Sniffing Unencrypted Traffic

[Arcadion]

Hi folks, I've been playing around with my new Tetra and I can get the target clients to hop onto the access point - What I'd like to do is log any unencrypted HTTP POST and FTP credentials. It wouldn't hurt if POP3 and others where in there too, but basically I'm interested in logging non-SSL. What's a good module to do this? Responder? SSLSplit with some options? Ettercap?

Arcadion

[bored369]

Dwall, but I don't think it logs. Haven't really checked that much into it.

[dustbyter]

You can also route with iptables to another machine and use wireshark.

Otherwise you can use tcpdump to save the pcap... and analyze it later.

[Arcadion]

So far I tried Dwall but like Bored369 says, it doesn't log as far as I could tell. It does grab things, but doesn't log.

With the amount of data going by, I don't think I can use tcpdump...

Maybe like dustbyter says Wireshark and some real-time filtering?

I tried using Responder for two hours last night and I honestly couldn't get it to grab anything from my target even though I was on the target opening FTP connections silly-nilly. My hunch is Responder is what I need, but its not cooperating.

You'd think something as basic as unencrypted forms and plaintext credentials would be something this platform could do out of the box.