and many other cleartext protocols. dsniff includes various sniffing utilities for penetration testing.
Step # 1: Install dsniff
Install dsniff under Debian / Ubuntu Linux:
# apt-get install dsniff
If you are using FreeBSD then you can install it using ports or binary package:
# pkg_add -r dsniff
On the other hand, use ports collection:
># cd /usr/ports/security/dsniff
# make; make install; make clean
Step # 2: Start dsniff
dsniff automatically detects and minimally parses each application protocol, only saving the interesting bits, and uses Berkeley DB as its output file format, only logging unique authentication attempts. Login as a root user and type dsniff command:
# dsniff
For example, if user use ftp, telnet, or other cleartext protocol then you can capture passwords:
Output:
03/16/06 23:34:02 udp 192.168.1.2.1195 -> router.161 (snmp) [version 1] public 03/16/06 23:36:10 tcp 192.168.1.2.49522 -> f100.somedomain.com.21 (ftp) USER rocky PASS myF&6z#*
Depend upon this audit report:
- You can block cleartext port
- Educate your user and ask them to use secure version of each of these protocols
Want to stay up to date with the latest Linux tips, news and announcements? Subscribe to our free e-mail newsletter or RSS feed to get all updates.
You can Email this page to a friend.
You may also be interested in other helpful articles:
- AIX UNIX: File auditing to track reads and writes changes
- Security Tip: Avoid Detection with nmap Port Scan Decoys
- Comparison Linux vs UNIX file systems
- NMAP - Network exploration tool and security / port scanner v4.0 released
- FreeBSD Enable Security Port Auditing to Avoid Vulnerabilities With portaudit
Leave a Reply
We encourage your comments, and suggestions. But please stay on topic, be polite, and avoid spam. Thank you very much for stopping by our site!
Tags: application protocol, apt-get_command, dsniff_command, ethereal, insecurity, network protocol analyzer, network protocols, passwords, pop3 telnet, smtp pop3, sniffer programs, Ubuntu Linux
Recent Comments
Today ~ 10 Comments
Today ~ 3 Comments
Today ~ 7 Comments
Today ~ 4 Comments
Today ~ 8 Comments