Ettercap not showing passwords

[monty47]

Hi everyone
I used to have ettercap on backtrack 4 and everything was ok...
But on ubuntu 10.04 I'm having this issue; it is not showing passwords (if i log in for example in a forum with a http link ) and not sending false certificate (if i try to log in in https links, after uncommenting the redir ip tables in etter.conf).
Other features seems to work alright (such as dns spoofing) and the arp poisonning is succesful.
Besides, Wireshark gets the passwords.
Any ideas?
thanks for your replies

[monty47]

after some research I used "iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000" while ettercap was on, and its behaviour is a bit weird ; I successfully got the facebook user and password that I've input in the machine I was sniffing (https link, this time the certificate process went on) but still no password on http links.
Sometimes I get this message "SEND L3 ERROR: 93 byte packet (0800:11) destined to 172.16.1.1 was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Operation not permitted)
)"

I tried to uninstall firewall and reinstall iptables but no improvements.
And another thing I noticed is that I can't sniff passwords input by the attacker (when the target is set on the router and no second target), while it is possible on backtrack.

Don't see what I'm doing wrong, I've done it millions of times back then but somehow it's not working...

[monty47]

I did a clean install of ubuntu (10.04.1) and tested ettercap another time and the problem is still there.
I forgot to mention that I'm using Thimoty Redaelli's fixed version (https://launchpad.net/~timothy-redae...izzt/+packages) since the version on the backtrack repo crashes when scanning for hosts on ubuntu.
Maybe the problem is comming from this version...(all other plugins seems to work well though).
Has anyone managed to make ettercap work on ubuntu 10.04 ?

[bastienvans]

hey man, I am in the same boat as you. Have you figured out anything? It works fine in BT4, but not ubuntu 10.0.4

Thanks!

[monty47]

I gave up on ubuntu 10.04 but it seems to work on the Ubuntu 10.10 (beta) version, though updating some packets (python I think ,but not sure) made ettercap crash once again after scanning hosts.
I'm waiting for the final version of 10.10 to see if it will still be working.

[kapiljhajhria]

same with me dude...i have upgraded to latest version of Ubuntu but still same problem...after scanning for host it just crashes

[monty47]

try to use the ettercap version from the link i posted in my 3rd message.
It won't crash after scanning for hosts but http sniffing doesn't seem to work, can you confirm this?

[monty47]

Good and bad news guys. I managed to partially solve the problem on 10.10 ; as I said before, ettercap needed python2.5 to work correctly (dunno why though), since I noticed that as soon as I upgraded python on the beta version, ettercap started to crash while scanning for hosts.That's why I wanted to install python2.5.
The problem was (dunno if you'll have the same problem) that every time I wanted to install the python2.5 minimal package (python2.5 depends on that package) synaptic wanted to delete many other essential packages.
So I used this technique to install it ;

http://welcometoubuntu.blogspot.com/...untu-1004.html

Now ettercap seems to be unstable, it sometime crashes after scanning hosts and sometimes it's ok...(I'm using the version from the backtrack repo, http://moon.backtrack-linux.org/README.txt )

[FutureNeo]

i found a solution here: http://codenull.net/?p=153

[monty47]

Hey thanks a lot FutureNeo! I've succesfully followed all the steps and it is true that ettercap sniffs passwords after this (the other computers no longer loose their connection), but I still have the crashing issue; ettercap crash 3 times over 4 after scanning hosts...