Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

learn more… | top users | synonyms

16
votes
4answers
3k views

Can someone using Wireshark obtain the full URL if my program uses HTTPS?

While perusing the contents of pcap files I've noticed some URLs appear to be visible despite being HTTPS. These mainly occur inside payloads that contain cert URLs too, but I also see HTTPS URLs ...
14
votes
2answers
10k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
13
votes
5answers
5k views

Why can't I decrypt SSL traffic with the client's private key only?

I have found that I can decrypt SSL traffic in Wireshark with the server's private key. Why isn't the client's private key enough to decrypt SSL traffic?
11
votes
1answer
1k views

How to study the packets sent by a keylogger

One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it. I have a strong doubt that it is a key-logger. ...
11
votes
4answers
2k views

Is my network being sniffed?

Is there any way to find out if someone who is connected to my network is sniffing packets? There is a way with nmap if his card is in promiscuous mode but what if it is passive?
7
votes
3answers
612 views

How to fuzz proprietary protocol over SSL?

I'm doing vulnerability research on a client/server architecture that uses a custom proprietary protocol sent over SSL (port 443). I need to be able to intercept the traffic, and be able to view it in ...
6
votes
4answers
11k views

How to get private key used to decrypt HTTPS traffic sent and received from my own browser with wireshark

I am working with a website that sends API requests. I would like to write a client to make the requests myself, but in order to do so I would need to first see the request payloads. However, the ...
5
votes
2answers
721 views

Facebook POST request capture

I have been trying to test a sniff on facebook POST request forms using wireshark (filtered HTTP). At login form, I would try login, and then check wireshark and see that no packet was captured. ...
5
votes
2answers
168 views

It is safe to share a wireshark file?

I wanted to share a wireshark of my file, because it may help with some problems i'm having but i need to know if it is safe, or if could reveal sensitive data about me, the only IP's i see are my ...
5
votes
3answers
563 views

When do Ps Tools send cleartext passwords, and how can I demonstrate this?

The Ps Tools from Mark Russinovich are very handy remote administration utilities. However, they all come with one big caveat. Note that the password is transmitted in clear text to the remote ...
4
votes
2answers
2k views

Extract cookies from pcap

Is there any tool to extract cookies from network sniffs generated by tcpdump (.pcap files). I know I can open it in wireshark but it will take a while until I find the domain I am interested into ...
3
votes
3answers
566 views

How to diagnose and handle unexplained open network connections?

I was using Wireshark in order to check the activity of an unknown client in my home network, and to my surprise, I found some strange connections established by my own computer. I disconnected all ...
3
votes
2answers
2k views

how to monitor a Wifi (802.11) network?

How to capture a sequential stream of data between two machines, making no assumptions about network layer protocols? On wired network, one can do it by ARP spoofing and then sniff the network. One ...
3
votes
3answers
410 views

Watching for applications like WireShark and other eaves dropping on corporate network

Are there ways to monitor and check for network monitoring like WireShark? Or would it just be more ideal to ensure every application uses SSL to ensure no employee or anyone could packet sniff ...
3
votes
3answers
200 views

Is it possible to obtain the login credentials submitted by users?

It's a question at computer security textbook Assume that user A is about to use some website that requires login credentials. User A starts his web browser, types the website’s URL, and submits the ...
3
votes
1answer
4k views

SSL/TLS version switch over reason

I'm studying the SSL/TLS protocol, more specifically its handshake. I know that initially, a client sends a Client Hello message to the server which includes the TLS version supported by the client. ...
3
votes
1answer
1k views

How do I verify exactly which cipher suite is in use for this Remote Desktop session?

You can configure Windows to use only certain cipher suites during things like Remote Desktop sessions. Cipher suites such as RC4 56 bit, RC4 128 bit, Triple DES 168 bit, etc. SSL/TLS is not in play ...
3
votes
1answer
897 views

Does anyone know how to “tcpdump” traffic decrypted by Mallory MITM?

I'm looking for some help in capturing network traffic that I can analyze in Wireshare (or other tools). The tool I'm using is mallory. If anyone is familiar with mallory, I could use some help. ...
2
votes
4answers
3k views

Can I listen to a remote IP's traffic using Wireshark? (Man in the Middle)

How can I listen to a remote IP's traffic using Wireshark? (Man in the Middle)
2
votes
4answers
728 views

How would a keylogger bypass Wireshark sniffing?

I often see malicious keyloggers being advertised as having anit-wireshark feature. Meaning their data can't be sniffed. Is it possible to do so? How would they do it? My guess is that they just ...
2
votes
2answers
281 views

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA ...
2
votes
4answers
6k views

How Can I Capture Packets of LAN device in Wireshark?

I want to use my computer to capture packets sent by my Android phone in applications: e.g. YouTube. I captured http requests coming from the machine where Wireshark is installed already, now I want ...
2
votes
3answers
221 views

promiscuous vs monitor mode in 802.11

I've been reading up on promiscuous mode and monitor mode as they relate to 802.11 networks. I understand the difference, which is explained here: What is the difference between Promiscuous and ...
2
votes
1answer
251 views

Search for user credentials within a packet capture of a gmail session over SPDY

I was reading this paper on SSL/TLS from the SANS Reading Room on how to capture and decrypt your own SSL traffic with Wireshark. I wanted to capture the credentials used to login to gmail. When the ...
2
votes
1answer
526 views

Capturing iTunes traffic with Wireshark - SSL decryption question

I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to ...
2
votes
2answers
1k views

wireshark does't show HTTP requests from other devices

My machine along with several other machines are connected to wireless router. When i open some http page on same machine(M1) where wireshark is installed, it captures the packets such as HTTP GET or ...
2
votes
2answers
1k views

Sniffing From Squid SSL

I created a Squid proxy and a self-signed SSL certificate. The SSL certificate on the server is a private certificate linked to the ssl-bump feature. I am using tshark to dump the SSL traffic, but I ...
2
votes
1answer
176 views

How to further analyze suspicious traffic

I've been monitoring my network traffic with Little Snitch, and today, when launching Chrome, just the default Chrome tab (shows most frequent sites), it alerted me Chrome was trying to connect over ...
2
votes
1answer
360 views

Client Hello message suggests cipher suite which is not in the list specified by setEnabledCipherSuites() method

In my code, I use JSSE6 API to specify a list of enabled cipher suites. I aimed to only allow 168 bits or higher encryption cipher suites, below is a part of my code: /** List of 168 bits encryption ...
2
votes
1answer
245 views

DNS packets during ARP poisoning

I carried out an arp poisoning attack from my virtual machine to real machine with cain and able and collected data with wireshark from real machine. While I was investigating data with wireshark I ...
2
votes
2answers
812 views

How to sniff email with https on Windows? [closed]

I am working now on Windows 7 and I want to see if I can sniff an email content on it with Wireshark. So all right with http but with https I can't at this moment and I don't understand how. You ...
2
votes
1answer
647 views

Why is the SSL handshake not shown in Wireshark?

I am trying to figure out if some Android applications with login functions are vulnerable to man in the middle attacks or not. I have set up a MITM proxy (as an attacker) on my lubuntu machine and ...
2
votes
0answers
32 views

What is the Padding used by SSL 3.0 in OpenSSL

Im Currently working to exploit POODLE, However i have encounter a problem. I want to know what is padding in my SSLv3 protocal, is there any method to get padding with a private key?
2
votes
0answers
64 views

Decrypt TLS from an IDS

So I am trying to figure out what the packet payload is off of a possible TLS HeartBleed alert from my IDS. I have read that Wireshark is able to do it with some certain keys, but isn't that in real ...
2
votes
0answers
208 views

Some http requests are not send encrypted by vpn! Why?

I subscribed to a VPN service recently, and installed wireshark to take a look at the traffic sent from my computer. Practically all of it goes through UDP protocol, encrypted. But there are two HTTP ...
1
vote
2answers
102 views

How can I strip sensitive data out of a Wireshark log report?

I have a sync app that doesn't work and the developer asked me to try and perform a sync with Wireshark capturing the data and send the Wireshark log to him. I noticed that Wireshark saves sensitive ...
1
vote
4answers
837 views

Can Your ISP use a Packet Sniffer? [closed]

Can ISPs presumably use packet sniffing applications such as wireshark and monitor my unencrypted data? Are they "allowed" to do so?
1
vote
2answers
1k views

Wireshark Trace containing SSL RSA with RC4 128 md5

I thought it'd be a neat idea to do a wireshark capture on my own login to a website and try to figure out where the packet containing the password is and decrypt it. So I logged into a website ...
1
vote
1answer
2k views

How does wireshark detects online-messenger traffic?

I have been working on how to find use of online messenger (e.g imo.im, ebuddy) using wireshark. I'm doing , as i need to build SIEM (security information event management) use-cases which detects ...
1
vote
1answer
190 views

Will packet sniffing still work if all connections go through a local proxy?

Will packet sniffing work if all connections use a local proxy? You are forced to use this proxy to get a connection to the internet at all.
1
vote
2answers
864 views

Why wireshark source ip tab lists other ip as well

I was trying to capture some packets using Wireshark. I could find a lots of ip in the source address tab. Which ip do they represent. Which all packets are visible to wireshark when I run it in my ...
1
vote
1answer
62 views

Intercept https traffic [duplicate]

Is it possible for a packet sniffer such as wireshark to be able to decrypt the traffic generated by a https connection from a browser ? I do not have control of the server, but I have control of the ...
1
vote
3answers
230 views

Doesn't seem to be able to capture the packets I need [ANSWERED]

I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got. Telegram does AES-256 encryption ...
1
vote
1answer
403 views

Decoding tunnel bytes in EAP-TLS or EAP-TTLS using Wireshark

I have a few pcaps of traffic for EAP-TTLS conversation, carried by RADIUS. I also have some being carried by EAPoL, but I think the answer to that case might be even less straightforward (though ...
1
vote
1answer
618 views

How to view WiFi traffic using Wireshark on a 3rd party?

I am trying to look at traffic between my phone and the outside world, and for whatever reason I can't see the outside world's traffic coming in. I am running Wireshark on a Kali box, I turned on the ...
1
vote
1answer
283 views

MiTM not working --rejected by router?

I have been attempting to run a MiTM on a very old XP SP3 computer. I have attempted it with 3 products, as listed below: Wireshark: Traffic from the computer did not even show up. (I did see traffic ...
1
vote
1answer
639 views

Wireshark detecting suspicious messages through jabber protocol, It says it is from my website, no idea what it is

I was doing a network scan on my computer with Wireshark and came up with something very suspicious: I found a stream with the jabber protocol. I do not have a jabber server set up nor do I have any ...
1
vote
1answer
95 views

How do I verify versions of Adobe?

I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. ...
1
vote
1answer
356 views

Configure Wireshark to capture preformatted data from pseudo-device

So, for a research project, I'm trying to use the HONE project on github, which creates during its module installation two pseudo-devices in the /dev folder. These are called hone and honet, the ...
1
vote
1answer
416 views

Is suspicious network activity likely to be caused by a rootkit?

Netstat has been one of my favorite tools to check out possible malicious connections, but then I heard about the dangers of rootkits and their high complexity, allowing them to be able to bypass ...