| || |
Tough problem for automated security..? :)
I'm trying to build an automated tool that will check my companies software to make sure there are no clear text information going over the wire. The hard part is finding the right kind of sniffer...
1) It must be launchable from command line so it be inserted to any type of automated test whether it be SILK, NUnit, or QTPro.
2) The sniffer must be able to monitor the loopback. Part of the reason for this is I want to be able to add it into existing automation and the only automation I have that doesn't have performance monitoring on it requires all pieces of our software to be installed locally. If everything is installed locally there are no packets that actually hit the ports. They only hit the loopback.
3) The configuration file that it uses must contain three strings: Known Username, Known password, and Known content.
4) It should be easy enough to use that after I package up the scripts and sniffer anyone regardless of programming background can use it.
I've looked at several sniffers to date and very few have the ability to view the loopback and the ones that do cannot be command line driven. I would consider the not-free sniffers but only as a last resort.
I'm trying to avoid dumping the packets to file and parsing them myself but I'm ready to give up on that to get this going.
Can anyone help me out? I think I'm outta my league here.
Thanks for any help/advice,
Re: Tough problem for automated security..? :)
Try using Ethereal to monitor the packets that are being passed between the client and your server. I dont know whether it has a command line interface but u culd trap the packets to see whether any clear text information is being passed.