Questions tagged [wireshark]

Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

Filter by
Sorted by
Tagged with
2 votes
3 answers
3k views

Intercept HTTP Traffic of an android app?

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
0 votes
0 answers
18 views

A python code to match a web page with it’s pcap file [closed]

I must use meta-data to figure out what websites someone has visited. I have access to the pcap files of the pages they visited and they have been isolated to some degree, but I need to figure out ...
3 votes
2 answers
473 views

Decrypting network traffic and finding HTTPS private key

I've been battling with one school task for couple days and can't seem to find any idea how to solve it. The task is pretty simple: Log in to the server using SSH. The answer to the task is in ...
0 votes
1 answer
443 views

How can I found a source of HTTP request in Wireshark?

There are weird requests to/from the AWS: and another one to/from 177.143.198.104.bc.googleusercontent.com: ( http://whois.domaintools.com/177.143.198.104 ) I use Ubuntu 18.04 Desktop, web browsers ...
1 vote
2 answers
2k views

Going from an EC Private Key to Decrypting Traffic

At the moment I have an EC private key in my possession and also some traffic that was encrypted using the aforementioned private key. I have been trying to use OpenSSL to turn the private key into ...
1 vote
2 answers
302 views

What are some symptoms of malware exfiltrating data in packet captures?

I am concerned that my Linux laptop has been compromised with malware that is remotely and regularly monitoring my activity. I ran Wireshark for a day to see if I could find any symptoms of data being ...
0 votes
1 answer
1k views

Can I elicit responses from "any remote host" on "all protocols" if I want to?

An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”. After some research, this is something that can be exploited. It is explained here that: By default, WSDAPI will listen ...
0 votes
1 answer
565 views

Monitor mode not sniffing from other devices on the same network

i'm currently running a 802.11n adapter in monitor mode on a kali linux PC. Monitor mode was enabled using airmon-ng. On the same network as the kali linux PC are 2 raspberry pi devices. Pinging from ...
6 votes
1 answer
613 views

GSM - Implementing Cipher Mode Command on YateBTS

I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!? I use the combination of BladeRF x40 FPGA and ...
2 votes
1 answer
134 views

Decrypt SSL with Wireshark supported browsers

I've been following the guide: https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/ Using it for chrome and Safari on MacOS does not populate any keys in the file, Did browsers stop keys ...
0 votes
1 answer
96 views

wireshark captures vpn tun0 smtp as unencrypted, why?

I am trying to learn more about cryptography and am stumped, i dont know what direction to move to even research an answer myself so would appreciate any input. I have a vpn set up to an adapter, tun0,...
2 votes
1 answer
514 views

Capturing packets in an android application or ios application?

I've an android and ios app. They run on the same application server on Linux. I want to capture the packets when users are trying to log in to the app. How do I proceed? I'm thinking of doing it with ...
2 votes
1 answer
86 views

DHE key exchange with p value 257 bytes but a pubkey of 256 bytes

I came across a packet capture in Wireshark where p length = 257 bytes and pubkey length = 256 bytes. See the ServerKeyExchange snip below: Diffie-Hellman Server Params p Length: 257 p: ...
0 votes
0 answers
133 views

Wireshark can't decrypt TLS from a specific python library

I have a problem. I'm using Wireshark 4.0.8. I created my ssl file to store my "(pre)-master-secrets". I can thus decrypt TLS from my browser or from different python libraries without ...
0 votes
0 answers
138 views

How can I verify that my DoS attack is effective?

I was trying to simulate a DoS attack on the CORE network emulator using hping3 (Ubuntu). The topology is like three PCs connected by a router. The client's IP is 10.0.0.20/24, The server's IP is 10.0....
0 votes
0 answers
81 views

Is it normal for Apple push notifications to use the IRC protocol?

Seeing traffic like this on my network and wondering if it’s normal to see IRC being used in macOS push notifications and if anyone has any idea what the apparently escaped code (based on all of the ...
1 vote
0 answers
198 views

Wireshark decrypt TLS 1.2 from WCF client

I have managed to decrypt TLS 1.2 data using Wireshark on a connection from the browser to the WCF service, but cannot manage to do the same with the WCF client. I'm not sure what is the difference, ...
0 votes
1 answer
347 views

Does wireshark detect all unauthorized access?

A security engineer told me that my computer must have a trojan horse, but it has not been found yet. The security engineer captured and analyzed traffic pcap files with Wireshark, and said that there ...
8 votes
1 answer
28k views

Filter TLS in Wireshark or other monitoring tool

As part of the new best practices in hardening server communications I need to deny TLS 1.0 on the web server, before doing so I wish to identify the number of clients who connect with this level of ...
1 vote
0 answers
73 views

What is sequence number and why is it used as the ACK number for the next ACK packet? [closed]

I am currently trying to learn the TCP session creating (3 way handshake) process in detail. I was wondering what the sequence number means and also why is the ack num for the next ACK packet always ...
18 votes
2 answers
153k views

How do we determine the SSL/TLS version of an HTTP request?

We are wanting to configure our Windows client to use only TLS 1.1 and greater. We've learned that we can do this by editing the registry. Now we want to make several HTTPS requests from different ...
4 votes
2 answers
6k views

What is the difference between Wireshark and Ettercap for man in the middle attacks!

I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home ...
1 vote
1 answer
2k views

SNI visible in HTTP/3, QUIC connection?

Client Hello should be encrypted in HTTP/3 and QUIC, but in Wireshark I can still see SNI of the QUIC connection when using DoH. The names should be encrypted inside the Handshake/CRYPTO packets. is ...
0 votes
1 answer
94 views

For a proper traffic analysis between 2 computers, does wireshark need to be on a third laptop or just one of the two?

Looking at a situation where two machines use a secure communication protocol like this: Machine (or a VM) A <--------> Machine (or a VM) B and I want to use Wireshark to capture the traffic ...
1 vote
1 answer
3k views

Can't see data packets when capturing in monitor mode

On Kali Linux, I have an Atheros wireless adapater. I'm trying to capture data packets off the air and decrypt them as an exercise. The problem is that when I turn on the wifi monitor mode and choose ...
1 vote
0 answers
452 views

ISP-provided router sending constant ARP requests

A few weeks ago I changed my ISP provider and router at home. It is a small network (less than 10 devices). From a user perspective everything seems to work correctly, nothing notable. However, today ...
8 votes
1 answer
14k views

Wireshark can't decrypt WPA2 LAN traffic

I want to decrypt my own network traffic. I have Linux Mint on Samsung Laptop with a AR542x Wireless Network Adapter. Open Wireshark, start capture in promiscuous mode & monitor mode and I ...
0 votes
2 answers
139 views

Unfamiliar user agents 'CON 1.0 urlexists' and 'VANILLA 1.0 vanillastub' - are they malicious?

I'm analyzing a pcap via Wireshark, and there are multiple get requests to the IP. These requests use different user agents, which I can't find anything about when I search. The user agents: CON 1.0 ...
4 votes
1 answer
4k views

Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?

We are using IIS on Windows 2012-R2 server to host dotnet apps. From the app, when we try connecting to an external 3rd party api we see TLS handshake failure. On running ssllabs test on that api, I ...
0 votes
0 answers
110 views

How to capture data and answer with simulated data?

I use Wireshark and other relatively smaller sniffers to make some tests. I share my internet to my second PC. However, I have to spend much time for the following task, and want to know if i can do ...
1 vote
0 answers
4k views

How to decrypt a tls1.3 tcp packets in wireshark

I generated the public and private key with openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout server_key.pem -out cert.pem and I am using c sockets for the server and client with openssl, ...
1 vote
1 answer
781 views

Is this wireshark capture using TLS 1.2 or 1.3?

Which version of TLS is being used here?
-2 votes
2 answers
370 views

Can a connection stay hidden from Wireshark?

I'm monitoring my home network with Wireshark, since I believe my computer is being actively hacked. I looked up a LOT of IP addresses, but didn't find any suspicious ones. Can a connection be hidden ...
1 vote
0 answers
304 views

How to extract Wireshark keylog from a Java JSSE TLSv1.3 Session

Is it possible to extract the Wireshark keylog information directly from the TLSv1.3 handshake in a Java app? If so, how do I map the fields, or is additional material not shared in the handshake ...
0 votes
0 answers
78 views

Is SSL necessary when sending password to a API from a server?

I have bought a online service which allows me to send SMS messages by making a call to the provider's SOAP-API. This is the WSDL I need to send a message: <?xml version="1.0"?> <...
-2 votes
1 answer
218 views

Trying to decrypt my home network

I've put my wireless card in monitor mode following this tutorial. After that, I started monitor my wifi home and, after a few seconds, I stop it. Every packet was crypted (obviously), so I follow ...
0 votes
0 answers
1k views

Wireshark Output | [Malformed Packet: Laplink: length of contained item exceeds length of containing item] from Russian IP

While running some traces for one of our production servers, an interesting item kept popping up in our Wireshark: [Malformed Packet: Laplink: length of contained item exceeds length of containing ...
0 votes
2 answers
3k views

How to know whether mysql connection is using SSL or TLS connection?

I want to verify whether mysql remote connection is using tls/ssl connection for security purposes. I ran status command to check initially: mysql> status -------------- mysql Ver 8.0.19 for osx10....
-1 votes
1 answer
2k views

Can the usage of Wireshark be detected when sniffing for packets in promiscuous mode? [duplicate]

I know that port scanning can set off IDS systems on certain networks due to the suspicious traffic it generates. Can the usage of Wireshark be detected on a network? If so, will using it set off any ...
1 vote
1 answer
2k views

How to extract Kerberos ticket from Wireshark?

I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
2 votes
1 answer
3k views

How to decrypt HTTPS traffic with tshark when I have the .key and .crt file?

I have my domain .key and .crt file. the key file include "-----BEGIN PRIVATE KEY-----" when i use command on centos: tshark -r /tmp/xx.pcap -o 'ssl.keys_list:any,443,http,/tmp/private.key' -...
56 votes
2 answers
82k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
15 votes
3 answers
4k views

Can an HTTPS request be sent twice?

When sniffing network traffic, one can see an HTTPS packet and all its (encrypted) data. I am wondering what would happen if this packet is copied and then re-sent. Is there a protocol at some layer ...
0 votes
1 answer
653 views

Can't find anomalies / abnormalities in wireshark capture

Previous post was deleted for not enough context, which I apologise for. I will try to provide as much context as I can. I am aware this appears to be an example of a SYN flood attack with spoofed ip ...
0 votes
2 answers
466 views

Using Hydra not sending traffic to target VM

I have 3 VM's 1 with Ubuntu server version 20.04, apache2, php, mysql and DVWA. (10.0.2.4) 1 with Ubuntu client version 20.04 with hydra installed. (10.0.2.5) 1 with Kali 2021.3. (10.0.2.6) All VM's ...
4 votes
3 answers
15k views

How do you find SSL Keys on Android (to decrypt SSL on WireShark)?

I'm using an Android Emulator on my PC, then logging into some apps (while running WireShark), and now I'm trying to figure out how to decrypt the SSL traffic. I understand that I need to find some ...
0 votes
0 answers
1k views

Running ARP Spoof disables internet access on target machine, doesn't intercept traffic as well

So I'm learning to run MITM attacks on my own WiFi network but I seem to be running into an issue. I'm following this tutorial. The process is simple and I'm running the attack from my Ubuntu laptop. ...
0 votes
0 answers
147 views

Sending meaningless Addresses requests to a series of malicious IPs

i was testing somethings on browsers(It has nothing to do with what I am going to say) and accidentally i faced a case that when i browse meaningless addresses like abc/ signortest/ word/ the request ...
1 vote
0 answers
159 views

Detecting and understanding malware/spyware [closed]

Recently, stumbled upon the new FB 500m+ leak and decided to satisfy my curiosity and poke around. Basically just wanted to see how 500m+ user records were kept and what info was released( it was ...
0 votes
0 answers
225 views

Do iPhones still send packets when they are completely shutdown?

Do iPhones (or just a smart phones in general) send packets when they are fully shutdown? I have heard that they do, but I have not been able to verify such a claim. In an effort to investigate, I ARP ...

1
2 3 4 5
7