Sniffpass will alert on cleartext passwords discovered in HTTP POST requests.
By default it will not log passwords, but only log the username in a post_username
field in http.log
and create an entry in notice.log
that a password was observed.
- Install via Zeek package manager:
$ zkg install zeek-sniffpass # or for legacy installs $ bro-pkg install zeek-sniffpass
- Download the files to
$PREFIX/bro/share/bro/site/sniffpass
and add the following to yourlocal.bro
:@load ./sniffpass
-
You can enable different types of password logging. Add one (or more) of the following options to your
local.bro
file:redef SNIFFPASS::log_password_plaintext = T; redef SNIFFPASS::log_password_md5 = T; redef SNIFFPASS::log_password_sha1 = T; redef SNIFFPASS::log_password_sha256 = T;
-
You can disable logging to notice.log using this flag:
redef SNIFFPASS::notice_log_enable = F;
-
By default, only the first 300 bytes of an HTTP POST request are parsed. This can be changed by adding the following to your
local.bro
file and setting your own value:redef SNIFFPASS::post_body_limit = 300
Zeek can use Broker to publish discovered username and passwords. Each Zeek worker will connect to the broker_host
. This can be useful in cases where credentials shouldn't be
saved to disk in a Zeek log file, but instead have them handled by a script. One use case of this is sending them to an API to retire valid credentials seen.
- Broker publishing is disabled by default, but can be enabled using these options:
redef SNIFFPASS::broker_enable = T; redef SNIFFPASS::broker_host = "127.0.0.1"; redef SNIFFPASS::broker_port = 9999/tcp;
- You can change the topic to something other than the default:
redef SNIFFPASS::broker_topic = "/sniffpass/credentials_seen";
This example was borrowed from the Broker documentation
import broker
import sys
# Setup endpoint and connect to Zeek.
ep = broker.Endpoint()
sub = ep.make_subscriber("/sniffpass/credentials_seen")
ss = ep.make_status_subscriber(True);
# Listen for connections from workers
ep.listen("127.0.0.1", 9999)
# Wait until connection is established.
st = ss.get()
if not (type(st) == broker.Status and st.code() == broker.SC.PeerAdded):
print("could not connect")
sys.exit(0)
while True:
(t, d) = sub.get()
event = broker.zeek.Event(d)
print("received {}{}".format(event.name(), event.args()))
Will give output like this when plaintext credentials are seen:
$ python test_broker.py
received SNIFFPASS::credentials_seen[u'my_username', u'Thi1sI$myP@ssw0rd']
There is an option to also include Destination IP, Destination Port, and full URL in the Broker output.
You can enable a more detailed output in Broker:
redef SNIFFPASS::broker_detailed = T;
The output from the Example Python Script:
$ python test_broker.py
received SNIFFPASS::credentials_seen_detailed[(u'my_username', u'Thi1sI$myP@ssw)rd'), IPv4Address(u'127.0.0.1'), 80/tcp, u'localhost/']
Automated tests are done against the http_post.trace
file with Travis CI.
-
If you are having any issues, ensure that you have TCP Checksumming disabled in your
local.bro
file, as per Zeek Documentationredef ignore_checksums = T;
Andrew Klaus (Cybera)
This module was inspired by the University of Alberta's 2019 CUCCIO Innovation Award Plaintext Password Sniffing Project.