dsniff

The dsniff package provides various tools designed to listen to and manipulate network traffic, exposing cleartext insecurities in protocols like FTP, Telnet, HTTP, POP, and more. These tools are useful for security testing on local networks, identifying weak authentication mechanisms, and demonstrating risks of unencrypted communications. Tools like dsniff sniff passwords, filesnarf extracts files from NFS, and urlsnarf logs HTTP URLs.

Use cases include penetration testing switched LANs, auditing for plaintext credentials, and educational demonstrations of network vulnerabilities. arpspoof enables ARP poisoning to intercept traffic, while sshmitm and webmitm facilitate monkey-in-the-middle attacks. The suite requires careful use, as noted by the warning not to abuse this software.

All tools operate on captured packets via libpcap, supporting live interfaces or pcap files, with version 2.5a2 providing options for filtering, verbose output, and protocol-specific behaviors.

dsniff tools use libpcap for packet capture on interfaces or from pcap files, reassembling TCP streams for half-duplex analysis. They target cleartext protocols by decoding known ports or forcing deep packet inspection (DPI), ignoring /etc/services if needed. Techniques include ARP spoofing for traffic redirection, DNS query forgery from hosts files, MAC flooding to overload switches, and MITM proxying for SSH/HTTP/HTTPS to sniff credentials and content in real-time.