Download

38 Chapter 2 • Botnets OverviewAt the time of this writing, Cain included the capabilities to sniff all traffic from thesubnet outbound, intercept and decrypt (through the MITM attack) SSH-1, HTTPS, RDP,and others, as well as searching for and cracking passwords in caches and files on the hostcomputer. See the following sidebar for a list of the output files collected by the hacker toolCain and ABEL. What’s that? You don’t run SSH-1? That’s okay, Cain will negotiate withyour clients to get them to switch to SSH-1.The CERT.lst file contains copies of fake CertsCain creates on the fly when a workstation tries to go to a Web site that uses Certificates.The VOIP file is interesting in that it contains the names of .wav files containing actual conversationsit recorded. For a detailed description of cracking password files with Cain, seehttp://www.rainbowtables.net/tutorials/cryptanalisys.php. Rainbowtables.net is a Web sitethat sells additional rainbow tables for use with Cain. Rainbow tables are tables of alreadycracked hashes. According to the Rainbowtables.net Web site, using their tables and otherson the Internet “it is possible to crack almost any password under 15 characters using amixed alphanumeric combination with symbols for LM, NTLM, PIX Firewall, MD4, andMD5.”Their market spiel says,“hackers have them and so should you.”Are You Owned?Cain Collection FilesCain uses the following collection files:■■■■■■■■■■■■■■80211.LSTAPOP-MD5.LSTAPR.LSTCACHE.LSTCCDU.LSTCERT.LSTCRAM-MD5.LSTDICT.LSTDRR.LSTFTP.LSTHOSTS.LSTHTTP.LSTHTTPS.LSTHTTP_PASS_FIELDS.LSTContinued