NetworkSniffing.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Network Sniffing\n",
    "- sniffing packets in unswitched network is fairly easy as packets are usually broadcasted to all the hosts in the network\n",
    "- hub is a network device that broadcasts all the packets e.g. and simply running the interface card in promiscuous mode would collect all the data that was broadcasted\n",
    "- sniffing packets in switched network is a bit challange\n",
    "- if systems are behind router or network switch they're using swtiched network\n",
    "    - packets are redirected to destination based on their MAC address"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500\r\n",
      "        inet 192.168.195.161  netmask 255.255.255.0  broadcast 192.168.195.255\r\n",
      "        inet6 fe80::20c:29ff:fe17:1a37  prefixlen 64  scopeid 0x20<link>\r\n",
      "        ether 00:0c:29:17:1a:37  txqueuelen 1000  (Ethernet)\r\n",
      "        RX packets 572645  bytes 714907354 (681.7 MiB)\r\n",
      "        RX errors 0  dropped 0  overruns 0  frame 0\r\n",
      "        TX packets 249855  bytes 19674060 (18.7 MiB)\r\n",
      "        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\r\n",
      "\r\n",
      "lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536\r\n",
      "        inet 127.0.0.1  netmask 255.0.0.0\r\n",
      "        inet6 ::1  prefixlen 128  scopeid 0x10<host>\r\n",
      "        loop  txqueuelen 1000  (Local Loopback)\r\n",
      "        RX packets 374981  bytes 138144709 (131.7 MiB)\r\n",
      "        RX errors 0  dropped 0  overruns 0  frame 0\r\n",
      "        TX packets 374981  bytes 138144709 (131.7 MiB)\r\n",
      "        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\r\n",
      "\r\n"
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S ifconfig"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "#ifconfig <interfaceCard> promisc on\n",
    "! echo kali | sudo -S ifconfig eth0 promisc"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "# trun off promisc mode\n",
    "! echo kali | sudo -S ifconfig eth0 -promisc"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: eth0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST>  mtu 1500\r\n",
      "        inet 192.168.195.161  netmask 255.255.255.0  broadcast 192.168.195.255\r\n",
      "        inet6 fe80::20c:29ff:fe17:1a37  prefixlen 64  scopeid 0x20<link>\r\n",
      "        ether 00:0c:29:17:1a:37  txqueuelen 1000  (Ethernet)\r\n",
      "        RX packets 572645  bytes 714907354 (681.7 MiB)\r\n",
      "        RX errors 0  dropped 0  overruns 0  frame 0\r\n",
      "        TX packets 249855  bytes 19674060 (18.7 MiB)\r\n",
      "        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\r\n",
      "\r\n"
     ]
    }
   ],
   "source": [
    "#ifconfig <interfaceCard>\n",
    "! echo kali | sudo -S ifconfig eth0"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Install vsftpd server or use metaploitable2 linux\n",
    "\n",
    "- install ftpd server for demo - remember FTP is not encrypted; typically use OpenSSH\n",
    "- detail instruction: http://itsfoss.com/set-ftp-server-linux\n",
    "\n",
    "## metaploitable2 linux\n",
    "- run the VM\n",
    "- find its IP address\n",
    "- double check if port 21 ftp server is running\n",
    "\n",
    "```bash\n",
    "$ sudo lsof -i:21\n",
    "```\n",
    "\n",
    "- login using msfadmin:msfadmin account from another VM\n",
    "\n",
    "- install ftp client if needed on another VM"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Reading package lists... Done\n",
      "Building dependency tree... Done\n",
      "Reading state information... Done\n",
      "The following packages were automatically installed and are no longer required:\n",
      "  libomp-9-dev libomp5-9 linux-image-5.9.0-kali4-amd64 python3-plotly\n",
      "Use 'sudo apt autoremove' to remove them.\n",
      "The following NEW packages will be installed:\n",
      "  vsftpd\n",
      "0 upgraded, 1 newly installed, 0 to remove and 535 not upgraded.\n",
      "Need to get 155 kB of archives.\n",
      "After this operation, 361 kB of additional disk space will be used.\n",
      "Get:1 http://kali.download/kali kali-rolling/main amd64 vsftpd amd64 3.0.3-13 [155 kB]\n",
      "Fetched 155 kB in 1s (204 kB/s)\u001b[0m\u001b[33m\n",
      "Preconfiguring packages ...\n",
      "\n",
      "\u001b7\u001b[0;23r\u001b8\u001b[1ASelecting previously unselected package vsftpd.\n",
      "(Reading database ... 314172 files and directories currently installed.)\n",
      "Preparing to unpack .../vsftpd_3.0.3-13_amd64.deb ...\n",
      "\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [  0%]\u001b[49m\u001b[39m [..........................................................] \u001b8\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [ 20%]\u001b[49m\u001b[39m [###########...............................................] \u001b8Unpacking vsftpd (3.0.3-13) ...\n",
      "\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [ 40%]\u001b[49m\u001b[39m [#######################...................................] \u001b8Setting up vsftpd (3.0.3-13) ...\n",
      "\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [ 60%]\u001b[49m\u001b[39m [##################################........................] \u001b8update-rc.d: We have no instructions for the vsftpd init script.\n",
      "update-rc.d: It looks like a network service, we disable it.\n",
      "\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [ 80%]\u001b[49m\u001b[39m [##############################################............] \u001b8Processing triggers for man-db (2.9.4-2) ...\n",
      "Processing triggers for kali-menu (2021.2.3) ...\n",
      "\n",
      "\u001b7\u001b[0;24r\u001b8\u001b[1A\u001b[J"
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S apt install vsftpd -y"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "VSFTPD.CONF(5)                File Formats Manual               VSFTPD.CONF(5)\r\n",
      "\r\n",
      "N\bNA\bAM\bME\bE\r\n",
      "       vsftpd.conf - config file for vsftpd\r\n",
      "\r\n",
      "D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN\r\n",
      "       vsftpd.conf  may  be used to control various aspects of vsftpd's behav‐\r\n",
      "       iour. By default, vsftpd looks for this file at the  location  /\b/e\bet\btc\bc/\b/v\bvs\bs‐\b‐\r\n",
      "       f\bft\btp\bpd\bd.\b.c\bco\bon\bnf\bf.  However, you may override this by specifying a command line\r\n",
      "       argument to vsftpd. The command line argument is the  pathname  of  the\r\n",
      "       configuration file for vsftpd. This behaviour is useful because you may\r\n",
      "       wish to use an advanced inetd such as x\bxi\bin\bne\bet\btd\bd to launch vsftpd with dif‐\r\n",
      "       ferent configuration files on a per virtual host basis.\r\n",
      "\r\n",
      "F\bFO\bOR\bRM\bMA\bAT\bT\r\n",
      "       The format of vsftpd.conf is very simple. Each line is either a comment\r\n",
      "       or a directive. Comment lines start with a # and are ignored. A  direc‐\r\n",
      "       tive line has the format:\r\n",
      "\r\n",
      "       option=value\r\n",
      "\r\n",
      "       It  is  important  to note that it is an error to put any space between\r\n",
      "       the option, = and value.\r\n",
      "\r\n",
      "       Each setting has a compiled in default which may  be  modified  in  the\r\n",
      "       configuration file.\r\n",
      "\r\n",
      "B\bBO\bOO\bOL\bLE\bEA\bAN\bN O\bOP\bPT\bTI\bIO\bON\bNS\bS\r\n",
      "       Below  is a list of boolean options. The value for a boolean option may\r\n",
      "       be set to Y\bYE\bES\bS or N\bNO\bO.\r\n",
      "\r\n",
      "       a\bal\bll\blo\bow\bw_\b_a\ban\bno\bon\bn_\b_s\bss\bsl\bl\r\n",
      "              Only applies if s\bss\bsl\bl_\b_e\ben\bna\bab\bbl\ble\be is active. If set to  YES,  anonymous\r\n",
      "              users will be allowed to use secured SSL connections.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       a\ban\bno\bon\bn_\b_m\bmk\bkd\bdi\bir\br_\b_w\bwr\bri\bit\bte\be_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If  set  to YES, anonymous users will be permitted to create new\r\n",
      "              directories under certain conditions. For this to work, the  op‐\r\n",
      "              tion  w\bwr\bri\bit\bte\be_\b_e\ben\bna\bab\bbl\ble\be must be activated, and the anonymous ftp user\r\n",
      "              must have write permission on the parent directory.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       a\ban\bno\bon\bn_\b_o\bot\bth\bhe\ber\br_\b_w\bwr\bri\bit\bte\be_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If set to YES, anonymous users  will  be  permitted  to  perform\r\n",
      "              write operations other than upload and create directory, such as\r\n",
      "              deletion and renaming. This is generally not recommended but in‐\r\n",
      "              cluded for completeness.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       a\ban\bno\bon\bn_\b_u\bup\bpl\blo\boa\bad\bd_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If set to YES, anonymous users will be permitted to upload files\r\n",
      "              under certain conditions. For this to work, the option w\bwr\bri\bit\bte\be_\b_e\ben\bn‐\b‐\r\n",
      "              a\bab\bbl\ble\be  must  be  activated,  and the anonymous ftp user must have\r\n",
      "              write permission on desired upload locations.  This  setting  is\r\n",
      "              also  required  for virtual users to upload; by default, virtual\r\n",
      "              users are treated with  anonymous  (i.e.  maximally  restricted)\r\n",
      "              privilege.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       a\ban\bno\bon\bn_\b_w\bwo\bor\brl\bld\bd_\b_r\bre\bea\bad\bda\bab\bbl\ble\be_\b_o\bon\bnl\bly\by\r\n",
      "              When  enabled,  anonymous users will only be allowed to download\r\n",
      "              files which are world readable. This is recognising that the ftp\r\n",
      "              user may own files, especially in the presence of uploads.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       a\ban\bno\bon\bny\bym\bmo\bou\bus\bs_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              Controls  whether  anonymous logins are permitted or not. If en‐\r\n",
      "              abled, both the usernames f\bft\btp\bp and a\ban\bno\bon\bny\bym\bmo\bou\bus\bs  are  recognised  as\r\n",
      "              anonymous logins.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       a\bas\bsc\bci\bii\bi_\b_d\bdo\bow\bwn\bnl\blo\boa\bad\bd_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              When  enabled,  ASCII  mode  data  transfers will be honoured on\r\n",
      "              downloads.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       a\bas\bsc\bci\bii\bi_\b_u\bup\bpl\blo\boa\bad\bd_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              When enabled, ASCII mode data transfers will be honoured on  up‐\r\n",
      "              loads.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       a\bas\bsy\byn\bnc\bc_\b_a\bab\bbo\bor\br_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              When  enabled,  a special FTP command known as \"async ABOR\" will\r\n",
      "              be enabled.  Only ill advised FTP clients will use this feature.\r\n",
      "              Additionally,  this  feature is awkward to handle, so it is dis‐\r\n",
      "              abled by default. Unfortunately, some FTP clients will hang when\r\n",
      "              cancelling  a  transfer unless this feature is available, so you\r\n",
      "              may wish to enable it.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       b\bba\bac\bck\bkg\bgr\bro\bou\bun\bnd\bd\r\n",
      "              When enabled, and vsftpd is started  in  \"listen\"  mode,  vsftpd\r\n",
      "              will  background the listener process. i.e. control will immedi‐\r\n",
      "              ately be returned to the shell which launched vsftpd.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       c\bch\bhe\bec\bck\bk_\b_s\bsh\bhe\bel\bll\bl\r\n",
      "              Note! This option only has an effect for non-PAM builds  of  vs‐\r\n",
      "              ftpd. If disabled, vsftpd will not check /etc/shells for a valid\r\n",
      "              user shell for local logins.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       c\bch\bhm\bmo\bod\bd_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              When enabled, allows use of the SITE CHMOD command.  NOTE!  This\r\n",
      "              only  applies  to  local users. Anonymous users never get to use\r\n",
      "              SITE CHMOD.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       c\bch\bho\bow\bwn\bn_\b_u\bup\bpl\blo\boa\bad\bds\bs\r\n",
      "              If enabled, all anonymously uploaded files will have the  owner‐\r\n",
      "              ship  changed  to  the user specified in the setting c\bch\bho\bow\bwn\bn_\b_u\bus\bse\ber\br‐\b‐\r\n",
      "              n\bna\bam\bme\be.  This is useful from an administrative, and perhaps  secu‐\r\n",
      "              rity, standpoint.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       c\bch\bhr\bro\boo\bot\bt_\b_l\bli\bis\bst\bt_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If  activated,  you  may  provide  a list of local users who are\r\n",
      "              placed in a chroot() jail in their home  directory  upon  login.\r\n",
      "              The meaning is slightly different if chroot_local_user is set to\r\n",
      "              YES. In this case, the list becomes a list of  users  which  are\r\n",
      "              NOT  to be placed in a chroot() jail.  By default, the file con‐\r\n",
      "              taining this list is /etc/vsftpd.chroot_list, but you may  over‐\r\n",
      "              ride this with the c\bch\bhr\bro\boo\bot\bt_\b_l\bli\bis\bst\bt_\b_f\bfi\bil\ble\be setting.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       c\bch\bhr\bro\boo\bot\bt_\b_l\blo\boc\bca\bal\bl_\b_u\bus\bse\ber\br\r\n",
      "              If  set to YES, local users will be (by default) placed in a ch‐\r\n",
      "              root() jail in their home directory after login.  W\bWa\bar\brn\bni\bin\bng\bg:\b:  This\r\n",
      "              option  has  security implications, especially if the users have\r\n",
      "              upload permission, or shell access. Only enable if you know what\r\n",
      "              you  are  doing.   Note that these security implications are not\r\n",
      "              vsftpd specific. They apply to all FTP daemons  which  offer  to\r\n",
      "              put local users in chroot() jails.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       c\bco\bon\bnn\bne\bec\bct\bt_\b_f\bfr\bro\bom\bm_\b_p\bpo\bor\brt\bt_\b_2\b20\b0\r\n",
      "              This  controls  whether  PORT style data connections use port 20\r\n",
      "              (ftp-data) on the server machine.  For  security  reasons,  some\r\n",
      "              clients  may insist that this is the case. Conversely, disabling\r\n",
      "              this option enables vsftpd to run with slightly less privilege.\r\n",
      "\r\n",
      "              Default: NO (but the sample config file enables it)\r\n",
      "\r\n",
      "       d\bde\beb\bbu\bug\bg_\b_s\bss\bsl\bl\r\n",
      "              If true, OpenSSL connection diagnostics are dumped to the vsftpd\r\n",
      "              log file.  (Added in v2.0.6).\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       d\bde\bel\ble\bet\bte\be_\b_f\bfa\bai\bil\ble\bed\bd_\b_u\bup\bpl\blo\boa\bad\bds\bs\r\n",
      "              If  true,  any  failed  upload  files  are  deleted.   (Added in\r\n",
      "              v2.0.7).\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       d\bde\ben\bny\by_\b_e\bem\bma\bai\bil\bl_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If activated, you may provide a list of  anonymous  password  e-\r\n",
      "              mail  responses  which cause login to be denied. By default, the\r\n",
      "              file containing this list is /etc/vsftpd.banned_emails, but  you\r\n",
      "              may override this with the b\bba\ban\bnn\bne\bed\bd_\b_e\bem\bma\bai\bil\bl_\b_f\bfi\bil\ble\be setting.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       d\bdi\bir\brl\bli\bis\bst\bt_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If  set  to NO, all directory list commands will give permission\r\n",
      "              denied.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       d\bdi\bir\brm\bme\bes\bss\bsa\bag\bge\be_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If enabled, users of the FTP server can be shown  messages  when\r\n",
      "              they  first  enter  a  new directory. By default, a directory is\r\n",
      "              scanned for the file .message, but that may be  overridden  with\r\n",
      "              the configuration setting m\bme\bes\bss\bsa\bag\bge\be_\b_f\bfi\bil\ble\be.\r\n",
      "\r\n",
      "              Default: NO (but the sample config file enables it)\r\n",
      "\r\n",
      "       d\bdo\bow\bwn\bnl\blo\boa\bad\bd_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If set to NO, all download requests will give permission denied.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       d\bdu\bua\bal\bl_\b_l\blo\bog\bg_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If  enabled,  two  log files are generated in parallel, going by\r\n",
      "              default to /\b/v\bva\bar\br/\b/l\blo\bog\bg/\b/x\bxf\bfe\ber\brl\blo\bog\bg and /\b/v\bva\bar\br/\b/l\blo\bog\bg/\b/v\bvs\bsf\bft\btp\bpd\bd.\b.l\blo\bog\bg.  The former\r\n",
      "              is  a  wu-ftpd  style transfer log, parseable by standard tools.\r\n",
      "              The latter is vsftpd's own style log.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       f\bfo\bor\brc\bce\be_\b_d\bdo\bot\bt_\b_f\bfi\bil\ble\bes\bs\r\n",
      "              If activated, files and directories  starting  with  .  will  be\r\n",
      "              shown in directory listings even if the \"a\" flag was not used by\r\n",
      "              the client. This override excludes the \".\" and \"..\" entries.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       f\bfo\bor\brc\bce\be_\b_a\ban\bno\bon\bn_\b_d\bda\bat\bta\ba_\b_s\bss\bsl\bl\r\n",
      "              Only applies if  s\bss\bsl\bl_\b_e\ben\bna\bab\bbl\ble\be  is  activated.  If  activated,  all\r\n",
      "              anonymous  logins  are  forced to use a secure SSL connection in\r\n",
      "              order to send and receive data on data connections.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       f\bfo\bor\brc\bce\be_\b_a\ban\bno\bon\bn_\b_l\blo\bog\bgi\bin\bns\bs_\b_s\bss\bsl\bl\r\n",
      "              Only applies if  s\bss\bsl\bl_\b_e\ben\bna\bab\bbl\ble\be  is  activated.  If  activated,  all\r\n",
      "              anonymous  logins  are  forced to use a secure SSL connection in\r\n",
      "              order to send the password.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       f\bfo\bor\brc\bce\be_\b_l\blo\boc\bca\bal\bl_\b_d\bda\bat\bta\ba_\b_s\bss\bsl\bl\r\n",
      "              Only applies if s\bss\bsl\bl_\b_e\ben\bna\bab\bbl\ble\be is activated. If activated, all  non-\r\n",
      "              anonymous  logins  are  forced to use a secure SSL connection in\r\n",
      "              order to send and receive data on data connections.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       f\bfo\bor\brc\bce\be_\b_l\blo\boc\bca\bal\bl_\b_l\blo\bog\bgi\bin\bns\bs_\b_s\bss\bsl\bl\r\n",
      "              Only applies if s\bss\bsl\bl_\b_e\ben\bna\bab\bbl\ble\be is activated. If activated, all  non-\r\n",
      "              anonymous  logins  are  forced to use a secure SSL connection in\r\n",
      "              order to send the password.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       g\bgu\bue\bes\bst\bt_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If enabled, all non-anonymous logins are classed as \"guest\"  lo‐\r\n",
      "              gins.  A  guest  login  is remapped to the user specified in the\r\n",
      "              g\bgu\bue\bes\bst\bt_\b_u\bus\bse\ber\brn\bna\bam\bme\be setting.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       h\bhi\bid\bde\be_\b_i\bid\bds\bs\r\n",
      "              If enabled, all user and group information in directory listings\r\n",
      "              will be displayed as \"ftp\".\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       i\bim\bmp\bpl\bli\bic\bci\bit\bt_\b_s\bss\bsl\bl\r\n",
      "              If  enabled,  an  SSL handshake is the first thing expect on all\r\n",
      "              connections (the FTPS protocol). To support explicit SSL  and/or\r\n",
      "              plain  text  too,  a  separate vsftpd listener process should be\r\n",
      "              run.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       l\bli\bis\bst\bte\ben\bn If enabled, vsftpd will run in standalone mode. This means  that\r\n",
      "              vsftpd  must not be run from an inetd of some kind. Instead, the\r\n",
      "              vsftpd executable is run once directly. vsftpd itself will  then\r\n",
      "              take care of listening for and handling incoming connections.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       l\bli\bis\bst\bte\ben\bn_\b_i\bip\bpv\bv6\b6\r\n",
      "              Like  the listen parameter, except vsftpd will listen on an IPv6\r\n",
      "              socket instead of an IPv4 one. Note that a socket  listening  on\r\n",
      "              the  IPv6 \"any\" address (::) will accept both IPv6 and IPv4 con‐\r\n",
      "              nections by default. This parameter and the listen parameter are\r\n",
      "              mutually exclusive.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       l\blo\boc\bca\bal\bl_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              Controls  whether local logins are permitted or not. If enabled,\r\n",
      "              normal user accounts in /etc/passwd (or wherever your PAM config\r\n",
      "              references)  may  be used to log in. This must be enable for any\r\n",
      "              non-anonymous login to work, including virtual users.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       l\blo\boc\bck\bk_\b_u\bup\bpl\blo\boa\bad\bd_\b_f\bfi\bil\ble\bes\bs\r\n",
      "              When enabled, all uploads proceed with a write lock on  the  up‐\r\n",
      "              load  file. All downloads proceed with a shared read lock on the\r\n",
      "              download file. WARNING!  Before enabling this, be aware that ma‐\r\n",
      "              licious  readers  could starve a writer wanting to e.g. append a\r\n",
      "              file.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       l\blo\bog\bg_\b_f\bft\btp\bp_\b_p\bpr\bro\bot\bto\boc\bco\bol\bl\r\n",
      "              When enabled, all FTP requests and responses are logged, provid‐\r\n",
      "              ing the option xferlog_std_format is not enabled. Useful for de‐\r\n",
      "              bugging.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       l\bls\bs_\b_r\bre\bec\bcu\bur\brs\bse\be_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              When enabled, this setting will allow the use of \"ls  -R\".  This\r\n",
      "              is  a minor security risk, because a ls -R at the top level of a\r\n",
      "              large site may consume a lot of resources.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       m\bmd\bdt\btm\bm_\b_w\bwr\bri\bit\bte\be\r\n",
      "              When enabled, this setting will allow MDTM to set file modifica‐\r\n",
      "              tion times (subject to the usual access checks).\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       n\bno\bo_\b_a\ban\bno\bon\bn_\b_p\bpa\bas\bss\bsw\bwo\bor\brd\bd\r\n",
      "              When  enabled, this prevents vsftpd from asking for an anonymous\r\n",
      "              password - the anonymous user will log straight in.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       n\bno\bo_\b_l\blo\bog\bg_\b_l\blo\boc\bck\bk\r\n",
      "              When enabled, this prevents vsftpd from taking a file lock  when\r\n",
      "              writing  to  log  files. This option should generally not be en‐\r\n",
      "              abled. It exists to workaround operating system bugs such as the\r\n",
      "              Solaris / Veritas filesystem combination which has been observed\r\n",
      "              to sometimes exhibit hangs trying to lock log files.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       o\bon\bne\be_\b_p\bpr\bro\boc\bce\bes\bss\bs_\b_m\bmo\bod\bde\bel\bl\r\n",
      "              If you have a Linux 2.4 kernel, it is possible to use a  differ‐\r\n",
      "              ent  security  model which only uses one process per connection.\r\n",
      "              It is a less pure security model, but gains you performance. You\r\n",
      "              really  don't  want  to enable this unless you know what you are\r\n",
      "              doing, and your site supports  huge  numbers  of  simultaneously\r\n",
      "              connected users.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       p\bpa\bas\bss\bsw\bwd\bd_\b_c\bch\bhr\bro\boo\bot\bt_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If  enabled, along with c\bch\bhr\bro\boo\bot\bt_\b_l\blo\boc\bca\bal\bl_\b_u\bus\bse\ber\br , then a chroot() jail\r\n",
      "              location may be specified on a per-user basis. Each user's  jail\r\n",
      "              is  derived from their home directory string in /etc/passwd. The\r\n",
      "              occurrence of /./ in the home directory string denotes that  the\r\n",
      "              jail is at that particular location in the path.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       p\bpa\bas\bsv\bv_\b_a\bad\bdd\bdr\br_\b_r\bre\bes\bso\bol\blv\bve\be\r\n",
      "              Set  to  YES if you want to use a hostname (as opposed to IP ad‐\r\n",
      "              dress) in the p\bpa\bas\bsv\bv_\b_a\bad\bdd\bdr\bre\bes\bss\bs option.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       p\bpa\bas\bsv\bv_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              Set to NO if you want to disallow the PASV method of obtaining a\r\n",
      "              data connection.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       p\bpa\bas\bsv\bv_\b_p\bpr\bro\bom\bmi\bis\bsc\bcu\buo\bou\bus\bs\r\n",
      "              Set  to  YES if you want to disable the PASV security check that\r\n",
      "              ensures the data connection originates from the same IP  address\r\n",
      "              as the control connection.  Only enable if you know what you are\r\n",
      "              doing! The only legitimate use for this is in some form  of  se‐\r\n",
      "              cure tunnelling scheme, or perhaps to facilitate FXP support.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       p\bpo\bor\brt\bt_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              Set to NO if you want to disallow the PORT method of obtaining a\r\n",
      "              data connection.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       p\bpo\bor\brt\bt_\b_p\bpr\bro\bom\bmi\bis\bsc\bcu\buo\bou\bus\bs\r\n",
      "              Set to YES if you want to disable the PORT security  check  that\r\n",
      "              ensures  that  outgoing data connections can only connect to the\r\n",
      "              client. Only enable if you know what you are doing!\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       r\bre\beq\bqu\bui\bir\bre\be_\b_c\bce\ber\brt\bt\r\n",
      "              If set to yes,  all  SSL  client  connections  are  required  to\r\n",
      "              present  a  client certificate. The degree of validation applied\r\n",
      "              to this certificate is controlled  by  v\bva\bal\bli\bid\bda\bat\bte\be_\b_c\bce\ber\brt\bt  (Added  in\r\n",
      "              v2.0.6).\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       r\bre\beq\bqu\bui\bir\bre\be_\b_s\bss\bsl\bl_\b_r\bre\beu\bus\bse\be\r\n",
      "              If  set to yes, all SSL data connections are required to exhibit\r\n",
      "              SSL session reuse (which proves that they know the  same  master\r\n",
      "              secret  as  the  control channel). Although this is a secure de‐\r\n",
      "              fault, it may break many FTP clients, so you may want to disable\r\n",
      "              it. For a discussion of the consequences, see http://scarybeast‐\r\n",
      "              security.blogspot.com/2009/02/vsftpd-210-released.html\r\n",
      "               (Added in v2.1.0).\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       r\bru\bun\bn_\b_a\bas\bs_\b_l\bla\bau\bun\bnc\bch\bhi\bin\bng\bg_\b_u\bus\bse\ber\br\r\n",
      "              Set to YES if you want vsftpd to run as the user which  launched\r\n",
      "              vsftpd.  This is useful where root access is not available. MAS‐\r\n",
      "              SIVE WARNING! Do NOT enable this option unless you totally  know\r\n",
      "              what  you are doing, as naive use of this option can create mas‐\r\n",
      "              sive security problems. Specifically, vsftpd does not  /  cannot\r\n",
      "              use  chroot  technology to restrict file access when this option\r\n",
      "              is set (even if launched by root). A poor substitute could be to\r\n",
      "              use  a  d\bde\ben\bny\by_\b_f\bfi\bil\ble\be setting such as {/*,*..*}, but the reliability\r\n",
      "              of this cannot compare to chroot, and should not be  relied  on.\r\n",
      "              If  using this option, many restrictions on other options apply.\r\n",
      "              For example, options requiring privilege such  as  non-anonymous\r\n",
      "              logins,  upload  ownership changing, connecting from port 20 and\r\n",
      "              listen ports less than 1024 are not expected to work. Other  op‐\r\n",
      "              tions may be impacted.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       s\bse\bec\bcu\bur\bre\be_\b_e\bem\bma\bai\bil\bl_\b_l\bli\bis\bst\bt_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              Set to YES if you want only a specified list of e-mail passwords\r\n",
      "              for anonymous logins to be accepted. This is useful  as  a  low-\r\n",
      "              hassle way of restricting access to low-security content without\r\n",
      "              needing virtual users. When enabled, anonymous logins  are  pre‐\r\n",
      "              vented unless the password provided is listed in the file speci‐\r\n",
      "              fied by the e\bem\bma\bai\bil\bl_\b_p\bpa\bas\bss\bsw\bwo\bor\brd\bd_\b_f\bfi\bil\ble\be setting. The file format is  one\r\n",
      "              password  per line, no extra whitespace. The default filename is\r\n",
      "              /etc/vsftpd.email_passwords.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       s\bse\bes\bss\bsi\bio\bon\bn_\b_s\bsu\bup\bpp\bpo\bor\brt\bt\r\n",
      "              This controls whether vsftpd attempts to maintain  sessions  for\r\n",
      "              logins.  If  vsftpd is maintaining sessions, it will try and up‐\r\n",
      "              date utmp and wtmp. It will also open a pam_session if using PAM\r\n",
      "              to  authenticate,  and only close this upon logout. You may wish\r\n",
      "              to disable this if you do not need session logging, and you wish\r\n",
      "              to give vsftpd more opportunity to run with less processes and /\r\n",
      "              or less privilege. NOTE - utmp and wtmp support is only provided\r\n",
      "              with PAM enabled builds.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       s\bse\bet\btp\bpr\bro\boc\bct\bti\bit\btl\ble\be_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If  enabled, vsftpd will try and show session status information\r\n",
      "              in the system process listing. In other words, the reported name\r\n",
      "              of  the  process will change to reflect what a vsftpd session is\r\n",
      "              doing (idle, downloading etc). You probably want to  leave  this\r\n",
      "              off for security purposes.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       s\bss\bsl\bl_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If enabled, and vsftpd was compiled against OpenSSL, vsftpd will\r\n",
      "              support secure connections via SSL. This applies to the  control\r\n",
      "              connection  (including  login) and also data connections. You'll\r\n",
      "              need a client with SSL support too. NOTE!!  Beware enabling this\r\n",
      "              option.  Only enable it if you need it. vsftpd can make no guar‐\r\n",
      "              antees about the security of the OpenSSL libraries. By  enabling\r\n",
      "              this  option,  you  are declaring that you trust the security of\r\n",
      "              your installed OpenSSL library.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       s\bss\bsl\bl_\b_r\bre\beq\bqu\bue\bes\bst\bt_\b_c\bce\ber\brt\bt\r\n",
      "              If enabled, vsftpd will request (but  not  necessarily  require;\r\n",
      "              see    r\bre\beq\bqu\bui\bir\bre\be_\b_c\bce\ber\brt\bt)\b)ac\bce\ber\brt\bti\bif\bfi\bic\bca\bat\bte\beoni\bin\bnc\bco\bom\bmi\bin\bng\bgSSLc\bco\bon\bnn\bne\bec\bct\bti\bio\bon\bns\bs.\b.Normal‐\r\n",
      "              lyt\bth\bhi\bis\bs should not cause any trouble at all, but IBM zOS seems to\r\n",
      "              have issues.  (New in v2.0.7).\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       s\bss\bsl\bl_\b_s\bss\bsl\blv\bv2\b2\r\n",
      "              Only applies if s\bss\bsl\bl_\b_e\ben\bna\bab\bbl\ble\be is activated. If enabled, this option\r\n",
      "              will permit SSL v2 protocol connections.  TLS v1 connections are\r\n",
      "              preferred.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       s\bss\bsl\bl_\b_s\bss\bsl\blv\bv3\b3\r\n",
      "              Only applies if s\bss\bsl\bl_\b_e\ben\bna\bab\bbl\ble\be is activated. If enabled, this option\r\n",
      "              will permit SSL v3 protocol connections.  TLS v1 connections are\r\n",
      "              preferred.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       s\bss\bsl\bl_\b_t\btl\bls\bsv\bv1\b1\r\n",
      "              Only applies if s\bss\bsl\bl_\b_e\ben\bna\bab\bbl\ble\be is activated. If enabled, this option\r\n",
      "              will permit TLS v1 protocol connections.  TLS v1 connections are\r\n",
      "              preferred.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       s\bst\btr\bri\bic\bct\bt_\b_s\bss\bsl\bl_\b_r\bre\bea\bad\bd_\b_e\beo\bof\bf\r\n",
      "              If  enabled, SSL data uploads are required to terminate via SSL,\r\n",
      "              not an EOF on the socket. This option is  required  to  be  sure\r\n",
      "              that  an attacker did not terminate an upload prematurely with a\r\n",
      "              faked TCP FIN. Unfortunately, it is not enabled by  default  be‐\r\n",
      "              cause so few clients get it right. (New in v2.0.7).\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       s\bst\btr\bri\bic\bct\bt_\b_s\bss\bsl\bl_\b_w\bwr\bri\bit\bte\be_\b_s\bsh\bhu\but\btd\bdo\bow\bwn\bn\r\n",
      "              If  enabled,  SSL  data  downloads are required to terminate via\r\n",
      "              SSL, not an EOF on the socket. This is off by default as  I  was\r\n",
      "              unable  to find a single FTP client that does this. It is minor.\r\n",
      "              All it affects is our ability to tell whether  the  client  con‐\r\n",
      "              firmed  full  receipt of the file. Even without this option, the\r\n",
      "              client is able to check the integrity of the download.  (New  in\r\n",
      "              v2.0.7).\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       s\bsy\bys\bsl\blo\bog\bg_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If  enabled,  then  any  log  output  which  would  have gone to\r\n",
      "              /var/log/vsftpd.log goes to the system log instead.  Logging  is\r\n",
      "              done under the FTPD facility.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       t\btc\bcp\bp_\b_w\bwr\bra\bap\bpp\bpe\ber\brs\bs\r\n",
      "              If  enabled,  and vsftpd was compiled with tcp_wrappers support,\r\n",
      "              incoming connections will be  fed  through  tcp_wrappers  access\r\n",
      "              control. Furthermore, there is a mechanism for per-IP based con‐\r\n",
      "              figuration. If tcp_wrappers sets the  VSFTPD_LOAD_CONF  environ‐\r\n",
      "              ment variable, then the vsftpd session will try and load the vs‐\r\n",
      "              ftpd configuration file specified in this variable.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       t\bte\bex\bxt\bt_\b_u\bus\bse\ber\brd\bdb\bb_\b_n\bna\bam\bme\bes\bs\r\n",
      "              By default, numeric IDs are shown in the user and  group  fields\r\n",
      "              of  directory  listings.  You  can get textual names by enabling\r\n",
      "              this parameter. It is off by default for performance reasons.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       t\bti\bil\bld\bde\be_\b_u\bus\bse\ber\br_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If enabled, vsftpd  will  try  and  resolve  pathnames  such  as\r\n",
      "              ~chris/pics,  i.e. a tilde followed by a username. Note that vs‐\r\n",
      "              ftpd will always resolve the pathnames  ~  and  ~/something  (in\r\n",
      "              this  case  the ~ resolves to the initial login directory). Note\r\n",
      "              that ~user paths will only resolve if the file  /\b/e\bet\btc\bc/\b/p\bpa\bas\bss\bsw\bwd\bd  may\r\n",
      "              be found within the _current_ chroot() jail.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       u\bus\bse\be_\b_l\blo\boc\bca\bal\blt\bti\bim\bme\be\r\n",
      "              If enabled, vsftpd will display directory listings with the time\r\n",
      "              in your local time zone. The default  is  to  display  GMT.  The\r\n",
      "              times returned by the MDTM FTP command are also affected by this\r\n",
      "              option.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       u\bus\bse\be_\b_s\bse\ben\bnd\bdf\bfi\bil\ble\be\r\n",
      "              An internal setting used for testing the relative benefit of us‐\r\n",
      "              ing the sendfile() system call on your platform.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       u\bus\bse\ber\brl\bli\bis\bst\bt_\b_d\bde\ben\bny\by\r\n",
      "              This  option is examined if u\bus\bse\ber\brl\bli\bis\bst\bt_\b_e\ben\bna\bab\bbl\ble\be is activated. If you\r\n",
      "              set this setting to NO, then users will be denied  login  unless\r\n",
      "              they   are   explicitly   listed   in   the  file  specified  by\r\n",
      "              u\bus\bse\ber\brl\bli\bis\bst\bt_\b_f\bfi\bil\ble\be.  When login is denied, the denial is  issued  be‐\r\n",
      "              fore the user is asked for a password.\r\n",
      "\r\n",
      "              Default: YES\r\n",
      "\r\n",
      "       u\bus\bse\ber\brl\bli\bis\bst\bt_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If enabled, vsftpd will load a list of usernames, from the file‐\r\n",
      "              name given by u\bus\bse\ber\brl\bli\bis\bst\bt_\b_f\bfi\bil\ble\be.  If a user tries to log in using  a\r\n",
      "              name in this file, they will be denied before they are asked for\r\n",
      "              a password. This may be useful in preventing cleartext passwords\r\n",
      "              being transmitted. See also u\bus\bse\ber\brl\bli\bis\bst\bt_\b_d\bde\ben\bny\by.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       v\bva\bal\bli\bid\bda\bat\bte\be_\b_c\bce\ber\brt\bt\r\n",
      "              If  set  to yes, all SSL client certificates received must vali‐\r\n",
      "              date OK.  Self-signed certs do  not  constitute  OK  validation.\r\n",
      "              (New in v2.0.6).\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       v\bvi\bir\brt\btu\bua\bal\bl_\b_u\bus\bse\be_\b_l\blo\boc\bca\bal\bl_\b_p\bpr\bri\biv\bvs\bs\r\n",
      "              If  enabled, virtual users will use the same privileges as local\r\n",
      "              users. By default, virtual users will use the same privileges as\r\n",
      "              anonymous  users, which tends to be more restrictive (especially\r\n",
      "              in terms of write access).\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       w\bwr\bri\bit\bte\be_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              This controls whether any FTP commands which change the filesys‐\r\n",
      "              tem  are  allowed  or not. These commands are: STOR, DELE, RNFR,\r\n",
      "              RNTO, MKD, RMD, APPE and SITE.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "       x\bxf\bfe\ber\brl\blo\bog\bg_\b_e\ben\bna\bab\bbl\ble\be\r\n",
      "              If enabled, a log file will be maintained detailling uploads and\r\n",
      "              downloads.  By default, this file will be placed at /var/log/vs‐\r\n",
      "              ftpd.log, but this location may be overridden using the configu‐\r\n",
      "              ration setting v\bvs\bsf\bft\btp\bpd\bd_\b_l\blo\bog\bg_\b_f\bfi\bil\ble\be.\r\n",
      "\r\n",
      "              Default: NO (but the sample config file enables it)\r\n",
      "\r\n",
      "       x\bxf\bfe\ber\brl\blo\bog\bg_\b_s\bst\btd\bd_\b_f\bfo\bor\brm\bma\bat\bt\r\n",
      "              If  enabled,  the  transfer log file will be written in standard\r\n",
      "              xferlog format, as used by wu-ftpd. This is useful  because  you\r\n",
      "              can  reuse  existing transfer statistics generators. The default\r\n",
      "              format is more readable, however. The default location for  this\r\n",
      "              style  of  log  file  is /var/log/xferlog, but you may change it\r\n",
      "              with the setting x\bxf\bfe\ber\brl\blo\bog\bg_\b_f\bfi\bil\ble\be.\r\n",
      "\r\n",
      "              Default: NO\r\n",
      "\r\n",
      "N\bNU\bUM\bME\bER\bRI\bIC\bC O\bOP\bPT\bTI\bIO\bON\bNS\bS\r\n",
      "       Below is a list of numeric options. A numeric option must be set  to  a\r\n",
      "       non  negative  integer. Octal numbers are supported, for convenience of\r\n",
      "       the umask options. To specify an octal number, use 0 as the first digit\r\n",
      "       of the number.\r\n",
      "\r\n",
      "       a\bac\bcc\bce\bep\bpt\bt_\b_t\bti\bim\bme\beo\bou\but\bt\r\n",
      "              The  timeout,  in seconds, for a remote client to establish con‐\r\n",
      "              nection with a PASV style data connection.\r\n",
      "\r\n",
      "              Default: 60\r\n",
      "\r\n",
      "       a\ban\bno\bon\bn_\b_m\bma\bax\bx_\b_r\bra\bat\bte\be\r\n",
      "              The maximum data transfer rate permitted, in bytes  per  second,\r\n",
      "              for anonymous clients.\r\n",
      "\r\n",
      "              Default: 0 (unlimited)\r\n",
      "\r\n",
      "       a\ban\bno\bon\bn_\b_u\bum\bma\bas\bsk\bk\r\n",
      "              The  value that the umask for file creation is set to for anony‐\r\n",
      "              mous users. NOTE! If you want to specify octal values,  remember\r\n",
      "              the  \"0\" prefix otherwise the value will be treated as a base 10\r\n",
      "              integer!\r\n",
      "\r\n",
      "              Default: 077\r\n",
      "\r\n",
      "       c\bch\bho\bow\bwn\bn_\b_u\bup\bpl\blo\boa\bad\bd_\b_m\bmo\bod\bde\be\r\n",
      "              The file mode to force for chown()ed anonymous  uploads.  (Added\r\n",
      "              in v2.0.6).\r\n",
      "\r\n",
      "              Default: 0600\r\n",
      "\r\n",
      "       c\bco\bon\bnn\bne\bec\bct\bt_\b_t\bti\bim\bme\beo\bou\but\bt\r\n",
      "              The  timeout,  in seconds, for a remote client to respond to our\r\n",
      "              PORT style data connection.\r\n",
      "\r\n",
      "              Default: 60\r\n",
      "\r\n",
      "       d\bda\bat\bta\ba_\b_c\bco\bon\bnn\bne\bec\bct\bti\bio\bon\bn_\b_t\bti\bim\bme\beo\bou\but\bt\r\n",
      "              The timeout, in seconds, which is roughly the  maximum  time  we\r\n",
      "              permit  data  transfers  to  stall  for with no progress. If the\r\n",
      "              timeout triggers, the remote client is kicked off.\r\n",
      "\r\n",
      "              Default: 300\r\n",
      "\r\n",
      "       d\bde\bel\bla\bay\by_\b_f\bfa\bai\bil\ble\bed\bd_\b_l\blo\bog\bgi\bin\bn\r\n",
      "              The number of seconds to pause prior to reporting a  failed  lo‐\r\n",
      "              gin.\r\n",
      "\r\n",
      "              Default: 1\r\n",
      "\r\n",
      "       d\bde\bel\bla\bay\by_\b_s\bsu\buc\bcc\bce\bes\bss\bsf\bfu\bul\bl_\b_l\blo\bog\bgi\bin\bn\r\n",
      "              The  number  of  seconds to pause prior to allowing a successful\r\n",
      "              login.\r\n",
      "\r\n",
      "              Default: 0\r\n",
      "\r\n",
      "       f\bfi\bil\ble\be_\b_o\bop\bpe\ben\bn_\b_m\bmo\bod\bde\be\r\n",
      "              The permissions with which uploaded files  are  created.  Umasks\r\n",
      "              are applied on top of this value. You may wish to change to 0777\r\n",
      "              if you want uploaded files to be executable.\r\n",
      "\r\n",
      "              Default: 0666\r\n",
      "\r\n",
      "       f\bft\btp\bp_\b_d\bda\bat\bta\ba_\b_p\bpo\bor\brt\bt\r\n",
      "              The port from which PORT style connections originate (as long as\r\n",
      "              the poorly named c\bco\bon\bnn\bne\bec\bct\bt_\b_f\bfr\bro\bom\bm_\b_p\bpo\bor\brt\bt_\b_2\b20\b0 is enabled).\r\n",
      "\r\n",
      "              Default: 20\r\n",
      "\r\n",
      "       i\bid\bdl\ble\be_\b_s\bse\bes\bss\bsi\bio\bon\bn_\b_t\bti\bim\bme\beo\bou\but\bt\r\n",
      "              The  timeout,  in  seconds,  which  is the maximum time a remote\r\n",
      "              client may spend between FTP commands. If the timeout  triggers,\r\n",
      "              the remote client is kicked off.\r\n",
      "\r\n",
      "              Default: 300\r\n",
      "\r\n",
      "       l\bli\bis\bst\bte\ben\bn_\b_p\bpo\bor\brt\bt\r\n",
      "              If vsftpd is in standalone mode, this is the port it will listen\r\n",
      "              on for incoming FTP connections.\r\n",
      "\r\n",
      "              Default: 21\r\n",
      "\r\n",
      "       l\blo\boc\bca\bal\bl_\b_m\bma\bax\bx_\b_r\bra\bat\bte\be\r\n",
      "              The maximum data transfer rate permitted, in bytes  per  second,\r\n",
      "              for local authenticated users.\r\n",
      "\r\n",
      "              Default: 0 (unlimited)\r\n",
      "\r\n",
      "       l\blo\boc\bca\bal\bl_\b_u\bum\bma\bas\bsk\bk\r\n",
      "              The  value  that the umask for file creation is set to for local\r\n",
      "              users. NOTE! If you want to specify octal values,  remember  the\r\n",
      "              \"0\"  prefix otherwise the value will be treated as a base 10 in‐\r\n",
      "              teger!\r\n",
      "\r\n",
      "              Default: 077\r\n",
      "\r\n",
      "       m\bma\bax\bx_\b_c\bcl\bli\bie\ben\bnt\bts\bs\r\n",
      "              If vsftpd is in standalone mode, this is the maximum  number  of\r\n",
      "              clients  which may be connected. Any additional clients connect‐\r\n",
      "              ing will get an error message.\r\n",
      "\r\n",
      "              Default: 0 (unlimited)\r\n",
      "\r\n",
      "       m\bma\bax\bx_\b_l\blo\bog\bgi\bin\bn_\b_f\bfa\bai\bil\bls\bs\r\n",
      "              After this many login failures, the session is killed.\r\n",
      "\r\n",
      "              Default: 3\r\n",
      "\r\n",
      "       m\bma\bax\bx_\b_p\bpe\ber\br_\b_i\bip\bp\r\n",
      "              If vsftpd is in standalone mode, this is the maximum  number  of\r\n",
      "              clients which may be connected from the same source internet ad‐\r\n",
      "              dress. A client will get an error message if they go  over  this\r\n",
      "              limit.\r\n",
      "\r\n",
      "              Default: 0 (unlimited)\r\n",
      "\r\n",
      "       p\bpa\bas\bsv\bv_\b_m\bma\bax\bx_\b_p\bpo\bor\brt\bt\r\n",
      "              The  maximum  port  to allocate for PASV style data connections.\r\n",
      "              Can be used to specify a  narrow  port  range  to  assist  fire‐\r\n",
      "              walling.\r\n",
      "\r\n",
      "              Default: 0 (use any port)\r\n",
      "\r\n",
      "       p\bpa\bas\bsv\bv_\b_m\bmi\bin\bn_\b_p\bpo\bor\brt\bt\r\n",
      "              The  minimum  port  to allocate for PASV style data connections.\r\n",
      "              Can be used to specify a  narrow  port  range  to  assist  fire‐\r\n",
      "              walling.\r\n",
      "\r\n",
      "              Default: 0 (use any port)\r\n",
      "\r\n",
      "       t\btr\bra\ban\bns\bs_\b_c\bch\bhu\bun\bnk\bk_\b_s\bsi\biz\bze\be\r\n",
      "              You  probably  don't  want to change this, but try setting it to\r\n",
      "              something like 8192 for a much smoother bandwidth limiter.\r\n",
      "\r\n",
      "              Default: 0 (let vsftpd pick a sensible setting)\r\n",
      "\r\n",
      "S\bST\bTR\bRI\bIN\bNG\bG O\bOP\bPT\bTI\bIO\bON\bNS\bS\r\n",
      "       Below is a list of string options.\r\n",
      "\r\n",
      "       a\ban\bno\bon\bn_\b_r\bro\boo\bot\bt\r\n",
      "              This option represents a directory  which  vsftpd  will  try  to\r\n",
      "              change  into  after  an anonymous login. Failure is silently ig‐\r\n",
      "              nored.\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       b\bba\ban\bnn\bne\bed\bd_\b_e\bem\bma\bai\bil\bl_\b_f\bfi\bil\ble\be\r\n",
      "              This option is the name of a file containing a list of anonymous\r\n",
      "              e-mail passwords which are not permitted. This file is consulted\r\n",
      "              if the option d\bde\ben\bny\by_\b_e\bem\bma\bai\bil\bl_\b_e\ben\bna\bab\bbl\ble\be is enabled.\r\n",
      "\r\n",
      "              Default: /etc/vsftpd.banned_emails\r\n",
      "\r\n",
      "       b\bba\ban\bnn\bne\ber\br_\b_f\bfi\bil\ble\be\r\n",
      "              This option is the name of a file  containing  text  to  display\r\n",
      "              when  someone  connects  to the server. If set, it overrides the\r\n",
      "              banner string provided by the f\bft\btp\bpd\bd_\b_b\bba\ban\bnn\bne\ber\br option.\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       c\bca\ba_\b_c\bce\ber\brt\bts\bs_\b_f\bfi\bil\ble\be\r\n",
      "              This option is the name of a file to load Certificate  Authority\r\n",
      "              certs  from,  for  the  purpose  of validating client certs. The\r\n",
      "              loaded certs are also advertised to the  client,  to  cater  for\r\n",
      "              TLSv1.0  clients  such as the z/OS FTP client.  Regrettably, the\r\n",
      "              default SSL CA cert paths are not used, because of vsftpd's  use\r\n",
      "              of restricted filesystem spaces (chroot). (Added in v2.0.6).\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       c\bch\bho\bow\bwn\bn_\b_u\bus\bse\ber\brn\bna\bam\bme\be\r\n",
      "              This  is  the  name of the user who is given ownership of anony‐\r\n",
      "              mously uploaded files. This option is only relevant  if  another\r\n",
      "              option, c\bch\bho\bow\bwn\bn_\b_u\bup\bpl\blo\boa\bad\bds\bs, is set.\r\n",
      "\r\n",
      "              Default: root\r\n",
      "\r\n",
      "       c\bch\bhr\bro\boo\bot\bt_\b_l\bli\bis\bst\bt_\b_f\bfi\bil\ble\be\r\n",
      "              The  option  is  the  name  of a file containing a list of local\r\n",
      "              users which will be placed in a chroot() jail in their home  di‐\r\n",
      "              rectory.  This  option  is  only  relevant  if  the  option  c\bch\bh‐\b‐\r\n",
      "              r\bro\boo\bot\bt_\b_l\bli\bis\bst\bt_\b_e\ben\bna\bab\bbl\ble\be is enabled. If the option c\bch\bhr\bro\boo\bot\bt_\b_l\blo\boc\bca\bal\bl_\b_u\bus\bse\ber\br  is\r\n",
      "              enabled, then the list file becomes a list of users to NOT place\r\n",
      "              in a chroot() jail.\r\n",
      "\r\n",
      "              Default: /etc/vsftpd.chroot_list\r\n",
      "\r\n",
      "       c\bcm\bmd\bds\bs_\b_a\bal\bll\blo\bow\bwe\bed\bd\r\n",
      "              This options specifies a comma separated  list  of  allowed  FTP\r\n",
      "              commands  (post login. USER, PASS and QUIT and others are always\r\n",
      "              allowed pre-login). Other commands are rejected. This is a  pow‐\r\n",
      "              erful  method  of  really  locking  down an FTP server. Example:\r\n",
      "              cmds_allowed=PASV,RETR,QUIT\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       c\bcm\bmd\bds\bs_\b_d\bde\ben\bni\bie\bed\bd\r\n",
      "              This options specifies a comma separated list of denied FTP com‐\r\n",
      "              mands  (post  login.  USER, PASS, QUIT and others are always al‐\r\n",
      "              lowed pre-login). If a command appears on both this and c\bcm\bmd\bds\bs_\b_a\bal\bl‐\b‐\r\n",
      "              l\blo\bow\bwe\bed\bd then the denial takes precedence. (Added in v2.1.0).\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       d\bde\ben\bny\by_\b_f\bfi\bil\ble\be\r\n",
      "              This  option can be used to set a pattern for filenames (and di‐\r\n",
      "              rectory names etc.) which should not be accessible in  any  way.\r\n",
      "              The  affected  items  are not hidden, but any attempt to do any‐\r\n",
      "              thing to them (download, change into directory, affect something\r\n",
      "              within  directory etc.) will be denied. This option is very sim‐\r\n",
      "              ple, and should not be used for serious  access  control  -  the\r\n",
      "              filesystem's  permissions should be used in preference. However,\r\n",
      "              this option may be useful in certain  virtual  user  setups.  In\r\n",
      "              particular  aware  that if a filename is accessible by a variety\r\n",
      "              of names (perhaps due to symbolic links  or  hard  links),  then\r\n",
      "              care must be taken to deny access to all the names.  Access will\r\n",
      "              be denied to items if their name contains the  string  given  by\r\n",
      "              hide_file,  or if they match the regular expression specified by\r\n",
      "              hide_file.  Note that vsftpd's regular expression matching  code\r\n",
      "              is a simple implementation which is a subset of full regular ex‐\r\n",
      "              pression functionality. Because of this, you will need to  care‐\r\n",
      "              fully  and exhaustively test any application of this option. And\r\n",
      "              you are recommended to use filesystem permissions for any impor‐\r\n",
      "              tant  security  policies  due to their greater reliability. Sup‐\r\n",
      "              ported regex syntax is any number of *, ? and unnested {,} oper‐\r\n",
      "              ators. Regex matching is only supported on the last component of\r\n",
      "              a path, e.g. a/b/? is supported  but  a/?/c  is  not.   Example:\r\n",
      "              deny_file={*.mp3,*.mov,.private}\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       d\bdo\bow\bwn\bnl\blo\boa\bad\bd_\b_f\bfi\bil\ble\be\r\n",
      "              This option may be set to restrict downloads to files with names\r\n",
      "              matching the specified pattern. If a filename also  matches  the\r\n",
      "              d\bde\ben\bny\by_\b_f\bfi\bil\ble\be  pattern,  the  denial takes precedence. For usage and\r\n",
      "              pattern details, see the d\bde\ben\bny\by_\b_f\bfi\bil\ble\be option.\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       d\bds\bsa\ba_\b_c\bce\ber\brt\bt_\b_f\bfi\bil\ble\be\r\n",
      "              This option specifies the location of the DSA certificate to use\r\n",
      "              for SSL encrypted connections.\r\n",
      "\r\n",
      "              Default: (none - an RSA certificate suffices)\r\n",
      "\r\n",
      "       d\bds\bsa\ba_\b_p\bpr\bri\biv\bva\bat\bte\be_\b_k\bke\bey\by_\b_f\bfi\bil\ble\be\r\n",
      "              This option specifies the location of the DSA private key to use\r\n",
      "              for SSL encrypted connections. If this option is  not  set,  the\r\n",
      "              private  key  is expected to be in the same file as the certifi‐\r\n",
      "              cate.\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       e\bem\bma\bai\bil\bl_\b_p\bpa\bas\bss\bsw\bwo\bor\brd\bd_\b_f\bfi\bil\ble\be\r\n",
      "              This option can be used to provide an alternate file  for  usage\r\n",
      "              by the s\bse\bec\bcu\bur\bre\be_\b_e\bem\bma\bai\bil\bl_\b_l\bli\bis\bst\bt_\b_e\ben\bna\bab\bbl\ble\be setting.\r\n",
      "\r\n",
      "              Default: /etc/vsftpd.email_passwords\r\n",
      "\r\n",
      "       f\bft\btp\bp_\b_u\bus\bse\ber\brn\bna\bam\bme\be\r\n",
      "              This  is the name of the user we use for handling anonymous FTP.\r\n",
      "              The home directory of this user is the root of the anonymous FTP\r\n",
      "              area.\r\n",
      "\r\n",
      "              Default: ftp\r\n",
      "\r\n",
      "       f\bft\btp\bpd\bd_\b_b\bba\ban\bnn\bne\ber\br\r\n",
      "              This  string  option  allows you to override the greeting banner\r\n",
      "              displayed by vsftpd when a connection first comes in.\r\n",
      "\r\n",
      "              Default: (none - default vsftpd banner is displayed)\r\n",
      "\r\n",
      "       g\bgu\bue\bes\bst\bt_\b_u\bus\bse\ber\brn\bna\bam\bme\be\r\n",
      "              See the boolean setting g\bgu\bue\bes\bst\bt_\b_e\ben\bna\bab\bbl\ble\be for a description  of  what\r\n",
      "              constitutes  a  guest  login.  This setting is the real username\r\n",
      "              which guest users are mapped to.\r\n",
      "\r\n",
      "              Default: ftp\r\n",
      "\r\n",
      "       h\bhi\bid\bde\be_\b_f\bfi\bil\ble\be\r\n",
      "              This option can be used to set a pattern for filenames (and  di‐\r\n",
      "              rectory  names etc.) which should be hidden from directory list‐\r\n",
      "              ings. Despite being hidden, the files  /  directories  etc.  are\r\n",
      "              fully accessible to clients who know what names to actually use.\r\n",
      "              Items will be hidden if their names contain the string given  by\r\n",
      "              hide_file,  or if they match the regular expression specified by\r\n",
      "              hide_file. Note that vsftpd's regular expression  matching  code\r\n",
      "              is a simple implementation which is a subset of full regular ex‐\r\n",
      "              pression functionality.  See d\bde\ben\bny\by_\b_f\bfi\bil\ble\be for  details  of  exactly\r\n",
      "              what regex syntax is supported.  Example: hide_file={*.mp3,.hid‐\r\n",
      "              den,hide*,h?}\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       l\bli\bis\bst\bte\ben\bn_\b_a\bad\bdd\bdr\bre\bes\bss\bs\r\n",
      "              If vsftpd is in standalone mode, the default listen address  (of\r\n",
      "              all local interfaces) may be overridden by this setting. Provide\r\n",
      "              a numeric IP address.\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       l\bli\bis\bst\bte\ben\bn_\b_a\bad\bdd\bdr\bre\bes\bss\bs6\b6\r\n",
      "              Like listen_address, but specifies a default listen address  for\r\n",
      "              the  IPv6 listener (which is used if listen_ipv6 is set). Format\r\n",
      "              is standard IPv6 address format.\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       l\blo\boc\bca\bal\bl_\b_r\bro\boo\bot\bt\r\n",
      "              This option represents a directory  which  vsftpd  will  try  to\r\n",
      "              change into after a local (i.e. non-anonymous) login. Failure is\r\n",
      "              silently ignored.\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       m\bme\bes\bss\bsa\bag\bge\be_\b_f\bfi\bil\ble\be\r\n",
      "              This option is the name of the file we look for when a  new  di‐\r\n",
      "              rectory  is  entered.  The  contents are displayed to the remote\r\n",
      "              user. This option is only relevant if the option  d\bdi\bir\brm\bme\bes\bss\bsa\bag\bge\be_\b_e\ben\bn‐\b‐\r\n",
      "              a\bab\bbl\ble\be is enabled.\r\n",
      "\r\n",
      "              Default: .message\r\n",
      "\r\n",
      "       n\bno\bop\bpr\bri\biv\bv_\b_u\bus\bse\ber\br\r\n",
      "              This  is  the  name  of  the user that is used by vsftpd when it\r\n",
      "              wants to be totally unprivileged. Note that  this  should  be  a\r\n",
      "              dedicated  user, rather than nobody. The user nobody tends to be\r\n",
      "              used for rather a lot of important things on most machines.\r\n",
      "\r\n",
      "              Default: nobody\r\n",
      "\r\n",
      "       p\bpa\bam\bm_\b_s\bse\ber\brv\bvi\bic\bce\be_\b_n\bna\bam\bme\be\r\n",
      "              This string is the name of the PAM service vsftpd will use.\r\n",
      "\r\n",
      "              Default: vsftpd\r\n",
      "\r\n",
      "       p\bpa\bas\bsv\bv_\b_a\bad\bdd\bdr\bre\bes\bss\bs\r\n",
      "              Use this option to override the IP address that vsftpd will  ad‐\r\n",
      "              vertise  in  response  to the PASV command. Provide a numeric IP\r\n",
      "              address, unless p\bpa\bas\bsv\bv_\b_a\bad\bdd\bdr\br_\b_r\bre\bes\bso\bol\blv\bve\be is enabled, in which case  you\r\n",
      "              can  provide  a  hostname  which will be DNS resolved for you at\r\n",
      "              startup.\r\n",
      "\r\n",
      "              Default: (none - the address is taken  from  the  incoming  con‐\r\n",
      "              nected socket)\r\n",
      "\r\n",
      "       r\brs\bsa\ba_\b_c\bce\ber\brt\bt_\b_f\bfi\bil\ble\be\r\n",
      "              This option specifies the location of the RSA certificate to use\r\n",
      "              for SSL encrypted connections.\r\n",
      "\r\n",
      "              Default: /usr/share/ssl/certs/vsftpd.pem\r\n",
      "\r\n",
      "       r\brs\bsa\ba_\b_p\bpr\bri\biv\bva\bat\bte\be_\b_k\bke\bey\by_\b_f\bfi\bil\ble\be\r\n",
      "              This option specifies the location of the RSA private key to use\r\n",
      "              for  SSL  encrypted  connections. If this option is not set, the\r\n",
      "              private key is expected to be in the same file as  the  certifi‐\r\n",
      "              cate.\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       s\bse\bec\bcu\bur\bre\be_\b_c\bch\bhr\bro\boo\bot\bt_\b_d\bdi\bir\br\r\n",
      "              This  option  should  be the name of a directory which is empty.\r\n",
      "              Also, the directory should not be writable by the ftp user. This\r\n",
      "              directory is used as a secure chroot() jail at times vsftpd does\r\n",
      "              not require filesystem access.\r\n",
      "\r\n",
      "              Default: /var/run/vsftpd/empty\r\n",
      "\r\n",
      "       s\bss\bsl\bl_\b_c\bci\bip\bph\bhe\ber\brs\bs\r\n",
      "              This option can be used to select which SSL ciphers vsftpd  will\r\n",
      "              allow  for  encrypted  SSL connections. See the c\bci\bip\bph\bhe\ber\brs\bs man page\r\n",
      "              for further details. Note that restricting ciphers can be a use‐\r\n",
      "              ful  security precaution as it prevents malicious remote parties\r\n",
      "              forcing a cipher which they have found problems with.\r\n",
      "\r\n",
      "              Default: DES-CBC3-SHA\r\n",
      "\r\n",
      "       u\bup\bpl\blo\boa\bad\bd_\b_f\bfi\bil\ble\be\r\n",
      "              This option may be set to restrict uploads to files  with  names\r\n",
      "              matching  the  specified pattern. If a filename also matches the\r\n",
      "              d\bde\ben\bny\by_\b_f\bfi\bil\ble\be pattern, the denial takes precedence.  For  usage  and\r\n",
      "              pattern details, see the d\bde\ben\bny\by_\b_f\bfi\bil\ble\be option.\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       u\bus\bse\ber\br_\b_c\bco\bon\bnf\bfi\big\bg_\b_d\bdi\bir\br\r\n",
      "              This  powerful  option  allows the override of any config option\r\n",
      "              specified in the manual page, on a per-user basis. Usage is sim‐\r\n",
      "              ple,  and  is  best  illustrated  with  an  example.  If you set\r\n",
      "              u\bus\bse\ber\br_\b_c\bco\bon\bnf\bfi\big\bg_\b_d\bdi\bir\br to be /\b/e\bet\btc\bc/\b/v\bvs\bsf\bft\btp\bpd\bd_\b_u\bus\bse\ber\br_\b_c\bco\bon\bnf\bf and then log  on  as\r\n",
      "              the  user  \"chris\",  then  vsftpd will apply the settings in the\r\n",
      "              file /\b/e\bet\btc\bc/\b/v\bvs\bsf\bft\btp\bpd\bd_\b_u\bus\bse\ber\br_\b_c\bco\bon\bnf\bf/\b/c\bch\bhr\bri\bis\bs for the duration  of  the  ses‐\r\n",
      "              sion.  The  format  of  this  file is as detailed in this manual\r\n",
      "              page! PLEASE NOTE that not all settings are effective on a  per-\r\n",
      "              user  basis. For example, many settings only prior to the user's\r\n",
      "              session being started. Examples of settings which will  not  af‐\r\n",
      "              fect  any  behviour  on a per-user basis include listen_address,\r\n",
      "              banner_file, max_per_ip, max_clients, xferlog_file, etc.\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       u\bus\bse\ber\br_\b_s\bsu\bub\bb_\b_t\bto\bok\bke\ben\bn\r\n",
      "              This option is useful in conjunction with virtual users.  It  is\r\n",
      "              used to automatically generate a home directory for each virtual\r\n",
      "              user, based on a template. For example, if the home directory of\r\n",
      "              the   real  user  specified  via  g\bgu\bue\bes\bst\bt_\b_u\bus\bse\ber\brn\bna\bam\bme\be  is  /\b/h\bho\bom\bme\be/\b/v\bvi\bir\br‐\b‐\r\n",
      "              t\btu\bua\bal\bl/\b/$\b$U\bUS\bSE\bER\bR, and u\bus\bse\ber\br_\b_s\bsu\bub\bb_\b_t\bto\bok\bke\ben\bn is set to $\b$U\bUS\bSE\bER\bR, then  when  vir‐\r\n",
      "              tual  user fred logs in, he will end up (usually chroot()'ed) in\r\n",
      "              the directory /\b/h\bho\bom\bme\be/\b/v\bvi\bir\brt\btu\bua\bal\bl/\b/f\bfr\bre\bed\bd.  This option also takes affect\r\n",
      "              if l\blo\boc\bca\bal\bl_\b_r\bro\boo\bot\bt contains u\bus\bse\ber\br_\b_s\bsu\bub\bb_\b_t\bto\bok\bke\ben\bn.\r\n",
      "\r\n",
      "              Default: (none)\r\n",
      "\r\n",
      "       u\bus\bse\ber\brl\bli\bis\bst\bt_\b_f\bfi\bil\ble\be\r\n",
      "              This option is the name of the file loaded when the u\bus\bse\ber\brl\bli\bis\bst\bt_\b_e\ben\bn‐\b‐\r\n",
      "              a\bab\bbl\ble\be option is active.\r\n",
      "\r\n",
      "              Default: /etc/vsftpd.user_list\r\n",
      "\r\n",
      "       v\bvs\bsf\bft\btp\bpd\bd_\b_l\blo\bog\bg_\b_f\bfi\bil\ble\be\r\n",
      "              This option is the name of the file to which we write the vsftpd\r\n",
      "              style  log  file.  This  log is only written if the option x\bxf\bfe\ber\br‐\b‐\r\n",
      "              l\blo\bog\bg_\b_e\ben\bna\bab\bbl\ble\be is set, and x\bxf\bfe\ber\brl\blo\bog\bg_\b_s\bst\btd\bd_\b_f\bfo\bor\brm\bma\bat\bt is NOT  set.  Alterna‐\r\n",
      "              tively,  it  is  written if you have set the option d\bdu\bua\bal\bl_\b_l\blo\bog\bg_\b_e\ben\bn‐\b‐\r\n",
      "              a\bab\bbl\ble\be.  One further complication - if you have set s\bsy\bys\bsl\blo\bog\bg_\b_e\ben\bna\bab\bbl\ble\be,\r\n",
      "              then  this  file is not written and output is sent to the system\r\n",
      "              log instead.\r\n",
      "\r\n",
      "              Default: /var/log/vsftpd.log\r\n",
      "\r\n",
      "       x\bxf\bfe\ber\brl\blo\bog\bg_\b_f\bfi\bil\ble\be\r\n",
      "              This option is the name of the file to which we  write  the  wu-\r\n",
      "              ftpd style transfer log. The transfer log is only written if the\r\n",
      "              option x\bxf\bfe\ber\brl\blo\bog\bg_\b_e\ben\bna\bab\bbl\ble\be is  set,  along  with  x\bxf\bfe\ber\brl\blo\bog\bg_\b_s\bst\btd\bd_\b_f\bfo\bor\brm\bma\bat\bt.\r\n",
      "              Alternatively,  it  is  written  if  you  have  set  the  option\r\n",
      "              d\bdu\bua\bal\bl_\b_l\blo\bog\bg_\b_e\ben\bna\bab\bbl\ble\be.\r\n",
      "\r\n",
      "              Default: /var/log/xferlog\r\n",
      "\r\n",
      "A\bAU\bUT\bTH\bHO\bOR\bR\r\n",
      "       scarybeasts@gmail.com\r\n",
      "\r\n",
      "                                                                VSFTPD.CONF(5)\r\n"
     ]
    }
   ],
   "source": [
    "# configure FTP Server\n",
    "! man vsftpd.conf"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Configure and restart FTP Server\n",
    "- open /etc/vsftpd.conf to change settings\n",
    "- allow users in /etc/passwd to login\n",
    "    - `local_enable=YES`\n",
    "- allow uploading to the FTP server\n",
    "    - `write_enable=YES`\n",
    "    \n",
    "- restrict local users to their home directory\n",
    "    - `chroot_local_user=YES`\n",
    "    \n",
    "- files are served by default from /srv/ftp\n",
    "- restart FTP server\n",
    "\n",
    "```bash\n",
    "sudo service vsftpd restart\n",
    "```\n",
    "\n",
    "- add a new user say ftp-user\n",
    "- don't add the user to sudo group!\n",
    "\n",
    "```\n",
    "$ sudo adduser ftp-user\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "# restart FTP server after modifying the conf settings\n",
    "! echo kali | sudo -S systemctl restart vsftpd"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## install ftp client if needed\n",
    "\n",
    "- type ftp and if it's missing, install it"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Reading package lists... Done\n",
      "Building dependency tree... Done\n",
      "Reading state information... Done\n",
      "ftp is already the newest version (20230507-2).\n",
      "ftp set to manually installed.\n",
      "The following packages were automatically installed and are no longer required:\n",
      "  bluez-firmware catfish dh-elpa-helper docutils-common firmware-atheros\n",
      "  firmware-brcm80211 firmware-intel-sound firmware-iwlwifi firmware-libertas\n",
      "  firmware-realtek firmware-sof-signed firmware-ti-connectivity\n",
      "  firmware-zd1211 gir1.2-gtksource-3.0 gir1.2-javascriptcoregtk-4.0\n",
      "  gir1.2-soup-2.4 gir1.2-webkit2-4.0 gir1.2-xfconf-0 gobject-introspection\n",
      "  kali-linux-firmware king-phisher libarmadillo11 libblockdev-crypto2\n",
      "  libblockdev-fs2 libblockdev-loop2 libblockdev-part-err2 libblockdev-part2\n",
      "  libblockdev-swap2 libblockdev-utils2 libblockdev2 libcfitsio9 libgdal31\n",
      "  libgdal32 libgeos3.11.1 libgupnp-igd-1.0-4 libmongocrypt0 libmpdec3 libmujs2\n",
      "  libncurses5 libnfs13 libnginx-mod-http-geoip libnginx-mod-http-image-filter\n",
      "  libnginx-mod-http-xslt-filter libnginx-mod-mail libnginx-mod-stream\n",
      "  libnginx-mod-stream-geoip libobjc-12-dev libpoppler123 libprotobuf23\n",
      "  libpython3.10 libpython3.10-dev libpython3.10-minimal libpython3.10-stdlib\n",
      "  libsoup-gnome2.4-1 libspatialite7 libsuperlu5 libtiff5 libtinfo5\n",
      "  libwebsockets17 libyara9 libzxingcore1 linux-image-6.0.0-kali3-amd64\n",
      "  nginx-core php8.1-mysql pwgen python-pastedeploy-tpl\n",
      "  python3-advancedhttpserver python3-alabaster python3-boltons\n",
      "  python3-cairo-dev python3-commonmark python3-cryptography37 python3-docutils\n",
      "  python3-flask-security python3-geoip2 python3-geojson python3-graphene\n",
      "  python3-graphene-sqlalchemy python3-graphql-core python3-graphql-relay\n",
      "  python3-icalendar python3-imagesize python3-jaraco.classes python3-jdcal\n",
      "  python3-maxminddb python3-promise python3-py python3-pytz-deprecation-shim\n",
      "  python3-requests-file python3-roman python3-rule-engine python3-rx\n",
      "  python3-smoke-zephyr python3-snowballstemmer python3-speaklater\n",
      "  python3-sphinx python3-texttable python3.10 python3.10-dev\n",
      "  python3.10-minimal ruby3.0 ruby3.0-dev ruby3.0-doc sphinx-common tftp\n",
      "Use 'sudo apt autoremove' to remove them.\n",
      "0 upgraded, 0 newly installed, 0 to remove and 20 not upgraded.\n"
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S apt install -y ftp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Get:1 http://kali.darklab.sh/kali kali-rolling InRelease [41.2 kB]\n",
      "Err:1 http://kali.darklab.sh/kali kali-rolling InRelease\n",
      "  At least one invalid signature was encountered.\n",
      "Reading package lists... Done\n",
      "Building dependency tree... Done\n",
      "Reading state information... Done\n",
      "20 packages can be upgraded. Run 'apt list --upgradable' to see them.\n",
      "\u001b[1;33mW: \u001b[0mAn error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://kali.darklab.sh/kali kali-rolling InRelease: At least one invalid signature was encountered.\u001b[0m\n",
      "\u001b[1;33mW: \u001b[0mFailed to fetch http://http.kali.org/kali/dists/kali-rolling/InRelease  At least one invalid signature was encountered.\u001b[0m\n",
      "\u001b[1;33mW: \u001b[0mSome index files failed to download. They have been ignored, or old ones used instead.\u001b[0m\n"
     ]
    }
   ],
   "source": [
    "# run update if ftp install fails\n",
    "! echo kali | sudo -S apt update -y "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Reading package lists... Done\n",
      "Building dependency tree... Done\n",
      "Reading state information... Done\n",
      "tcpdump is already the newest version (4.99.4-3).\n",
      "tcpdump set to manually installed.\n",
      "The following packages were automatically installed and are no longer required:\n",
      "  bluez-firmware catfish dh-elpa-helper docutils-common firmware-atheros\n",
      "  firmware-brcm80211 firmware-intel-sound firmware-iwlwifi firmware-libertas\n",
      "  firmware-realtek firmware-sof-signed firmware-ti-connectivity\n",
      "  firmware-zd1211 gir1.2-gtksource-3.0 gir1.2-javascriptcoregtk-4.0\n",
      "  gir1.2-soup-2.4 gir1.2-webkit2-4.0 gir1.2-xfconf-0 gobject-introspection\n",
      "  kali-linux-firmware king-phisher libarmadillo11 libblockdev-crypto2\n",
      "  libblockdev-fs2 libblockdev-loop2 libblockdev-part-err2 libblockdev-part2\n",
      "  libblockdev-swap2 libblockdev-utils2 libblockdev2 libcfitsio9 libgdal31\n",
      "  libgdal32 libgeos3.11.1 libgupnp-igd-1.0-4 libmongocrypt0 libmpdec3 libmujs2\n",
      "  libncurses5 libnfs13 libnginx-mod-http-geoip libnginx-mod-http-image-filter\n",
      "  libnginx-mod-http-xslt-filter libnginx-mod-mail libnginx-mod-stream\n",
      "  libnginx-mod-stream-geoip libobjc-12-dev libpoppler123 libprotobuf23\n",
      "  libpython3.10 libpython3.10-dev libpython3.10-minimal libpython3.10-stdlib\n",
      "  libsoup-gnome2.4-1 libspatialite7 libsuperlu5 libtiff5 libtinfo5\n",
      "  libwebsockets17 libyara9 libzxingcore1 linux-image-6.0.0-kali3-amd64\n",
      "  nginx-core php8.1-mysql pwgen python-pastedeploy-tpl\n",
      "  python3-advancedhttpserver python3-alabaster python3-boltons\n",
      "  python3-cairo-dev python3-commonmark python3-cryptography37 python3-docutils\n",
      "  python3-flask-security python3-geoip2 python3-geojson python3-graphene\n",
      "  python3-graphene-sqlalchemy python3-graphql-core python3-graphql-relay\n",
      "  python3-icalendar python3-imagesize python3-jaraco.classes python3-jdcal\n",
      "  python3-maxminddb python3-promise python3-py python3-pytz-deprecation-shim\n",
      "  python3-requests-file python3-roman python3-rule-engine python3-rx\n",
      "  python3-smoke-zephyr python3-snowballstemmer python3-speaklater\n",
      "  python3-sphinx python3-texttable python3.10 python3.10-dev\n",
      "  python3.10-minimal ruby3.0 ruby3.0-dev ruby3.0-doc sphinx-common tftp\n",
      "Use 'sudo apt autoremove' to remove them.\n",
      "0 upgraded, 0 newly installed, 0 to remove and 20 not upgraded.\n"
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S apt install -y tcpdump"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Reading package lists... Done\n",
      "Building dependency tree       \n",
      "Reading state information... Done\n",
      "dsniff is already the newest version (2.4b1+debian-29).\n",
      "The following packages were automatically installed and are no longer required:\n",
      "  libcdio18 libmpdec2 libprotobuf22 libx264-155 libx264-159\n",
      "Use 'sudo apt autoremove' to remove them.\n",
      "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n"
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S apt install -y dsniff"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Sniff user accounts in plain text\n",
    "\n",
    "- ftp, telnet, pop3, etc.\n",
    "- run ftp server on a VM and try to connect to it from a different VM\n",
    "```bash\n",
    "ftp <server ip>\n",
    "<username>\n",
    "<password>\n",
    "```\n",
    "- sniff it first from wihtin Kali itself\n",
    "    - Kali is attacker and victim\n",
    "- use Kali as a client and Msfadmin as a server"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# run tcpdump from a terminal\n",
    "# tcpdump -l -X 'ip host <ip>'\n",
    "! echo kali | sudo tcpdump -l -X 'ip host 192.168.1.148'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "dsniff: nids_init: eth0: You don't have permission to perform this capture on that device (socket: Operation not permitted)\r\n"
     ]
    }
   ],
   "source": [
    "# run dsniff from a terminal\n",
    "! dsniff -n\n",
    "# displays ftp username:password captured only after clinet disconnects!"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Install and run telnet server\n",
    "- not secure; use ssh\n",
    "- https://www.cyberciti.biz/faq/howto-install-enable-telnet-on-debian-linux/\n",
    "- telnet server is also already installed and configured in metaploitable2\n",
    "- use msfadmin:msfadmin account to login"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Reading package lists... Done\n",
      "Building dependency tree... Done\n",
      "Reading state information... Done\n",
      "telnet is already the newest version (0.17-42).\n",
      "The following packages were automatically installed and are no longer required:\n",
      "  libomp-9-dev libomp5-9 linux-image-5.9.0-kali4-amd64 python3-plotly\n",
      "Use 'sudo apt autoremove' to remove them.\n",
      "The following NEW packages will be installed:\n",
      "  telnetd\n",
      "0 upgraded, 1 newly installed, 0 to remove and 535 not upgraded.\n",
      "Need to get 45.4 kB of archives.\n",
      "After this operation, 114 kB of additional disk space will be used.\n",
      "Get:1 http://kali.download/kali kali-rolling/main amd64 telnetd amd64 0.17-42 [45.4 kB]\n",
      "Fetched 45.4 kB in 2s (26.3 kB/s)\u001b[0m\u001b[33m\n",
      "\n",
      "\u001b7\u001b[0;23r\u001b8\u001b[1ASelecting previously unselected package telnetd.\n",
      "(Reading database ... 314273 files and directories currently installed.)\n",
      "Preparing to unpack .../telnetd_0.17-42_amd64.deb ...\n",
      "\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [  0%]\u001b[49m\u001b[39m [..........................................................] \u001b8\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [ 20%]\u001b[49m\u001b[39m [###########...............................................] \u001b8Unpacking telnetd (0.17-42) ...\n",
      "\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [ 40%]\u001b[49m\u001b[39m [#######################...................................] \u001b8Setting up telnetd (0.17-42) ...\n",
      "\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [ 60%]\u001b[49m\u001b[39m [##################################........................] \u001b8Adding user telnetd to group utmp\n",
      "\u001b7\u001b[24;0f\u001b[42m\u001b[30mProgress: [ 80%]\u001b[49m\u001b[39m [##############################################............] \u001b8Processing triggers for man-db (2.9.4-2) ...\n",
      "Processing triggers for kali-menu (2021.2.3) ...\n",
      "\n",
      "\u001b7\u001b[0;24r\u001b8\u001b[1A\u001b[J"
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S apt install telnet telnetd -y"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: sudo: /etc/init.d/xinetd: command not found\r\n"
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S /etc/init.d/xinetd restart  "
   ]
  },
  {
   "cell_type": "raw",
   "metadata": {},
   "source": [
    "dsniff: listening on eth0\n",
    "-----------------\n",
    "12/10/02 21:43:21 tcp 192.168.0.193.32782 -> 192.168.0.118.21 (ftp)\n",
    "USER leech\n",
    "PASS l8@nite\n",
    "-----------------\n",
    "12/10/02 21:47:49 tcp 192.168.0.193.32785 -> 192.168.0.120.23 (telnet)\n",
    "USER root\n",
    "PASS 5eCr3t"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Install and configure telnet server on Ubuntu\n",
    "- follow directions from: http://jdav.is/2018/04/22/installing-and-enabling-telnet-server-on-ubuntu-linux/\n",
    "- if you edit /etc/xinetd.d/telnet config file, updated the following line:\n",
    "\n",
    "`\n",
    "server = /usr/sbin/telnetd\n",
    "`"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Active sniffing\n",
    "- in a switched network environment, packets are only sent to the port they are destined for (using MAC addresses)\n",
    "- promiscuous devices aren't able to sniff any additional packets that aren't destined for them\n",
    "- a switch usually has multiple ethernet ports with its own MAC addresses"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## arp spoofing\n",
    "\n",
    "- arp spoofing allows the attacker's to redirect the victims packets to her system\n",
    "- send a bunch of bogus ARP reply with attackers MAC but victim's IP; saying hey this is my IP and my MAC is this...\n",
    "- victim then refreshes its ARP cache table (unless its explicitly marked as permanent) or adds new entry\n",
    "- systems will accept ARP reply even if they don't send out ARP request\n",
    "- also called ARP cache poisoning\n",
    "- typically attackers would want to spoof gateway/router/switch that routes all the traffic from a local network out to the Internet\n",
    "\n",
    "<img src=\"resources/arp-spoofing.png\" />"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## steps\n",
    "    - we'll do a simple MitM between two victims for ethical reasons given we have permission from the victims\n",
    "\n",
    "1. add the MAC addresses of the victims on the attackers machine"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: eth0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST>  mtu 1500\r\n",
      "        inet 192.168.195.157  netmask 255.255.255.0  broadcast 192.168.195.255\r\n",
      "        inet6 fe80::20c:29ff:febb:4e8a  prefixlen 64  scopeid 0x20<link>\r\n",
      "        ether 00:0c:29:bb:4e:8a  txqueuelen 1000  (Ethernet)\r\n",
      "        RX packets 231808  bytes 193206092 (184.2 MiB)\r\n",
      "        RX errors 0  dropped 0  overruns 0  frame 0\r\n",
      "        TX packets 91655  bytes 8957474 (8.5 MiB)\r\n",
      "        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\r\n",
      "\r\n",
      "lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536\r\n",
      "        inet 127.0.0.1  netmask 255.0.0.0\r\n",
      "        inet6 ::1  prefixlen 128  scopeid 0x10<host>\r\n",
      "        loop  txqueuelen 1000  (Local Loopback)\r\n",
      "        RX packets 88364  bytes 62522967 (59.6 MiB)\r\n",
      "        RX errors 0  dropped 0  overruns 0  frame 0\r\n",
      "        TX packets 88364  bytes 62522967 (59.6 MiB)\r\n",
      "        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\r\n",
      "\r\n"
     ]
    }
   ],
   "source": [
    "# find victims in the network; find the network address\n",
    "! echo kali | sudo -S ifconfig"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-30 00:58 EDT\n",
      "Nmap scan report for 192.168.195.1\n",
      "Host is up (0.0011s latency).\n",
      "Nmap scan report for 192.168.195.2\n",
      "Host is up (0.00092s latency).\n",
      "Nmap scan report for 192.168.195.131\n",
      "Host is up (0.0031s latency).\n",
      "Nmap scan report for 192.168.195.140\n",
      "Host is up (0.0057s latency).\n",
      "Nmap scan report for 192.168.195.157\n",
      "Host is up (0.0018s latency).\n",
      "Nmap scan report for 192.168.195.160\n",
      "Host is up (0.0014s latency).\n",
      "Nmap done: 256 IP addresses (6 hosts up) scanned in 2.45 seconds\n"
     ]
    }
   ],
   "source": [
    "# run nmap ping scan (disable port scan) to find hosts in the network\n",
    "! nmap -sn 192.168.195.0/24"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- See victims ARP cache\n",
    "```bash\n",
    "arp -n\n",
    "arp -d <ip address> # delete entry; you;ll see incomplete entry\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# ping a victim ip\n",
    "! ping -c 1 -w 1 <victim1 IP>"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# ping another victim ip\n",
    "! ping -c 1 -w 1 <victim2 IP>"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# check the atackers arp cache\n",
    "! arp -n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "2. enable ip forwarding capability in the kernel so the victims do get their packets and are not suspicious of any spoofing activities"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: 1\r\n"
     ]
    }
   ],
   "source": [
    "# check ip_forward settings - 0 means disabled\n",
    "! echo kali | sudo -S cat /proc/sys/net/ipv4/ip_forward"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "! echo kali | sudo -S sysctl net.ipv4.ip_forward"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: net.ipv4.ip_forward = 1\r\n"
     ]
    }
   ],
   "source": [
    "# enable if necessary on the fly\n",
    "! echo kali | sudo -S sysctl -w net.ipv4.ip_forward=1"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### enable ip forwarding permanently\n",
    "- open /etc/sysctl.conf file in an editor add the following line\n",
    "```\n",
    "net.ipv4.ip_forward = 1\n",
    "```\n",
    "- run the following command to enable the changes made\n",
    "\n",
    "```\n",
    "$ sysctl -p /etc/sysctl.conf\n",
    "```\n",
    "\n",
    "- or on Ubuntu run the following command\n",
    "\n",
    "```\n",
    "$ /etc/init.d/procps.sh restart\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "3. run arpspoof program to sniff packets on a switched LAN\n",
    "\n",
    "- install if needed"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[4mARPSPOOF\u001b[24m(8)                 System Manager’s Manual                \u001b[4mARPSPOOF\u001b[24m(8)\r\n",
      "\r\n",
      "\u001b[1mNAME\u001b[0m\r\n",
      "       arpspoof - intercept packets on a switched LAN\r\n",
      "\r\n",
      "\u001b[1mSYNOPSIS\u001b[0m\r\n",
      "       \u001b[1marpspoof \u001b[22m[\u001b[1m-i \u001b[4m\u001b[22minterface\u001b[24m] [\u001b[1m-c \u001b[4m\u001b[22mown|host|both\u001b[24m] [\u001b[1m-t \u001b[4m\u001b[22mtarget\u001b[24m] [\u001b[1m-r\u001b[22m] \u001b[4mhost\u001b[0m\r\n",
      "\r\n",
      "\u001b[1mDESCRIPTION\u001b[0m\r\n",
      "       \u001b[1marpspoof \u001b[22mredirects packets from a target host (or all hosts) on the LAN\r\n",
      "       intended  for  another host on the LAN by forging ARP replies.  This is\r\n",
      "       an extremely effective way of sniffing traffic on a switch.\r\n",
      "\r\n",
      "       Kernel IP forwarding (or a  userland  program  which  accomplishes  the\r\n",
      "       same, e.g. fragrouter(8)) must be turned on ahead of time.\r\n",
      "\r\n",
      "\u001b[1mOPTIONS\u001b[0m\r\n",
      "       \u001b[1m‐i \u001b[4m\u001b[22minterface\u001b[0m\r\n",
      "              Specify the interface to use.\r\n",
      "\r\n",
      "       \u001b[1m‐c \u001b[4m\u001b[22mown|host|both\u001b[0m\r\n",
      "              Specify which hardware address t use when restoring the arp con‐\r\n",
      "              figuration;  while cleaning up, packets can be send with the own\r\n",
      "              address as well as with the address of the host. Sending packets\r\n",
      "              with a fake hw address can  disrupt  connectivity  with  certain\r\n",
      "              switch/ap/bridge  configurations, however it works more reliably\r\n",
      "              than using the own address, which is the  default  way  arpspoof\r\n",
      "              cleans up afterwards.\r\n",
      "\r\n",
      "       \u001b[1m‐t \u001b[4m\u001b[22mtarget\u001b[0m\r\n",
      "              Specify  a  particular host to ARP poison (if not specified, all\r\n",
      "              hosts on the LAN). Repeat to specify multiple hosts.\r\n",
      "\r\n",
      "       \u001b[1m-r     \u001b[22mPoison both hosts (host and target) to capture traffic  in  both\r\n",
      "              directions.  (only valid in conjuntion with -t)\r\n",
      "\r\n",
      "       \u001b[4mhost\u001b[24m   Specify  the host you wish to intercept packets for (usually the\r\n",
      "              local gateway).\r\n",
      "\r\n",
      "\u001b[1mSEE ALSO\u001b[0m\r\n",
      "       dsniff(8), fragrouter(8)\r\n",
      "\r\n",
      "\u001b[1mAUTHOR\u001b[0m\r\n",
      "       Dug Song <dugsong@monkey.org>\r\n",
      "\r\n",
      "                                                                   \u001b[4mARPSPOOF\u001b[24m(8)\r\n"
     ]
    }
   ],
   "source": [
    "! man arpspoof"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### run arpspoof\n",
    "- must run as super user/root\n",
    "\n",
    "```\n",
    "$ sudo arpspoof -i <interface> -t <targetIP or victim1IP> -r <hostIP or victim2IP>\n",
    "\n",
    "```\n",
    "- let the arpspoof continue to run\n",
    "- run dsniff on another terminal to sniff username and password\n",
    "- make a victim connect to FTP server running on another victim\n",
    "```bash\n",
    "ftp <victimIP Running FTP server>\n",
    "<username>\n",
    "<password>\n",
    "```\n",
    "- close the connection and you'll see the username and password on dsniff terminal"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Wireshark\n",
    "\n",
    "- use wireshark to caputure the sniffed traffic\n",
    "\n",
    "- https://www.wireshark.org/docs/wsug_html_chunked/ChapterIntroduction.html\n",
    "- https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html\n",
    "- some filters - see manage saved bookmarks for exampes (Ribbon on the left side of filter bar)\n",
    "- add/remove filters for quick reference: Analyze -> Display Filters \n",
    "\n",
    "## Use FTP server to generate interest data\n",
    "- account info \n",
    "- common FTP commands\n",
    "```bash\n",
    "ftp <ip of FTP server>\n",
    "<username>\n",
    "<password>\n",
    "ls\n",
    "cd <folderName>\n",
    "put filename.txt # upload a file\n",
    "get filename.txt # download a file\n",
    "```\n",
    "\n",
    "## Some common filters\n",
    "\n",
    "```\n",
    "ip.src == 192.168.1. and ip.dst == 192.168.1.122\n",
    "ip.src == <clientIP> and ip.dst == <ftp server IP> and tcp.port == 21\n",
    "```\n",
    "    \n",
    "### check data contents on TCP traffic with keyword\n",
    "```  \n",
    "tcp contains PASS \n",
    "tcp contains secret\n",
    "frame contains <word>\n",
    "```\n",
    "\n",
    "### Use Regular Expression\n",
    "\n",
    "- match SSN format\n",
    "```\n",
    "tcp matches \"[0-9]{3}\\-[0-9]{2}\\-[0-9]{4}\"\n",
    "```\n",
    "    \n",
    "- match 16 digit credit card numbers with spaces in between\n",
    "```\n",
    "tcp matches \"[0-9]{4} [0-9]{4} [0-9]{4} [0-9]{4}\"\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.9"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}