Network Sniffing: Cain vs APR

TL;DR

Cain & Abel and APR (Afterburner/Wireshark) are both tools for network analysis, but they work differently. Cain focuses on password recovery from various protocols, while APR is better for capturing and analysing raw packet data. This guide explains how to use each tool effectively.

Using Cain & Abel

1. Download and Install: Get Cain & Abel from a reputable source (be careful of malware!). Run the installer.
2. Select Network Interface: Launch Cain. Choose the network adapter you want to monitor. This is usually your Ethernet or Wi-Fi card.
3. ARP Cache Poisoning: Cain automatically attempts ARP cache poisoning to redirect traffic through its interface. This is how it intercepts data. Be aware this can be disruptive and may violate network policies.
4. Password Recovery: Cain supports several protocols:
   • Microsoft NTLM/LM Hash: Captures hashes from Windows authentication.
   • FTP: Sniffs usernames and passwords for FTP connections (unencrypted).
   • SMTP: Sniffs credentials for email logins (again, unencrypted).
   • POP3: Similar to SMTP.
5. Save Captured Data: Cain can save captured passwords in various formats (e.g., text file, CSV).

Using APR (Afterburner/Wireshark)

1. Download and Install: Download Wireshark from wireshark.org. Afterburner is often used as a GUI front-end for tshark, the command line version of Wireshark.
2. Select Network Interface: Launch Wireshark (or Afterburner). Choose the network interface to capture from.
3. Start Capture: Click the shark fin icon or go to Capture > Options and select your interface.
4. Apply Filters (Important): Use filters to narrow down captured traffic. For example:
   • tcp port 80: Captures HTTP traffic.
   • ip.addr == 192.168.1.100: Captures traffic to/from a specific IP address.
   • http.request.method == "POST": Captures only POST requests.
5. Stop Capture: Click the red square icon when you’ve captured enough data.
6. Analyse Packets: Wireshark displays packets in a hierarchical format.
   • Examine packet details (source/destination IP, ports, protocol).
   • Follow TCP streams to reconstruct conversations. (Right-click on a packet > Follow > TCP Stream)
7. Save Capture: Save the capture file (.pcapng) for later analysis.

   tshark -i eth0 -w mycapture.pcapng

Cain vs APR – Key Differences

• Focus: Cain is primarily a password recovery tool; APR is for general network analysis.
• Protocol Support: Cain focuses on specific authentication protocols; APR supports all protocols.
• Packet Level Access: APR provides full packet-level access, allowing detailed inspection of network traffic. Cain abstracts this away.
• Complexity: Cain is easier to use for basic password recovery; APR requires more technical knowledge.
• Legality/Ethics: Both tools can be misused. Always obtain permission before capturing network traffic. ARP poisoning with Cain is particularly intrusive.

cyber security Considerations

Using these tools without authorization is illegal and unethical. Ensure you have explicit permission to monitor any network. Modern networks often use encryption (HTTPS, TLS) which makes sniffing passwords directly much harder. Focus on securing your own systems rather than attempting to compromise others.