ngrep questions

fakie_flip · 08-15-2006, 06:27 AM

Does anyone know how to use ngrep to show only packets from a certain ip range? Does anyone know how to use ngrep to show only packets with certain patterns in them? I tried to use it like normal grep and with the -v option, but that didn't work.

////// · 08-15-2006, 06:53 AM

multiple words as a pattern.
'pattern1|pattern2|pattern3'

Hex as a pattern.
ngrep -xX '0xc5d5e5f55666768696a6b6c6d6e6' port 80

http://ngrep.sourceforge.net/usage.html

fakie_flip · 08-16-2006, 04:25 AM

Why would I want to use hexadecimal?

////// · 08-17-2006, 08:11 AM

Quote:

Originally Posted by fakie_flip

Why would I want to use hexadecimal?

You can catch virus/trojan/exploit packets with hex strings.
I believe you could catch this ssh exploit ..

Code:

drop tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"EXPLOIT ssh CRC32 overflow NOOP"; flow:to_server,established; content:"|90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90|"; reference:bugtraq,2347; reference:cve,2001-0144; reference:cve,2001-0572; classtype:shellcode-detect; sid:1326; rev:6;)

.. with string like this:

Code:

ngrep -xX '0x90909090909090909090909090909090' port 22

I'm not a expert with this stuff, maybe there is someone that knows more and could confirm this ?

fakie_flip · 08-19-2006, 08:31 AM

I've been trying to catch my password with ngrep. I run this.

Code:

ngrep -d eth1 mypassword

Then I login to websites, instant messenger, and I haven't been able to catch my password yet. I do not know why. I don't think all of the instant message protocols use ssl with gaim.