Driftnet Port

[shalkith]

I've been messing around with different MITM attacks and I've recently found driftnet. It's a very interesting tool but seems to only listen on port 80.

On my network I'm passing all http traffic through port 10000. anyone know how to change the port that driftnet listens to to another port?

[Mr-Protocol]

I don't think it's port specific.

Driftnet is a program which listens to network traffic and picks out images from TCP streams it observes. Fun to run on a host which sees lots of web traffic.

http://www.ex-parrot.com/~chris/driftnet/

[shalkith]

I don't think it's port specific.

http://www.ex-parrot.com/~chris/driftnet/

That's strange. I was testing it this morning and it worked fine when all traffic was on port 80 when I redirected traffic to get stripssl working driftnet quit working.

I assumed it ran on port 80.

Any idea what else would cause it to stop working?

[Mr-Protocol]

That's strange. I was testing it this morning and it worked fine when all traffic was on port 80 when I redirected traffic to get stripssl working driftnet quit working.

I assumed it ran on port 80.

Any idea what else would cause it to stop working?

It is probably how it's looking for data. Think of it like this (incoming crappy text graphic):

Internet >>ENCRYPTED SSL>> DRIFTNET -> SSL Strip -> Computer Browser

If this is the case, the data is encrypted and it will not recognize most things. My thinking is that Driftnet just watches traffic on the interface, so it's being sniffed before it's even passed to SSL Strip.

**Note: This is just a guess, I'm not sure this is how the data path really goes.