Ettercap Question

[Urieal]

Posted 26 September 2012 - 10:00 PM

I just run ettercap on the pineapple and dump everything to a pcap file....

cd /usb

ettercap -Tq -i br-lan -w filename.pcap

When done collecting open the file in NetworkMiner 1.4

Click on images tab...

done

PS Sometimes I just run driftnet on the host PC that the pineapple is connected to..

Edited by myst32, 26 September 2012 - 10:01 PM.

I stole this post from the Mark IV forums and was wondering if someone could clarify...

Is he referring to running the command

cd /usb ettercap -Tq -i br-lan -w filename.pcap

from the Tile..

or SSHing in and running from there?

[Whistle Master]

Not from the tile, through SSH. However, I strongly recommend to install and use the infusion.

[Urieal]

So from the infusion I click the LARGE tile, and that gives me options (regarding Ettercap)

The first tab has an area to select the INTERFACE and there is also a section for the command line?

Is this where I would put in (in my case I'm using the SD CARD).

cd /sd ettercap -Tq -i (interface) -w filename.pcap

and then hit start?

Thus

saving the entire log to the SDCARD named filename.pcap

One last question-- again sorry (maybe this can get stickied)

The interface I want to select to monitor is the wlan0 if I'm using PineAP for clients to connect?

My Setup is as follows:

WLAN0 - > PineAP Access Point.

WLAN1 - > Not Active

WLAN2 (usb) - > Client Mode via Seperate WiFi)

based on my setup

I take it people connect and use WLAN0 therefor I monitor THAT access point?
OR should I be monitoring WLAN2 in this scenario?

I am *NOT* Using eth0.

[Whistle Master]

pcap files are automatically saved, you don't need to specify it in the command. If you installed the infusion on your sd card, then the pcap will be also on the sd card.

Use br-lan as the interface.

You don't need to enter anything in the command line field. Just select the options from the GUI and hit start. You will find the pcap files in the History tab.