Telnet Cleartext Credential Capture via MITM

Telnet transmits everything in plaintext — credentials, commands, and responses. If you are on the same network segment as a host authenticating to a Telnet service, ARP spoofing lets you intercept the session and pull credentials directly from traffic. No brute force needed.

This works in any scenario where you have layer-2 access: internal network, VPN segment, compromised switch, or a lab environment. The technique captures not just the credentials but the full session, giving you visibility into whatever the user or device is doing over Telnet.

ARP Spoofing with arpspoof

arpspoof is part of the dsniff package and is the most straightforward tool for positioning yourself between a client and a Telnet server.

Enable IP forwarding first so traffic continues to flow and the connection is not dropped:

Spoof the gateway to the victim — tell the victim that your MAC is the gateway:

-t is the target host. -r enables bidirectional spoofing, poisoning both the target and the gateway simultaneously. Run this in one terminal and keep it running throughout.

Capturing with Wireshark

With ARP spoofing active and forwarding enabled, open Wireshark and filter for Telnet traffic:

Apply the display filter:

telnet

Or filter specifically for the Telnet port if it is non-standard:

tcp.port == $PORT

Follow the TCP stream of any Telnet session — right-click a packet and select Follow > TCP Stream. Wireshark reassembles the session and displays the full conversation including the login exchange.

Credentials appear in plaintext in the stream output. On a typical login you will see the username and password typed character by character, depending on whether the daemon echoes input or not. Look for lines following Username: or Login: prompts.

Capturing with tcpdump

For headless environments or remote shells where Wireshark is not available:

Transfer the pcap to your machine and open it in Wireshark, or extract Telnet data directly:

-A prints packet payload in ASCII. Credentials will scroll past as they are typed.

Capturing with Ettercap

Ettercap combines ARP poisoning and protocol dissection in a single tool and automatically extracts Telnet credentials without manual stream analysis.

Text-mode with ARP MITM between a target and gateway:

Ettercap's Telnet dissector recognises the login sequence and prints credentials directly to the console.

No pcap analysis needed. This is the fastest path when you need credentials quickly.

For a full network segment rather than a specific target, use a broadcast target to intercept all Telnet sessions on the segment:

This poisons all hosts on the segment simultaneously. Use carefully — aggressive ARP poisoning can destabilise devices on the segment.

Extracting Credentials from an Existing Pcap

If you already have a packet capture from another source — a network tap, a compromised switch with port mirroring, or a previously collected pcap — extract Telnet sessions with tcpflow:

tcpflow writes each TCP session to a separate file. Open the files for the Telnet sessions and read the plaintext login exchanges directly.

Alternatively, use dsniff which has a purpose-built Telnet credential extractor:

dsniff parses the pcap and prints extracted credentials for Telnet, FTP, HTTP Basic, and other cleartext protocols in a clean format.

Capturing Full Session Commands

Credentials are often not the end goal. The full session content — commands run, output returned, configs displayed — is equally valuable. In Wireshark, export the reassembled TCP stream as plain text:

Follow TCP Stream > Show data as ASCII > Save As.

This gives you the complete interactive session including anything the authenticated user typed and every response from the device. On network devices this often includes a show running-config output that contains SNMP community strings, VPN pre-shared keys, local user accounts, and routing details useful for further lateral movement.