Questions tagged [wireshark]
Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.
338
questions
2
votes
3
answers
3k
views
Intercept HTTP Traffic of an android app?
I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
0
votes
0
answers
18
views
A python code to match a web page with it’s pcap file [closed]
I must use meta-data to figure out what websites someone has visited. I have access to the pcap files of
the pages they visited and they have been isolated to some degree, but I need to figure out ...
3
votes
2
answers
473
views
Decrypting network traffic and finding HTTPS private key
I've been battling with one school task for couple days and can't seem to find any idea how to solve it. The task is pretty simple:
Log in to the server using SSH. The answer to the task is in ...
0
votes
1
answer
443
views
How can I found a source of HTTP request in Wireshark?
There are weird requests to/from the AWS:
and another one to/from 177.143.198.104.bc.googleusercontent.com:
( http://whois.domaintools.com/177.143.198.104 )
I use Ubuntu 18.04 Desktop, web browsers ...
1
vote
2
answers
2k
views
Going from an EC Private Key to Decrypting Traffic
At the moment I have an EC private key in my possession and also some traffic that was encrypted using the aforementioned private key. I have been trying to use OpenSSL to turn the private key into ...
1
vote
2
answers
302
views
What are some symptoms of malware exfiltrating data in packet captures?
I am concerned that my Linux laptop has been compromised with malware that is remotely and regularly monitoring my activity. I ran Wireshark for a day to see if I could find any symptoms of data being ...
0
votes
1
answer
1k
views
Can I elicit responses from "any remote host" on "all protocols" if I want to?
An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”.
After some research, this is something that can be exploited.
It is explained here that:
By default, WSDAPI will listen ...
0
votes
1
answer
565
views
Monitor mode not sniffing from other devices on the same network
i'm currently running a 802.11n adapter in monitor mode on a kali linux PC. Monitor mode was enabled using airmon-ng. On the same network as the kali linux PC are 2 raspberry pi devices.
Pinging from ...
6
votes
1
answer
613
views
GSM - Implementing Cipher Mode Command on YateBTS
I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!?
I use the combination of BladeRF x40 FPGA and ...
2
votes
1
answer
134
views
Decrypt SSL with Wireshark supported browsers
I've been following the guide:
https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/
Using it for chrome and Safari on MacOS does not populate any keys in the file, Did browsers stop keys ...
0
votes
1
answer
96
views
wireshark captures vpn tun0 smtp as unencrypted, why?
I am trying to learn more about cryptography and am stumped, i dont know what direction to move to even research an answer myself so would appreciate any input.
I have a vpn set up to an adapter, tun0,...
2
votes
1
answer
514
views
Capturing packets in an android application or ios application?
I've an android and ios app. They run on the same application server on Linux. I want to capture the packets when users are trying to log in to the app. How do I proceed? I'm thinking of doing it with ...
2
votes
1
answer
86
views
DHE key exchange with p value 257 bytes but a pubkey of 256 bytes
I came across a packet capture in Wireshark where p length = 257 bytes and pubkey length = 256 bytes. See the ServerKeyExchange snip below:
Diffie-Hellman Server Params
p Length: 257
p: ...
0
votes
0
answers
133
views
Wireshark can't decrypt TLS from a specific python library
I have a problem. I'm using Wireshark 4.0.8. I created my ssl file to store my "(pre)-master-secrets". I can thus decrypt TLS from my browser or from different python libraries without ...
0
votes
0
answers
138
views
How can I verify that my DoS attack is effective?
I was trying to simulate a DoS attack on the CORE network emulator using hping3 (Ubuntu). The topology is like three PCs connected by a router. The client's IP is 10.0.0.20/24, The server's IP is 10.0....
0
votes
0
answers
81
views
Is it normal for Apple push notifications to use the IRC protocol?
Seeing traffic like this on my network and wondering if it’s normal to see IRC being used in macOS push notifications and if anyone has any idea what the apparently escaped code (based on all of the ...
1
vote
0
answers
198
views
Wireshark decrypt TLS 1.2 from WCF client
I have managed to decrypt TLS 1.2 data using Wireshark on a connection from the browser to the WCF service, but cannot manage to do the same with the WCF client.
I'm not sure what is the difference, ...
0
votes
1
answer
347
views
Does wireshark detect all unauthorized access?
A security engineer told me that my computer must have a trojan horse, but it has not been found yet.
The security engineer captured and analyzed traffic pcap files with Wireshark, and said that there ...
8
votes
1
answer
28k
views
Filter TLS in Wireshark or other monitoring tool
As part of the new best practices in hardening server communications I need to deny TLS 1.0 on the web server, before doing so I wish to identify the number of clients who connect with this level of ...
1
vote
0
answers
73
views
What is sequence number and why is it used as the ACK number for the next ACK packet? [closed]
I am currently trying to learn the TCP session creating (3 way handshake) process in detail. I was wondering what the sequence number means and also why is the ack num for the next ACK packet always ...
18
votes
2
answers
153k
views
How do we determine the SSL/TLS version of an HTTP request?
We are wanting to configure our Windows client to use only TLS 1.1 and greater. We've learned that we can do this by editing the registry. Now we want to make several HTTPS requests from different ...
4
votes
2
answers
6k
views
What is the difference between Wireshark and Ettercap for man in the middle attacks!
I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home ...
1
vote
1
answer
2k
views
SNI visible in HTTP/3, QUIC connection?
Client Hello should be encrypted in HTTP/3 and QUIC, but in Wireshark I can still see SNI of the QUIC connection when using DoH.
The names should be encrypted inside the Handshake/CRYPTO packets.
is ...
0
votes
1
answer
94
views
For a proper traffic analysis between 2 computers, does wireshark need to be on a third laptop or just one of the two?
Looking at a situation where two machines use a secure communication protocol like this:
Machine (or a VM) A <--------> Machine (or a VM) B
and I want to use Wireshark to capture the traffic ...
1
vote
1
answer
3k
views
Can't see data packets when capturing in monitor mode
On Kali Linux, I have an Atheros wireless adapater. I'm trying to capture data packets off the air and decrypt them as an exercise. The problem is that when I turn on the wifi monitor mode and choose ...
1
vote
0
answers
452
views
ISP-provided router sending constant ARP requests
A few weeks ago I changed my ISP provider and router at home. It is a small network (less than 10 devices). From a user perspective everything seems to work correctly, nothing notable.
However, today ...
8
votes
1
answer
14k
views
Wireshark can't decrypt WPA2 LAN traffic
I want to decrypt my own network traffic.
I have Linux Mint on Samsung Laptop with a AR542x Wireless Network Adapter.
Open Wireshark, start capture in promiscuous mode & monitor mode and I ...
0
votes
2
answers
139
views
Unfamiliar user agents 'CON 1.0 urlexists' and 'VANILLA 1.0 vanillastub' - are they malicious?
I'm analyzing a pcap via Wireshark, and there are multiple get requests to the IP. These requests use different user agents, which I can't find anything about when I search. The user agents:
CON 1.0 ...
4
votes
1
answer
4k
views
Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?
We are using IIS on Windows 2012-R2 server to host dotnet apps. From the app, when we try connecting to an external 3rd party api we see TLS handshake failure. On running ssllabs test on that api, I ...
0
votes
0
answers
110
views
How to capture data and answer with simulated data?
I use Wireshark and other relatively smaller sniffers to make some tests.
I share my internet to my second PC. However, I have to spend much time for the following task, and want to know if i can do ...
1
vote
0
answers
4k
views
How to decrypt a tls1.3 tcp packets in wireshark
I generated the public and private key with
openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout server_key.pem -out cert.pem
and I am using c sockets for the server and client with openssl, ...
1
vote
1
answer
781
views
Is this wireshark capture using TLS 1.2 or 1.3?
Which version of TLS is being used here?
-2
votes
2
answers
370
views
Can a connection stay hidden from Wireshark?
I'm monitoring my home network with Wireshark, since I believe my computer is being actively hacked. I looked up a LOT of IP addresses, but didn't find any suspicious ones.
Can a connection be hidden ...
1
vote
0
answers
304
views
How to extract Wireshark keylog from a Java JSSE TLSv1.3 Session
Is it possible to extract the Wireshark keylog information directly from the TLSv1.3 handshake in a Java app? If so, how do I map the fields, or is additional material not shared in the handshake ...
0
votes
0
answers
78
views
Is SSL necessary when sending password to a API from a server?
I have bought a online service which allows me to send SMS messages by making a call to the provider's SOAP-API.
This is the WSDL I need to send a message:
<?xml version="1.0"?>
<...
-2
votes
1
answer
218
views
Trying to decrypt my home network
I've put my wireless card in monitor mode following this tutorial. After that, I started monitor my wifi home and, after a few seconds, I stop it. Every packet was crypted (obviously), so I follow ...
0
votes
0
answers
1k
views
Wireshark Output | [Malformed Packet: Laplink: length of contained item exceeds length of containing item] from Russian IP
While running some traces for one of our production servers, an interesting item kept popping up in our Wireshark:
[Malformed Packet: Laplink: length of contained item exceeds length of containing ...
0
votes
2
answers
3k
views
How to know whether mysql connection is using SSL or TLS connection?
I want to verify whether mysql remote connection is using tls/ssl connection for security purposes.
I ran status command to check initially:
mysql> status
--------------
mysql Ver 8.0.19 for osx10....
-1
votes
1
answer
2k
views
Can the usage of Wireshark be detected when sniffing for packets in promiscuous mode? [duplicate]
I know that port scanning can set off IDS systems on certain networks due to the suspicious traffic it generates. Can the usage of Wireshark be detected on a network? If so, will using it set off any ...
1
vote
1
answer
2k
views
How to extract Kerberos ticket from Wireshark?
I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
2
votes
1
answer
3k
views
How to decrypt HTTPS traffic with tshark when I have the .key and .crt file?
I have my domain .key and .crt file.
the key file include "-----BEGIN PRIVATE KEY-----"
when i use command on centos:
tshark -r /tmp/xx.pcap -o 'ssl.keys_list:any,443,http,/tmp/private.key' -...
56
votes
2
answers
82k
views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
15
votes
3
answers
4k
views
Can an HTTPS request be sent twice?
When sniffing network traffic, one can see an HTTPS packet and all its (encrypted) data.
I am wondering what would happen if this packet is copied and then re-sent.
Is there a protocol at some layer ...
0
votes
1
answer
653
views
Can't find anomalies / abnormalities in wireshark capture
Previous post was deleted for not enough context, which I apologise for. I will try to provide as much context as I can. I am aware this appears to be an example of a SYN flood attack with spoofed ip ...
0
votes
2
answers
466
views
Using Hydra not sending traffic to target VM
I have 3 VM's
1 with Ubuntu server version 20.04, apache2, php, mysql and DVWA. (10.0.2.4)
1 with Ubuntu client version 20.04 with hydra installed. (10.0.2.5)
1 with Kali 2021.3. (10.0.2.6)
All VM's ...
4
votes
3
answers
15k
views
How do you find SSL Keys on Android (to decrypt SSL on WireShark)?
I'm using an Android Emulator on my PC, then logging into some apps (while running WireShark), and now I'm trying to figure out how to decrypt the SSL traffic.
I understand that I need to find some ...
0
votes
0
answers
1k
views
Running ARP Spoof disables internet access on target machine, doesn't intercept traffic as well
So I'm learning to run MITM attacks on my own WiFi network but I seem to be running into an issue. I'm following this tutorial.
The process is simple and I'm running the attack from my Ubuntu laptop. ...
0
votes
0
answers
147
views
Sending meaningless Addresses requests to a series of malicious IPs
i was testing somethings on browsers(It has nothing to do with what I am going to say) and accidentally i faced a case that when i browse meaningless addresses like abc/ signortest/ word/
the request ...
1
vote
0
answers
159
views
Detecting and understanding malware/spyware [closed]
Recently, stumbled upon the new FB 500m+ leak and decided to satisfy my curiosity and poke around.
Basically just wanted to see how 500m+ user records were kept and what info was released( it was ...
0
votes
0
answers
225
views
Do iPhones still send packets when they are completely shutdown?
Do iPhones (or just a smart phones in general) send packets when they are fully shutdown? I have heard that they do, but I have not been able to verify such a claim. In an effort to investigate, I ARP ...