A comprehensive suite for man-in-the-middle attacks, featuring live connection sniffing, content filtering, and protocol dissection.
Ettercap is a comprehensive network security tool suite designed for performing man-in-the-middle (MITM) attacks on local area networks (LANs). It enables security professionals to intercept, analyze, and manipulate live network traffic through techniques like ARP poisoning, content filtering, and protocol dissection for security auditing and educational purposes.
Security professionals, ethical hackers, and network administrators who need to audit network security, analyze vulnerabilities, or perform penetration testing in LAN environments.
Developers choose Ettercap for its unified sniffing architecture that allows multiple simultaneous MITM attacks, extensive protocol support including SSH1 decryption, and flexible interfaces (text, curses, GTK) suitable for various workflows.
Ettercap Project
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Disables kernel IP forwarding and handles packet forwarding internally, allowing multiple MITM attacks simultaneously as detailed in the technical paper.
Supports ARP poisoning, ICMP redirection, DHCP spoofing, and SSH1 decryption, providing a wide range of techniques for security testing and protocol dissection.
Offers text mode, curses-based, and GTK+ graphical interfaces, catering to different preferences and workflows, as highlighted in the README.
Can discover hosts, operating systems, open ports, and network topology without sending packets, enabling stealthy analysis for security audits.
Requires numerous libraries like libpcap, libnet, and openssl, with platform-specific issues noted in README.PLATFORMS, making installation and compilation non-trivial.
Primarily designed for local area networks; techniques like ARP poisoning are ineffective on switched or wide-area networks, limiting broader applicability.
Relies on extensive man pages and technical configurations for attacks, with no beginner-friendly guides, which can be daunting for users without deep networking knowledge.