Ettercap

No entries match these filters. Clear filters

1. v0.8.4 Feb 1, 2026 · release notes

   Ettercap v0.8.4 adds a new etterfilter random function, libmaxminddb GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. API, GTKGTKA cross-platform widget toolkit maintained by the GNOME project for building graphical user interfaces in C, with bindings for many languages, giving cyber tools a native desktop UI without writing platform-specific rendering code. SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. redirect list refresh, and major dependency updates.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.8.4 https://github.com/Ettercap/ettercap.git
   # already have the repo? check out this version:
   $ git checkout v0.8.4

   └──▷ HOW TO FIND IT
   Refresh the SSL redirect list mid-session without restarting Ettercap — useful after adding new HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. targets.
   📍In the GTK UI, navigate to the SSL redirect list panel and click the Refresh button to reload the current redirect rules.
   • Adds a new random function to etterfilter for use in custom filter scripts.
   • Replaces the legacy GeoIP C API with the libmaxminddb C API for geolocation lookups.
   • Enables on-demand refresh of the SSL redirect list directly from the GTK UI.
   • Adds proper XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. hi-color icon support for desktop environments.
   • Upgrades bundled libnet from 1.2 to 1.3, curl from 7.86 to 8.18, and LuaJIT from 2.0.5 to v2.1-20250826.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The default configuration directory is now /usr/local/etc/ettercap instead of /etc/ettercap on non-Linux operating systems.
2. v0.8.3.1 Aug 1, 2020 · release notes

   v0.8.3.1 adds --plugin-list CLI arg, autostarting UI plugins from CLI, execreplace etterfilter command, and SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address./SAN takeover in SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. interception.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.8.3.1 https://github.com/Ettercap/ettercap.git
   # already have the repo? check out this version:
   $ git checkout v0.8.3.1

   └──▷ USE IT
   Load specific plugins via CLI instead of config when launching Ettercap in graphical mode.
   shell copy

   ettercap -G --plugin-list 'plugin1,plugin2'

   • Adds --plugin-list CLI parameter to specify plugins on the command line
   • CLI provided plugins are now also autostarted in graphical UI
   • New execreplace etterfilter command for packet modification
   • Take over client-side SNI extension in ClientHello in SSL interception (req. OpenSSL 1.1.1)
   • Take over SAN certificate extension from server certificate in SSL interception

   5 details in Everything

3. v0.8.3 Jul 1, 2019 · release notes

   Ettercap v0.8.3 adds customizable SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. redirects at runtime, a KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. 5 downgrade plugin, and GTK3 UI default.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.8.3 https://github.com/Ettercap/ettercap.git
   # already have the repo? check out this version:
   $ git checkout v0.8.3

   └──▷ TRY IT
   Build ettercap with the new default GTK3 interface instead of the deprecated GTK2.
   copy

   $ cmake -DGTK_BUILD_TYPE=gtk3 ..

   • New Kerberos 5 downgrade plugin added to ettercap
   • GTK3 is the new default GTK_BUILD_TYPE for builds

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Non-aligned filters are no longer supported and require recompilation with etterfilter
4. v0.8.2 Mar 14, 2015 · release notes

   ettercap v0.8.2 adds TXT and ANY DNS query support in dns_spoof

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.8.2 https://github.com/Ettercap/ettercap.git
   # already have the repo? check out this version:
   $ git checkout v0.8.2

5. v0.8.1 Oct 16, 2014 · release notes

   Adds ESP filtering, GTK3 support, smart ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. poisoning, nd-poisoning, execinject command, base64 functions, and Windows build.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.8.1 https://github.com/Ettercap/ettercap.git
   # already have the repo? check out this version:
   $ git checkout v0.8.1

   └──▷ USE IT
   Inject custom actions into an etter filter based on packet content.
   shell copy

   etterfilter -e myrules.ef myfilter.ec

   Install ettercap binaries to a custom directory during build.
   shell copy

   cmake .. -DINSTALL_EXEDIR=/opt/custom/bin && make install

   • etterfilter now supports execinject subcommand for executing actions on matched packets
   • ettercap gains experimental ESP detection and filtering capabilities
   • ettercap adds support for GTK3 UI via new GTK3 support build option
   • ettercap introduces smart ARP poisoning algorithm
   • ettercap introduces nd-poisoning for IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. neighbor discovery attacks

   +2 more show less

   • etterfilter gains base64 encode and decode functions
   • Build system adds -DINSTALL_EXEDIR cmake option to control binary installation path

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Removed hex_encode functionality from etterfilter
   • !Removed ec_pap.c source file as it was duplicated in ec_ppp.c
6. v0.8.0 Sep 20, 2013 · release notes

   Ettercap v0.8.0 adds new plugins (fraggle, mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing.), Lua support, full wifi decryption, and the libettercap library

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.8.0 https://github.com/Ettercap/ettercap.git
   # already have the repo? check out this version:
   $ git checkout v0.8.0

   • Adds fraggle plugin attack for amplification attacks
   • Adds mDNS spoof plugin for multicast DNS spoofing
   • Adds Add experimental Lua support to Ettercap for scriptable logic
   • Enables Full support for wifi decrypting (wep and wpa) in the dissector
   • Adds new low level decoders including ip over pppoe and PPP DLT interfaces

   +3 more show less

   • Adds SRV query handling to DNS spoof for broader DNS attack vectors
   • Enables building the standalone libettercap library without GUIs
   • Adds ettercap-pkexec, policy file, and ettercap.desktop for privileged GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. launching as a normal user

   8 details in Everything