Ettercap is by far one of the most powerful Security Tools to perform
Communication Interception on both Local and Wireless Networks.
A few days ago,
Version 0.7.5 was released, introducing
three new and exciting features:
1.
SSL Password Interception. Captures user
credentials from secure web portals such as Facebook, Yahoo, Hotmail and
Gmail. This technique is based on the "Sslstrip" tool.
2.
IPv6 Support. With this feature, we can now
perform security tests over this network generation, giving us new and
exciting Ethical Hacking opportunities.
3.
NBNS Spoofing. Steals the identitiy of any
network device or service, as long as it is based on Netbios name
resolution. This attack is very useful on Windows Networks and Samba
servers. It can also be used to attack other technologies such as SAN
and NAS.
As Security Experts, we need to stay at the cutting edge of our
field, testing new attack tools and their capabilities as soon as they
become available.
Unfortunately, Ettercap's installation procedure is very poorly documented. Despite my amazing
Google Powers, I have not found any useful Internet tutorial. To make things worse, even the great
BackTrack distribution does not include the new version.
Furthermore, I really doubt we'll see the new version on Ubuntu's
software repositories any time soon. Ettercap authors strongly recommend
using "development" libraries, which are considered "unstable" for most
production environments.
To solve the conundrum, I decided to write this tutorial, explaining a detailed installation procedure for Ettercap on
Ubuntu 12.04. Of course, a rookie Hacker might say "I'll just install it on Windows! Problem solved!".
Well, if you are one of these rookies, I have bad news for you. Installing it on Windows
is extremely easy. However, this platform
does not support the new SSL attack!
So, with this Tutorial, I'm going to help you become one of the first
Ethical Hackers in the whole Universe with the knowledge and power to
use the new Ettercap awesome features.
INSTALLATION PROCEDURE
1. Installing Dependencies. Ettercap requires a
lot of
software libraries not usually available on a standard Ubuntu system.
To install them, just open a terminal and run the following commands:
apt-get install -y cmake cmake-curses-gui
apt-get install -y libgtk2.0-dev libnet1-dev flex build-essential
apt-get install -y linux-headers-`uname -r` libpcre3-dev libpcap0.8-dev openssl
apt-get install -y libssl-dev ncurses-bin libncurses5-dev libnet6-1.3-dev libpthread-stubs0-dev
apt-get install -y zlib1g-dev libltdl-dev pango-graphite pkg-config libpango1.0-dev
apt-get install -y libatk1.0-dev libgtk2.0-dev autoconf byacc
(To accelerate the installation, open this tutorial in your browser
and just copy-paste the instructions on your terminal, instead of
entering them manually).
2. Sslstrip support. This new feature requires a recent
libcurl library version, not yet available in Ubuntu's repositories. So, we need to install it from source. Run the following commands:
cd /usr/src
wget http://curl.haxx.se/download/curl-7.28.0.tar.gz
tar xvfz curl-7.28.0.tar.gz
cd curl-7.28.0
./configure
make
make install
In this tutorial, I'm using
/usr/src as destination folder, feel free to use whatever you want.
To make sure Ettercap finds the new library, open the
/etc/ld.so.conf file. Add
/usr/local/lib at the end. Save the file and run
ldconfig to complete the installation.
2. IPv6 Support. This new feature requires a recent
libnet library version, not yet available in Ubuntu's repositories. Again, we are going to install it from source. Go to
http://sourceforge.net/projects/libnet-dev/ and download the
libnet-1.1.6.tar.gz file to any folder. In this tutorial, I'm using
/usr/src
Run the following commands from your terminal:
cd /usr/src
tar xvfz libnet-1.1.6.tar.gz
cd libnet-1.1.6
./configure
make
make install
ldconfig
3. Ettercap Installation. Open
http://sourceforge.net/projects/ettercap in your browser. Download
ettercap-0-7.5.tar.gz to any folder.
In this tutorial, I use
/hack/network/mitm (I install all my "Man in The Middle" attack tools in this folder, hence the name. Of course, you can choose any other folder).
Run the following commands in your terminal:
cd /hack/network/mitm
tar xvfz ettercap-0.7.5.tar.gz
cd ettercap-0.7.5
mkdir build
cd build
cmake ..
ccmake ..
You'll see the following screen:

Change the following fields, with the indicated values:
ENABLE_IPV6 ON
FOUND_LIBCURL /usr/local/lib/libcurl.so
HAVE_LIBNET /usr/local/lib/libnet.so
Press
Enter after modifying each field, press "
c" to return to configuration mode, and finally "
g" to save the changes and exit. Finish Ettercap's installation by running the following commands:
make
make install
SSLSTRIP CONFIGURATION
1. Sslstrip capability requires
root privileges to make some temporal changes to the local firewall. To grant them, open Ettercap's configuration file
/etc/ettercap/etter.conf. Modify the text at line
17, so it reads
ec_uid = 0.

2. Delete the
# comment character from lines
171 and 1
72.
These are firewall modifications required by Sslstrip, used only while
Ettercap is running. Don't worry, they are just network traffic
redirection instructions and do not jeopardize your firewall integrity
in any way.

Save the etter.conf file.
ETTERCAP TESTING
Run the following command:
ettercap -G
If everything works as expected, you'll see the following screen:

Congratulations! You are now one of the first and proud Ethical
Hackers in the whole Universe to test the new and powerful Ettercap!
Now go have a drink... You know you deserve it.