Software Recommendations Stack Exchange is a question and answer site for people seeking specific software recommendations. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What tool you can recommend to reveal credentials transferred in unencrypted connection to POP3 server?

  • I would prefer free and possibly open-source solutions.
  • Platforms are Linux and/or Windows.
share|improve this question
up vote 4 down vote accepted

You can use tcpdump:

  • free and open-source
  • works on Linux
  • can sniff network data, such as POP3 passwords:

Code snippet to get POP3 passwords and a bit more:

tcpdump port http or port ftp or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20`
share|improve this answer
1  
I'm awarding this answer because of open character of packet capturing. There is also command-line compatible WinPCap equivalent of the tool for Windows users. – miroxlav Apr 20 '14 at 11:08

You can use Wireshark:

  • free and open-source
  • works on Windows/Linux/Mac
  • can capture all network data. Just filter what you need:

enter image description here

share|improve this answer

You can use dsniff:

  • free and open-source
  • works on Linux
  • can sniff network data, such as POP3 password: dsniff -i any 'tcp port pop3'

Sample output:

dsniff: listening on any [tcp port pop3]
-----------------
11/18/10 10:41:01 tcp xxx.48323 -> remote.host.110 (pop3)
USER user1
PASS pass-for-user1

-----------------
11/18/10 10:41:28 tcp xxx.48321 -> other.host.110 (pop3)
USER user2
PASS pass-for-user2
share|improve this answer

I'd use ngrep. It's more or less tcpdump and grep rolled into one tool. You can use the same match conditions (verbatim) as in Franck Dernoncourt's answer, but you don't have to pipe between tools, and having the regular expression match on a per-packet-content basis rather than per-line as in grep is nicer.

ngrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' port http or port ftp or port smtp or port imap or port pop3
share|improve this answer
    
features look very useful and as far I can see, it is also available for Windows. – miroxlav Apr 20 '14 at 13:47

You can use SniffPass:

  • free but not open-source
  • works on Windows 98/ME/NT/2000/XP/2003/Vista/7
  • NirSoft quality
  • can capture the passwords of the following Protocols: POP3, IMAP4, SMTP, FTP, and HTTP (basic authentication passwords).

enter image description here

share|improve this answer
    
very good tool for someone who doesn't want to go too technical way – miroxlav Apr 20 '14 at 16:07
    
@miroxlav yes probably the easiest to use! – Franck Dernoncourt Apr 20 '14 at 16:12

Just one more note with this.

Normal USER/PASS is sent in clear text so you can see it in packet captures, but POP3 has an extension mechanism and a number of alternative authentication mechanisms, which may or may not be visible.

SASL LOGIN, for example is clear text but Base64 encoded, so you could retrieve the passwords with a Base64 decoder.

However, it's also common to use hash-based authentication such as CRAM-MD5, APOP, or NTLM, or even GSSAPI (Kerberos).

Most modern POP3 clients support secure authentication, and so do many mail servers. So your luck with a packet capturing approach may vary.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.