Take the 2-minute tour ×
Software Recommendations Stack Exchange is a question and answer site for people seeking specific software recommendations. It's 100% free, no registration required.

What tool you can recommend to reveal credentials transferred in unencrypted connection to POP3 server?

  • I would prefer free and possibly open-source solutions.
  • Platforms are Linux and/or Windows.
share|improve this question
    
The solution must run on both OS? –  unor Apr 19 at 23:17
1  
@unor - not necessarily, but it would be appreciated –  miroxlav Apr 19 at 23:22
    
I recommended 4 tools I think are among the most widely used and that I've personally tried (for POP3 or other). There are many more but that's my favorite ones. –  Franck Dernoncourt Apr 20 at 3:02

5 Answers 5

up vote 4 down vote accepted

You can use tcpdump:

  • free and open-source
  • works on Linux
  • can sniff network data, such as POP3 passwords:

Code snippet to get POP3 passwords and a bit more:

tcpdump port http or port ftp or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20`
share|improve this answer
1  
I'm awarding this answer because of open character of packet capturing. There is also command-line compatible WinPCap equivalent of the tool for Windows users. –  miroxlav Apr 20 at 11:08

You can use Wireshark:

  • free and open-source
  • works on Windows/Linux/Mac
  • can capture all network data. Just filter what you need:

enter image description here

share|improve this answer

You can use dsniff:

  • free and open-source
  • works on Linux
  • can sniff network data, such as POP3 password: dsniff -i any 'tcp port pop3'

Sample output:

dsniff: listening on any [tcp port pop3]
-----------------
11/18/10 10:41:01 tcp xxx.48323 -> remote.host.110 (pop3)
USER user1
PASS pass-for-user1

-----------------
11/18/10 10:41:28 tcp xxx.48321 -> other.host.110 (pop3)
USER user2
PASS pass-for-user2
share|improve this answer

You can use SniffPass:

  • free but not open-source
  • works on Windows 98/ME/NT/2000/XP/2003/Vista/7
  • NirSoft quality
  • can capture the passwords of the following Protocols: POP3, IMAP4, SMTP, FTP, and HTTP (basic authentication passwords).

enter image description here

share|improve this answer
    
very good tool for someone who doesn't want to go too technical way –  miroxlav Apr 20 at 16:07
    
@miroxlav yes probably the easiest to use! –  Franck Dernoncourt Apr 20 at 16:12

I'd use ngrep. It's more or less tcpdump and grep rolled into one tool. You can use the same match conditions (verbatim) as in Franck Dernoncourt's answer, but you don't have to pipe between tools, and having the regular expression match on a per-packet-content basis rather than per-line as in grep is nicer.

ngrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' port http or port ftp or port smtp or port imap or port pop3
share|improve this answer
    
features look very useful and as far I can see, it is also available for Windows. –  miroxlav Apr 20 at 13:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.