What tool you can recommend to reveal credentials transferred in unencrypted connection to POP3 server?
- I would prefer free and possibly open-source solutions.
- Platforms are Linux and/or Windows.
You can use tcpdump:
Code snippet to get POP3 passwords and a bit more:
tcpdump port http or port ftp or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20`
You can use Wireshark:
You can use dsniff:
dsniff -i any 'tcp port pop3'
dsniff: listening on any [tcp port pop3] ----------------- 11/18/10 10:41:01 tcp xxx.48323 -> remote.host.110 (pop3) USER user1 PASS pass-for-user1 ----------------- 11/18/10 10:41:28 tcp xxx.48321 -> other.host.110 (pop3) USER user2 PASS pass-for-user2
I'd use ngrep. It's more or less tcpdump and grep rolled into one tool. You can use the same match conditions (verbatim) as in Franck Dernoncourt's answer, but you don't have to pipe between tools, and having the regular expression match on a per-packet-content basis rather than per-line as in grep is nicer.
ngrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' port http or port ftp or port smtp or port imap or port pop3
You can use SniffPass:
Just one more note with this.
Normal USER/PASS is sent in clear text so you can see it in packet captures, but POP3 has an extension mechanism and a number of alternative authentication mechanisms, which may or may not be visible.
SASL LOGIN, for example is clear text but Base64 encoded, so you could retrieve the passwords with a Base64 decoder.
However, it's also common to use hash-based authentication such as CRAM-MD5, APOP, or NTLM, or even GSSAPI (Kerberos).
Most modern POP3 clients support secure authentication, and so do many mail servers. So your luck with a packet capturing approach may vary.