net-creds 1.0

Thoroughly sniff passwords and hashes from an interface or pcap file. Concatenates fragmented packets and does not rely on ports for service identification.
Sniffs

• URLs visited
• HTTP site logins/passwords
• HTTP Basic Auth
• FTP logins/passwords
• IRC logins/passwords
• POP logins/passwords
• IMAP logins/passwords
• SMTP logins/passwords
• SNMP community string
• NTLM challenge and response hashes
• Kerberos (untested, I have no pcaps)

Examples

Auto-detect the interface to sniff

Code:

Select All

sudo python net-creds.py

Choose eth0 as the interface

Code:

Select All

sudo python net-creds.py -i eth0

Read from pcap

Code:

Select All

sudo python net-creds.py -p pcapfile

Thanks

• Laurent Gaffie writer of PCredz
• psychomario writer of ntlmsspparser