document updated 14 years ago, on Apr 4, 2010

Tools that can decode application-layer stuff.

(i.e. how to be antisocial at a coffeeshop that has open wifi)

ettercap — grabs plaintext passwords from ~20 protocols
driftnet — grabs images from web traffic
dsniff — grabs plaintext passwords from ~20 protocols
- filesnarf — grabs files accessed over NFS
- mailsnarf — grabs contents of emails
- msgsnarf — grabs contents of several IM protocols
- urlsnarf — produces a log of URLs that are accessed
- webspy — views a target web browsing in real time
SniffPass by Nirsoft — sniffs plaintext passwords for 4 protocols (Windows only)
Cain and Abel — grabs Windows password hashes
NetworkMiner — passive network mapping (Windows only)
more

(TCP stream reassembly is an important stepping stone for accessing application-layer data)