Thursday, November 12, 2009

PASSWORD SNIFFER

SmartSniff - Monitoring TCP/IP packets on your network adapter
Mail PassView - Recover POP3/IMAP/SMTP email passwords.
Dialupass - Recover VPN/RAS/Dialup passwords
___________________________________________________________________

SniffPass is small password monitoring software that listens to your network, capture the passwords that pass through your network adapter, and display them on the screen instantly. SniffPass can capture the passwords of the following Protocols: POP3, IMAP4, SMTP, FTP, and HTTP (basic authentication passwords).
You can use this utility to recover lost Web/FTP/Email passwords.
In order to start using SniffPass, follow the instructions below:
If you have Windows 9x, Windows NT, or Windows XP with SP1, you must download and install the WinPcap capture driver in order to use SniffPass.
In all other versions of Windows (including Windows XP with SP2), installing this capture driver is optional. If you don't install this driver, you can still use the raw sockets method for capturing the passwords.
Run the executable file of SniffPass (SniffPass.exe).
From the File menu, select "Start Capture", or simply click the green play button in the toolbar. If it's the first time that you use SniffPass, you'll be asked to select the capture method and the network adapter that you want to use.
After you select the desired capture options, SniffPass listen to your network adapter, and display instantly any password that it find.

Command-Line Options
Command Description
/NoCapDriver Starts SniffPass without loading the WinPcap Capture Driver.
/NoReg Starts SniffPass without loading/saving your settings to the Registry.


Translating SniffPass to other languages
SniffPass allows you to easily translate all menus, dialog-boxes, and other strings to other languages.
In order to do that, follow the instructions below:
Run SniffPass with /savelangfile parameter:
SniffPass.exe /savelangfile
A file named SniffPass_lng.ini will be created in the folder of SniffPass utility.
Open the created language file in Notepad or in any other text editor.
Translate all menus, dialog-boxes, and string entries to the desired language. Optionally, you can also add your name and/or a link to your Web site. (TranslatorName and TranslatorURL values) If you add this information, it'll be used in the 'About' window.
After you finish the translation, Run SniffPass, and all translated strings will be loaded from the language file.
If you want to run SniffPass without the translation, simply rename the language file, or move it to another folder.

SocketSniff allows you to watch the Windows Sockets (WinSock) activity of the selected process.
For each created socket, the following information is displayed: socket handle, socket type, local and remote addresses, local and remote ports, total number of send/receive bytes, and more. You can also watch the content of each send or receive call, in Ascii mode or as Hex Dump
SocketSniff doesn't require any installation process or additional dll files. In order to start using it, simply run the executable file - SocketSniff.exe
After running it, select the process that you want to inspect, and click Ok. You must select a process that already loaded the winsock library, otherwise, the action will fail. After clicking Ok, SocketSniff will start showing the activity of Windows socket for the selected process.
The upper pane displays the list of all created sockets. When selecting a socket in the upper pane, the lower pane displays the receive and send calls of the selected socket.

Using SocketSniff In Windows Vista
SocketSniff can work in Vista even when UAC (User Account Control) is turned on, as long as the process that you wish to inspect run in the same account and security context of SocketSniff. However, if you want to inspect a process that runs under administrator account, you must also run SocketSniff as administrator. (right-click on SocketSniff.exe and choose 'Run As Administrator')

Translating SocketSniff to other languages
In order to translate SocketSniff to other language, follow the instructions below:
Run SocketSniff with /savelangfile parameter:
SocketSniff.exe /savelangfile
A file named SocketSniff_lng.ini will be created in the folder of SocketSniff utility.
Open the created language file in Notepad or in any other text editor.
Translate all string entries to the desired language. Optionally, you can also add your name and/or a link to your Web site. (TranslatorName and TranslatorURL values) If you add this information, it'll be used in the 'About' window.
After you finish the translation, Run SocketSniff, and all translated strings will be loaded from the language file.
If you want to run SocketSniff without the translation, simply rename the language file, or move it to another folder.
____________________________________________________________________
Network Tools - Other network monitoring tools of NirSoft.
NetResView - View all computers/shares on your network.
SmartSniff - Capture TCP/IP packets on your network adapter
DownTester - Test the download speed of your Internet connection.
SocketSniff - Windows Sockets (WinSock) Sniffer
SniffPass - Capture POP3/IMAP/SMTP/FTP/HTTP passwords on your network adapter.
AdapterWatch - Monitor your network adapters
IPNetInfo - Retrieve IP Address Information from WHOIS servers
_______________________________________________________________

CurrPorts is network monitoring software that displays the list of all currently opened TCP/IP and UDP ports on your local computer. For each port in the list, information about the process that opened the port is also displayed, including the process name, full path of the process, version information of the process (product name, file description, and so on), the time that the process was created, and the user that created it.
In addition, CurrPorts allows you to close unwanted TCP connections, kill the process that opened the ports, and save the TCP/UDP ports information to HTML file , XML file, or to tab-delimited text file.
CurrPorts also automatically mark with pink color suspicious TCP/UDP ports owned by unidentified applications (Applications without version information and icons)
CurrPorts utility is a standalone executable, and it doesn't require any installation process or additional DLLs. In order to start using it, just copy the executable file (cports.exe) to any folder you like, and run it.
The main window of CurrPorts displays the list of all currently opened TCP and UDP ports. You can select one or more items, and then close the selected connections, copy the ports information to the clipboard, or save it to HTML/XML/Text file. If you don't want to view all available columns, or you want to change the order of the columns on the screen and in the files you save, select 'Choose Column' from the View menu, and select the desired columns and their order. In order to sort the list by specific column, click on the header of the desired column.

Command-Line Options
/stext Save the list of all opened TCP/UDP ports into a regular text file.
/stab Save the list of all opened TCP/UDP ports into a tab-delimited text file.
/scomma Save the list of all opened TCP/UDP ports into a comma-delimited text file.
/stabular Save the list of all opened TCP/UDP ports into a tabular text file.
/shtml Save the list of all opened TCP/UDP ports into HTML file (Horizontal).
/sverhtml Save the list of all opened TCP/UDP ports into HTML file (Vertical).
/sxml Save the list of all opened TCP/UDP ports to XML file.
/sort This command-line option can be used with other save options for sorting by the desired column. If you don't specify this option, the list is sorted according to the last sort that you made from the user interface. The parameter can specify the column index (0 for the first column, 1 for the second column, and so on) or the name of the column, like "Remote Port" and "Remote Address". You can specify the '~' prefix character (e.g: "~Remote Address") if you want to sort in descending order. You can put multiple /sort in the command-line if you want to sort by multiple columns.
Examples:
cports.exe /shtml "f:\temp\1.html" /sort 2 /sort ~1
cports.exe /shtml "f:\temp\1.html" /sort "Protocol" /sort "~Remote Address"

/nosort When you specify this command-line option, the list will be saved without any sorting.
/filter Start CurrPorts with the specified filters. If you want to specify more than one filter, use the ';' character as a delimiter.
/cfg Start CurrPorts with the specified config file.

Here's some examples:

Save all opened TCP/IP ports created by Internet Explorer browser to HTML file:
cports.exe /filter "include:process:iexplore" /shtml "c:\temp\ports.html"
Add all opened ports information to ports.txt (as tab-delimited text file). This example only works when running it from a command-prompt window.
cports.exe /stab "" >> c:\temp\cports1.txt
Start CurrPorts with filter that will only display the opened ports of Internet Explorer and FireFox:
cports.exe /filter "include:process:firefox;include:process:iexplore"

Closing a Connection From Command-Line
Starting from version 1.09, you can close one or more connections from command-line, by using /close parameter.
The syntax of /close command:
/close
For each parameter, you can specify "*" in order to include all ports or addresses.
Examples:

Close all connections with remote port 80 and remote address 192.168.1.10:
/close * * 192.168.1.10 80
Close all connections with remote port 80 (for all remote addresses):
/close * * * 80
Close all connections to remote address 192.168.20.30:
/close * * 192.168.20.30 *
Close all connections with local port 80:
/close * 80 * *

Translating CurrPorts To Another Language
CurrPorts allows you to easily translate all menus, dialog-boxes, and other strings to other languages.
In order to do that, follow the instructions below:
Run CurrPorts with /savelangfile parameter:
cports.exe /savelangfile
A file named cports_lng.ini will be created in the folder of CurrPorts utility.
Open the created language file in Notepad or in any other text editor.
Translate all menus, dialog-boxes, and string entries to the desired language.
After you finish the translation, Run CurrPorts, and all translated strings will be loaded from the language file.
If you want to run CurrPorts without the translation, simply rename the language file, or move it to another folder.
_______________________________________
Disk Doctors Outlook Mail Recovery - Repairs corrupt and damaged .pst files.
MessenPass - Recover the passwords of 'Instant Messenger' applications.
IE PassView - Recover the passwords of Internet Explorer.
Dialupass - Recover VPN/RAS/Dialup passwords
Asterisk Logger - Recover passwords stored behind asterisk (**) characters.
Network Password Recovery - Recover Windows XP/Vista network passwords (Credentials file)
____________________________________________

Mail PassView is a small password-recovery tool that reveals the passwords and other account details for the following email clients:

Outlook Express
Microsoft Outlook 2000 (POP3 and SMTP Accounts only)
Microsoft Outlook 2002/2003/2007 (POP3, IMAP, HTTP and SMTP Accounts)
Windows Mail
Windows Live Mail
IncrediMail
Eudora
Netscape 6.x/7.x (If the password is not encrypted with master password)
Mozilla Thunderbird (If the password is not encrypted with master password)
Group Mail Free
Yahoo! Mail - If the password is saved in Yahoo! Messenger application.
Hotmail/MSN mail - If the password is saved in MSN/Windows/Live Messenger application.
Gmail - If the password is saved by Gmail Notifier application, Google Desktop, or by Google Talk.
For each email account, the following fields are displayed: Account Name, Application, Email, Server, Server Type (POP3/IMAP/SMTP), User Name, and the Password.

If your email program is not supported by Mail PassView, you can still recover your password by using this Password Sniffer
Translating Mail PassView to other languages
Mail PassView allows you to easily translate all dialog-boxes, menus, and strings to other language.
In order to do that, follow the instructions below:
Run Mail PassView with /savelangfile parameter:
mailpv.exe /savelangfile
A file named mailpv_lng.ini will be created in the folder of Mail PassView utility.
Open the created language file in Notepad or in any other text editor.
Translate all menus, dialog-boxes, and string entries to the desired language.
After you finish the translation, Run Mail PassView, and all translated strings will be loaded from the language file.
If you want to run Mail PassView without the translation, simply rename the language file, or move it to another folder.
_____________________

When you use the "Dial-Up Networking" module for connecting to the internet or to other networks, the operating system give you the option to store the password and use it when it needed. Although the password is constantly stored in your computer, the operating system doesn't allow you to watch it. if you forget your password and you want to extract it from your computer, you can use the Dialupass utility for viewing the password.
This utility enumerates all Dial-Up entries on your computer and reveals their logon details: User Name, Password and Domain.
it works perfectly in the following operating systems: Windows 95, Windows 98, Windows ME, Windows NT, Windows 2000, and Windows XP. In Windows 2000 and Windows XP, the Dialupass utility can reveal the Dial-Up passwords only if you are logged on with administrator privileges. Using Dialupass
The Dialupass utility is a standalone application, and it doesn't require any installation process or additional DLLs. Just copy the dialupass.exe to any folder you want and run it. After you run it, it'll instantly show all your Dial-Up accounts and their user/password details.
You can also select one or more Dial-Up items (by using Ctrl and Shift keys), and then save them into a readable or tab-limited text file , or copy them into the clipboard (Ctrl+C).

the Dialupass utility also allows you to easily edit the logon details: user name, password and domain. You can get the editing dialog-box by double-clicking the item you want to edit.


Viewing the logon details of other users
Under Windows 2000/XP, you can view the logon details of other users in the same computer. Simply press Ctrl+U, and select the desired user, or select to view the passwords of all user profiles in your system. In order to view the logon details of other users under Windows NT, you should run Dialupass in advanced mode, by using the /adv option: dialupass.exe /adv

Command-Line Options
Option Description
/stext Save the list of all dial-up items into a regular text file.
/stab Save the list of all dial-up items into a tab-delimited text file.
/stabular Save the list of all dial-up items into a tabular text file.
/shtml Save the list of all dial-up items into horizontal HTML file.
/sverhtml Save the list of all dial-up items into vertical HTML file.

No comments:

Post a Comment