Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -161,3 +161,4 @@ pip-log.txt

# Mac crap
.DS_Store
dechap
8 changes: 8 additions & 0 deletions Makefile
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
CC=gcc
CFLAGS=-lcrypto

all:
$(CC) $(CFLAGS) dechap.c -o dechap

clean:
rm dechap
106 changes: 56 additions & 50 deletions README → README.md
Original file line number Diff line number Diff line change
@@ -1,50 +1,56 @@
dechap v0.4 Alpha
Written by Foeh Mannay, October 2013

PURPOSE
=======

dechap is a tool which attempts to recover login credentials from captured
PPPoE, RADIUS and L2TP CHAP authentications plus MD5 authenticated OSPF or BGP
traffic. It strips away any 802.1Q tags and / or MPLS labels which are present
to get to the good stuff and then runs a dictionary attack against any
authentications it finds.

Please see http://networkingbodges.blogspot.com/ for more information on the
theory behind this if you are interested.

INSTALLATION
============

Provided the OpenSSL dev libraries are installed it should be possible to simply
extract the source code, cd into the directory then run "make".

USAGE
=====

There are only two parameters and both are mandatory. You must specify your
capture file (original pcap format) with the -c flag and your word list with
the -w flag. Here's an example:

lab@lab:~/dechap$ ./dechap -w mywords.txt -c someauths.cap
Found password "tangerine" for user user1@testisp.com.
Unable to find a password for user user2@testisp.com.
Found password "password1" for user user3@testisp.com.
Found password "Africa" for user user4@testisp.com.
Found password "Frankenstein" for user user5@testisp.com.
Found password "s3cr3tk3y" for OSPF host 10.1.1.1 key 1.
Found password "t1nt3rn3t" for TCP from 10.0.0.2 to 10.0.0.1.
lab@lab:~/dechap$

CHANGE LOG
==========

v0.1a First working release, only works with PPPoE traffic.

v0.2a Added support for RADIUS and L2TP captures.
Fixed a bug in MPLS decap.

v0.3a Added support for MD5 authenticated OSPF.

v0.4a Added support for MD5 authenticated BGP.

# DECHAP

dechap is a tool which attempts to recover login credentials from captured
PPPoE, RADIUS and L2TP CHAP authentications plus MD5 authenticated OSPF or BGP
traffic. It strips away any 802.1Q tags and / or MPLS labels which are present
to get to the good stuff and then runs a dictionary attack against any
authentications it finds.

Please see http://networkingbodges.blogspot.com/ for more information on the
theory behind this if you are interested.


### INSTALLATION

Provided the OpenSSL dev libraries are installed it should be possible to simply
extract the source code, cd into the directory then run `make`.


### USAGE

There are only two parameters and both are mandatory. You must specify your
capture file (original pcap format) with the `-c` flag and your word list with
the `-w` flag. Here's an example:

```
lab@lab:~/dechap$ ./dechap -w mywords.txt -c someauths.cap
Found password "tangerine" for user user1@testisp.com.
Unable to find a password for user user2@testisp.com.
Found password "password1" for user user3@testisp.com.
Found password "Africa" for user user4@testisp.com.
Found password "Frankenstein" for user user5@testisp.com.
Found password "s3cr3tk3y" for OSPF host 10.1.1.1 key 1.
Found password "t1nt3rn3t" for TCP from 10.0.0.2 to 10.0.0.1.
lab@lab:~/dechap$
```


### CHANGE LOG

- v0.1a: First working release, only works with PPPoE traffic.

- v0.2a: Added support for RADIUS and L2TP captures.
Fixed a bug in MPLS decap.

- v0.3a: Added support for MD5 authenticated OSPF.

- v0.4a: Added support for MD5 authenticated BGP.

- v0.5a: Fixed Makefile.


### Credits

dechap v0.1 to v0.4 Alpha - Written by Foeh Mannay, October 2013
dechap v0.5 Alpha - Written by libcrack, April 2016

Binary file removed dechap-0.1a.tar.gz
Binary file not shown.
Binary file removed dechap-0.2a.tar.gz
Binary file not shown.
Binary file removed dechap-0.3a.tar.gz
Binary file not shown.
Binary file removed dechap-0.4a.tar.gz
Binary file not shown.
Loading