The wireshark tag has no wiki summary.
7
votes
1answer
378 views
How to study the packets sent by a keylogger
One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it.
I have a strong doubt that it is a key-logger. ...
6
votes
3answers
92 views
How to fuzz proprietary protocol over SSL?
I'm doing vulnerability research on a client/server architecture that uses a custom proprietary protocol sent over SSL (port 443). I need to be able to intercept the traffic, and be able to view it in ...
4
votes
1answer
205 views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
4
votes
2answers
187 views
When do Ps Tools send cleartext passwords, and how can I demonstrate this?
The Ps Tools from Mark Russinovich are very handy remote administration utilities. However, they all come with one big caveat.
Note that the password is transmitted in clear text to the remote ...
3
votes
2answers
271 views
how to monitor a Wifi (802.11) network?
How to capture a sequential stream of data between two machines, making no assumptions about network layer protocols? On wired network, one can do it by ARP spoofing and then sniff the network. One ...
3
votes
1answer
166 views
Extract cookies from pcap
Is there any tool to extract cookies from network sniffs generated by tcpdump (.pcap files).
I know I can open it in wireshark but it will take a while until I find the domain I am interested into ...
3
votes
1answer
520 views
Does anyone know how to “tcpdump” traffic decrypted by Mallory MITM?
I'm looking for some help in capturing network traffic that I can analyze in Wireshare (or other tools). The tool I'm using is mallory.
If anyone is familiar with mallory, I could use some help. ...
1
vote
1answer
310 views
How does wireshark detects online-messenger traffic?
I have been working on how to find use of online messenger (e.g imo.im, ebuddy) using wireshark. I'm doing , as i need to build SIEM (security information event management) use-cases which detects ...
1
vote
1answer
120 views
Will packet sniffing still work if all connections go through a local proxy?
Will packet sniffing work if all connections use a local proxy?
You are forced to use this proxy to get a connection to the internet at all.
1
vote
2answers
231 views
Why wireshark source ip tab lists other ip as well
I was trying to capture some packets using Wireshark. I could find a lots of ip in the source address tab. Which ip do they represent. Which all packets are visible to wireshark when I run it in my ...
1
vote
1answer
55 views
How do I verify versions of Adobe?
I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. ...
1
vote
1answer
56 views
Configure Wireshark to capture preformatted data from pseudo-device
So, for a research project, I'm trying to use the HONE project on github, which creates during its module installation two pseudo-devices in the /dev folder. These are called hone and honet, the ...
1
vote
1answer
830 views
wireshark only showing inbound traffic
I am using a dynex DX-EHB4 ethernet hub with two systems connected to it, the target desktop and another desktop running wireshark in promiscuous mode. I have a filter in place "host x.x.x.x" so I ...
1
vote
0answers
73 views
Turn Binary Data into Airborne Packets? [closed]
Are there any software libraries and/or wireless drivers that make it possible to turn a sequence of binary data into a wireless packet in the air? For example, if someone used Airpcap/Wireshark to ...
0
votes
1answer
73 views
Display all packets but not these TCP packets?
I'm trying to filter packets with wireshark, I would like to display all packets but terminal service communications, but if I do:
tcp.dstport != 3389 && tcp.srcport != 3389
It would ...
-1
votes
1answer
65 views
What's the best route to watch network traffic on our networks?
We have a single switch that routes all our different offices around the country using Meraki VPN. We have a VM on the switch (to the extent it can see all subdomains and different IP addresses in our ...
-1
votes
1answer
101 views
Wireshark Decode HTTPS Root Certificate
I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some ...
-4
votes
1answer
108 views
Is my computer being hacked? How can wireshark reveal if I am being hacked? [closed]
So last night I was using openVPN via my personal cloud server to watch some Hulu.
About 15 minutes into the movie I noticed my network stats were
download: ~250 MB
upload: ~1.8 GB
This is ...
