Reply to comment

Posted by bobbyn

I wrote an Ethereal/Wireshark protocol dissector for the Secure Instant Messaging Protocol (SIMP) application. It isn't exactly beautiful, but it is functional. It would appear as though the creators are no longer around, so this is even less useful than before.

SIMP was a small utility made by the folks over at www.winfosec.com (apparently no longer around) that was initially designed as a PoC tool for secure instant messaging between two distinct hosts. The program uses the blowfish encryption algorithm in order to secure the message content before throwing it on the wire. Both sides of the connection must have the same encryption key in order for this to work correctly (blowfish being a symmetric cipher).

While doing research for my GCIA practical, I decided it would be much easier to understand the SIMP communication process if ethereal (now wireshark) could display the client interactions in a more visible manner. Using the protocol dissector for POP and the developer doc as references, I was able to write a very generic dissector for SIMP. The dissector is not perfect - the most notable issue is the incorrect ASCII display of the encrypted text in the protocol tree view.

In order to get it working on your system, first download the source for the SIMP dissector and place it in the directory where you have extracted ethereal. Then, add "packet-simp.c" to the DISSECTOR_SOURCES macro in the Makefile.am and Makefile.nmake files. Run ./configure && make and you are done.
If you would like to make any changes to my dissector, have at it. The developer doc can be found in doc/README.developer.
 

Screenshots

Session Initialization

Session Initialization
This is the beginning of a conversation between "User1" and "User2"

Sending a Message

Sending a Message
sending...

Quiting the Program

Quiting the Program
quiting...

Reply

The content of this field is kept private and will not be shown publicly.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd> <img> <div> <pre> <address> <h1> <h2> <h3> <h4> <h5> <h6> <br>
  • Lines and paragraphs break automatically.
  • You can enable syntax highlighting of source code with the following tags: <codeblock>, <blockcode>, <code>, <asm>, <c>, <cpp>, <java>, <javascript>, <perl>, <php>, <python>. The supported tag styles are: <foo>, [foo].

More information about formatting options

CAPTCHA
I hate these too, but the spam submissions were annoying and persistent.