Net-Creds

[Mutt]

Good day, folks, in this article we'll talk about Net-Creds.
Net-Creds carefully sniffs passwords and hashes from the interface or from the pcap file. Consolidates fragmented packets and does not rely on ports to identify a service.

Sniffs:

• Visited URLs
• sent POST requests
• logins / passwords from HTTP forms
• logins / passwords for basic HTTP authentication
• HTTP searches
• FTP logins / passwords
• IRC logins / passwords
• POP logins / passwords
• IMAP logins / passwords
• Telnet logins / passwords
• SMTP logins / passwords
• SNMP community string
• all supported protocols NTLMv1 / v2 like HTTP, SMB, LDAP, etc.
• Kerberos

GitHub page: https://github.com/DanMcInerney/net-creds

Installing Net-Creds
Installation on Linux:

git clone https://github.com/DanMcInerney/net-creds.git
cd net-creds/
./net-creds.py

Installation on OSX:

sudo easy_install pip
sudo pip install scapy
sudo pip install pcapy
brew install libdnet --with-python
mkdir -p /Users/<username>/Library/Python/2.7/lib/python/site-packages
echo 'import site; site.addsitedir("/usr/local/lib/python2.7/site-packages")' >> /Users/<username>/Library/Python/2.7/lib/python/site-packages/homebrew.pth
sudo pip install pypcap
brew tap brona/iproute2mac
brew install iproute2mac

Then replace line 74 '/ sbin / ip' with '/ usr / local / bin / ip'.

Net-Creds startup examples
Automatically detect interface for sniffing:

sudo python net-creds.py

Select eth0 as interface:

sudo python net-creds.py -i eth0

Ignore packets to and from 192.168.0.2:

sudo python net-creds.py -f 192.168.0.2

Read from pcap:

python net-creds.py -p pcapfile

Net-Creds Help
Usage:

net-creds.py [-h] [-i INTERFACE] [-p PCAP] [-f FILTERIP] [-v]

Optional arguments:

-h, --help show this help message and exit.
  -i INTERFACE, --interface INTERFACE
                        Select interface
  -p PCAP, --pcap PCAP Parse information from pcap file; -p <
  pcap_file_name > -f FILTERIP, --filterip FILTERIP
                        Do not sniff packets from this IP address; -f
                        192.168.0.4
  -v, --verbose Show full URLs and POST requests, rather than
                        truncate them at 100 characters

Screenshots of Net-Creds

Screenshots of Net-Creds