auxiliary/server/capture/XXXX part-1

auxiliary/server/capture/ftp

This module provides a fake FTP service that is designed to capture authentication credentials.
I've used FileZilla for logins

[used FileZilla to pentest login]

auxiliary/server/capture/smb

This module provides a FAKE SMB service that can be used to capture the challenge-response password hashes of SMB client systems.

Responses sent by this service have by default the configurable challenge string (\x11\x22\x33\x44\x55\x66\x77\x88), allowing for easy cracking using Cain & Abel, L0phtcrack or John the ripper (with jumbo patch).

To exploit this, the target system must try to authenticate to this module. The easiest way to force a SMB authentication attempt is by embedding a UNC path (\SERVER\SHARE) into a web page or email message. When the victim views the web page or email, their system will automatically connect to the server specified in the UNC share (the IP address of the system running this module) and attempt to authenticate.

SMB: Server Message Block (SMB), also known as Common Internet File System (CIFS) used for providing shared access to files, printers, serial ports, and miscellaneous communications between nodes on a network.

http://en.wikipedia.org/wiki/Server_Message_Block

http://oss.sgi.com/LDP/HOWTO/SMB-HOWTO-8.html

To test accessing the fake server and put the password »

smbclient -L [serverip] -U [username]
smbclient -L 192.168.45.1 -U test

To crack the password hash »

john JOHNPWFILE

auxiliary/server/capture/pop3

This module provides a fake POP3 service that is designed to capture authentication credentials.

[used Microsoft Outlook for pentest login]

auxiliary/server/capture/telnet

auxiliary/server/capture/smtp