Wall of Sheep - a password sniffing tool

The Wall of Sheep is dedicated to network security research and we make use of a powerful API provided by RethinkDB, Firebase to store and sync data in realtime.

Without SSL/TLS, your password is just like streaking. Therefore, we recommend that service provider in the list should secure their websites with HTTPS.

You can check out the demo page. The circle symbolizes that the status of sniffer program. Green is online, otherwise offline.

We built sniffer in two languages Python and Node.js. The Node.js version support on OSX and Linux. Unfortunately, The Python version only support on Linux.

New implementation in Node.js

[April 18, 2015 Updated] Add Node.js sniffer implementation. Now OSX user can play with it. 😆

We believe that using JavaScript is more efficient. Please refer to Why capture packets in JavaScript?

In simple terms

Event-based.

Handling binary data is fast and efficient.

Good HTTP parser.

Installation

Here is installation method.

Using brew install Node.js, npm and rethinkdb (option).

$ brew update

$ brew install node

$ brew install npm

$ brew install rethinkdb

Clone the repo and change directory to nodejs folder.

$ git clone git@github.com:John-Lin/wallofsheep.git

Packet capturing depends on mranney/node_pcap and save data to RethinkDB using neumino/thinky (option) you can use npm to get these packages.

$ npm install

That's it.

Basic usage

Two ways to use

Not saving the credentials. Start the sniffer with sudo

john at JohnsMacBook-Air in ~/Repository/wallofsheep/nodejs (master●●)

$ sudo node sniffer.js -i en0

[-] Loading RethinkDB module.

  _       _____    __    __       ____  ______   _____ __  __________________

| |     / /   |  / /   / /      / __ \/ ____/  / ___// / / / ____/ ____/ __ \

| | /| / / /| | / /   / /      / / / / /_      \__ \/ /_/ / __/ / __/ / /_/ /

| |/ |/ / ___ |/ /___/ /___   / /_/ / __/     ___/ / __  / /___/ /___/ ____/

|__/|__/_/  |_/_____/_____/   \____/_/       /____/_/ /_/_____/_____/_/

[*] Using interface: en0

[192.168.0.16:61881 -> 140.***.**.***:80] Account: hello@gmail.com

[192.168.0.16:61881 -> 140.***.**.***:80] Password: thisispassword

Saving credentials in RethinkDB need -s option.

First, start the RethinkDB server like this:

$ rethinkdb

info: Creating directory 'rethinkdb_data'

info: Listening for intracluster connections on port 29015

info: Listening for client driver connections on port 28015

info: Listening for administrative HTTP connections on port 8080

info: Server ready

Second, open a new terminal and start the sniffer with sudo

john at JohnsMacBook-Air in ~/Repository/wallofsheep/nodejs (master●●)

$ sudo node sniffer.js -i en0 -s

[-] Loading RethinkDB module.

  _       _____    __    __       ____  ______   _____ __  __________________

| |     / /   |  / /   / /      / __ \/ ____/  / ___// / / / ____/ ____/ __ \

| | /| / / /| | / /   / /      / / / / /_      \__ \/ /_/ / __/ / __/ / /_/ /

| |/ |/ / ___ |/ /___/ /___   / /_/ / __/     ___/ / __  / /___/ /___/ ____/

|__/|__/_/  |_/_____/_____/   \____/_/       /____/_/ /_/_____/_____/_/

[*] Using interface: en0

[192.168.0.16:61881 -> 140.***.**.***:80] Account: hello@gmail.com

[192.168.0.16:61881 -> 140.***.**.***:80] Password: thisispassword

How to Run Web

Deploy firebase web

First, Install firebase toolkits.

╭─~/Coding/Projects/web/wallofsheep/firebase_app on master✔ using

╰─± npm install -g firebase-tools

Find out the following code snippet in firebase_app/index.html and change to your own firebase's project id and create both pwd_table & status table in the Firebase management panel.

var myDataRef = new Firebase('https://<your-project-id>.firebaseio.com/pwd_table'),

    statusRef = new Firebase('https://<your-project-id>.firebaseio.com/status'),

Last, just do

╭─~/Coding/Projects/web/wallofsheep/firebase_app on master✔ using

╰─± firebase deploy

After a moment, you can find your site on https://your-project-id.firebaseapp.com

Running web implemented in express

Just change directory to express_app, do the following command, do not forget to run rethinkdb and sniffer.js metioned above.

╭─~/Coding/Projects/web/wallofsheep/express_app on master✔ using

╰─± npm install & npm start

Now, You can wait for the comming sheep 😄

Work in progress

 Support RethinkDB provided push/sync data in realtime.

 Parsing user/password in IMAP protocol.

 Parsing user/password in POP3 protocol.

 A new Web interface for showing off rely on RethinkDB.

 Any protocol not encrypted (e.g., telnet, irc etc.)

GITHUB PROJECT