[BlueOnyx:03322] Re: Suggestions for trashed filesystem?

[Tobias Gablunsky]

> 
> 
> On 12 Jan 2010, at 13:42, Chris Gebhardt - VIRTBIZ Internet wrote:
> > Steve Howes wrote:
> >> Leave tcpdump running for a while. Anyone not using SSL 
> will tell you
> >> their passwords soon enough...
> > Interesting, Steve!  What is your recipe for weeding out the  
> > passwords?
> >  On a box with even a modicum of traffic, I think I'd have 
> some issues
> > with that.
> 
> Pick a protocol (POP3/IMAP would be my choice), then tcpdump just  
> that. Nuke any packets without 'user' or 'pass' in (or IMAP  
> equivalent) and you should get something useful. You may well have  
> issues with it (i.e. its a lot of work) but if its that or get a few  
> hundred customers to reconfigure their mail clients - it 
> might well be  
> worth it....

Or maybe you'll use a tool like i.e. dsniff - that is able to extract
the passwords for you "automatically".