The tag has no wiki summary.

learn more… | top users | synonyms

10
votes
4answers
2k views

Is my network being sniffed?

Is there any way to find out if someone who is connected to my network is sniffing packets? There is a way with nmap if his card is in promiscuous mode but what if it is passive?
9
votes
2answers
5k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
8
votes
1answer
966 views

How to study the packets sent by a keylogger

One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it. I have a strong doubt that it is a key-logger. ...
6
votes
3answers
377 views

How to fuzz proprietary protocol over SSL?

I'm doing vulnerability research on a client/server architecture that uses a custom proprietary protocol sent over SSL (port 443). I need to be able to intercept the traffic, and be able to view it in ...
4
votes
2answers
1k views

Extract cookies from pcap

Is there any tool to extract cookies from network sniffs generated by tcpdump (.pcap files). I know I can open it in wireshark but it will take a while until I find the domain I am interested into ...
4
votes
2answers
429 views

When do Ps Tools send cleartext passwords, and how can I demonstrate this?

The Ps Tools from Mark Russinovich are very handy remote administration utilities. However, they all come with one big caveat. Note that the password is transmitted in clear text to the remote ...
3
votes
3answers
357 views

How to diagnose and handle unexplained open network connections?

I was using Wireshark in order to check the activity of an unknown client in my home network, and to my surprise, I found some strange connections established by my own computer. I disconnected all ...
3
votes
2answers
2k views

how to monitor a Wifi (802.11) network?

How to capture a sequential stream of data between two machines, making no assumptions about network layer protocols? On wired network, one can do it by ARP spoofing and then sniff the network. One ...
3
votes
3answers
375 views

Watching for applications like WireShark and other eaves dropping on corporate network

Are there ways to monitor and check for network monitoring like WireShark? Or would it just be more ideal to ensure every application uses SSL to ensure no employee or anyone could packet sniff ...
3
votes
1answer
133 views

SSL/TLS version switch over reason

I'm studying the SSL/TLS protocol, more specifically its handshake. I know that initially, a client sends a Client Hello message to the server which includes the TLS version supported by the client. ...
3
votes
1answer
531 views

How do I verify exactly which cipher suite is in use for this Remote Desktop session?

You can configure Windows to use only certain cipher suites during things like Remote Desktop sessions. Cipher suites such as RC4 56 bit, RC4 128 bit, Triple DES 168 bit, etc. SSL/TLS is not in play ...
3
votes
1answer
763 views

Does anyone know how to “tcpdump” traffic decrypted by Mallory MITM?

I'm looking for some help in capturing network traffic that I can analyze in Wireshare (or other tools). The tool I'm using is mallory. If anyone is familiar with mallory, I could use some help. ...
2
votes
4answers
406 views

How would a keylogger bypass Wireshark sniffing?

I often see malicious keyloggers being advertised as having anit-wireshark feature. Meaning their data can't be sniffed. Is it possible to do so? How would they do it? My guess is that they just ...
2
votes
3answers
2k views

Can I listen to a remote IP's traffic using Wireshark? (Man in the Middle)

How can I listen to a remote IP's traffic using Wireshark? (Man in the Middle)
2
votes
4answers
242 views

How Can I Capture Packets of LAN device in Wireshark?

I want to use my computer to capture packets sent by my Android phone in applications: e.g. YouTube. I captured http requests coming from the machine where Wireshark is installed already, now I want ...
2
votes
2answers
430 views

wireshark does't show HTTP requests from other devices

My machine along with several other machines are connected to wireless router. When i open some http page on same machine(M1) where wireshark is installed, it captures the packets such as HTTP GET or ...
2
votes
1answer
97 views

Capturing iTunes traffic with Wireshark - SSL decryption question

I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to ...
2
votes
1answer
122 views

How to further analyze suspicious traffic

I've been monitoring my network traffic with Little Snitch, and today, when launching Chrome, just the default Chrome tab (shows most frequent sites), it alerted me Chrome was trying to connect over ...
2
votes
2answers
178 views

How to sniff email with https on Windows? [closed]

I am working now on Windows 7 and I want to see if I can sniff an email content on it with Wireshark. So all right with http but with https I can't at this moment and I don't understand how. You ...
2
votes
1answer
265 views

Why is the SSL handshake not shown in Wireshark?

I am trying to figure out if some Android applications with login functions are vulnerable to man in the middle attacks or not. I have set up a MITM proxy (as an attacker) on my lubuntu machine and ...
2
votes
0answers
104 views

Some http requests are not send encrypted by vpn! Why?

I subscribed to a VPN service recently, and installed wireshark to take a look at the traffic sent from my computer. Practically all of it goes through UDP protocol, encrypted. But there are two HTTP ...
1
vote
3answers
172 views

How to get private key used to decrypt HTTPS traffic sent and received from my own browser with wireshark

I am working with a website that sends API requests. I would like to write a client to make the requests myself, but in order to do so I would need to first see the request payloads. However, the ...
1
vote
4answers
410 views

Can Your ISP use a Packet Sniffer? [closed]

Can ISPs presumably use packet sniffing applications such as wireshark and monitor my unencrypted data? Are they "allowed" to do so?
1
vote
2answers
740 views

Wireshark Trace containing SSL RSA with RC4 128 md5

I thought it'd be a neat idea to do a wireshark capture on my own login to a website and try to figure out where the packet containing the password is and decrypt it. So I logged into a website ...
1
vote
1answer
1k views

How does wireshark detects online-messenger traffic?

I have been working on how to find use of online messenger (e.g imo.im, ebuddy) using wireshark. I'm doing , as i need to build SIEM (security information event management) use-cases which detects ...
1
vote
1answer
179 views

Will packet sniffing still work if all connections go through a local proxy?

Will packet sniffing work if all connections use a local proxy? You are forced to use this proxy to get a connection to the internet at all.
1
vote
2answers
624 views

Why wireshark source ip tab lists other ip as well

I was trying to capture some packets using Wireshark. I could find a lots of ip in the source address tab. Which ip do they represent. Which all packets are visible to wireshark when I run it in my ...
1
vote
1answer
176 views

How to view WiFi traffic using Wireshark on a 3rd party?

I am trying to look at traffic between my phone and the outside world, and for whatever reason I can't see the outside world's traffic coming in. I am running Wireshark on a Kali box, I turned on the ...
1
vote
1answer
183 views

MiTM not working --rejected by router?

I have been attempting to run a MiTM on a very old XP SP3 computer. I have attempted it with 3 products, as listed below: Wireshark: Traffic from the computer did not even show up. (I did see traffic ...
1
vote
2answers
661 views

Sniffing From Squid SSL

I created a Squid proxy and a self-signed SSL certificate. The SSL certificate on the server is a private certificate linked to the ssl-bump feature. I am using tshark to dump the SSL traffic, but I ...
1
vote
1answer
379 views

Wireshark detecting suspicious messages through jabber protocol, It says it is from my website, no idea what it is

I was doing a network scan on my computer with Wireshark and came up with something very suspicious: I found a stream with the jabber protocol. I do not have a jabber server set up nor do I have any ...
1
vote
1answer
88 views

How do I verify versions of Adobe?

I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. ...
1
vote
1answer
243 views

Configure Wireshark to capture preformatted data from pseudo-device

So, for a research project, I'm trying to use the HONE project on github, which creates during its module installation two pseudo-devices in the /dev folder. These are called hone and honet, the ...
1
vote
1answer
323 views

Is suspicious network activity likely to be caused by a rootkit?

Netstat has been one of my favorite tools to check out possible malicious connections, but then I heard about the dangers of rootkits and their high complexity, allowing them to be able to bypass ...
1
vote
1answer
2k views

wireshark only showing inbound traffic

I am using a dynex DX-EHB4 ethernet hub with two systems connected to it, the target desktop and another desktop running wireshark in promiscuous mode. I have a filter in place "host x.x.x.x" so I ...
1
vote
1answer
68 views

DNS packets during ARP poisoning

I carried out an arp poisoning attack from my virtual machine to real machine with cain and able and collected data with wireshark from real machine. While I was investigating data with wireshark I ...
1
vote
2answers
84 views

How to remove tcp header of packets captured with dumpcap?

The traffic from Wireshark saved into a file with dumpcap. In this file a have for example : € X `þ $À6 @ íëÃNxXÀ¨£ P&E»kKí¨<`PEà; HTTP/1.1 200 OK Cache-Control: private And I ...
1
vote
0answers
402 views

When EAPOL packets are exchanged?

I have put wireshark to capture interface in monitor mode. I have also enable decryption and set keys in Wireshark preferences, but protocol for all packets is 802.11 which I think it means that ...
1
vote
0answers
96 views

Turn Binary Data into Airborne Packets? [closed]

Are there any software libraries and/or wireless drivers that make it possible to turn a sequence of binary data into a wireless packet in the air? For example, if someone used Airpcap/Wireshark to ...
0
votes
2answers
45 views

Wireshark displays sql calls - Prevention

So I was analysing a new application that is being written. I noticed that on the app server level there are sql calls that are being made from C# code. These calls can be seen in wireshark by ...
0
votes
1answer
551 views

What's the best route to watch network traffic on our networks?

We have a single switch that routes all our different offices around the country using Meraki VPN. We have a VM on the switch (to the extent it can see all subdomains and different IP addresses in our ...
0
votes
3answers
234 views

Do i need to have Airpcap?

Hi I am learning system security in an online course, in a practical experiment I tried to monitor the traffic through my router using wireshark1.10.3 but i have a feeling that it only sensing traffic ...
0
votes
1answer
172 views

Corrupt password being pulled from wireshark data?

Hello everyone, I currently have a pcap file that contains an unencrypted Telnet session, and when I trace the TCP stream the password is in a format like so: pas...ord (please note ...
0
votes
2answers
106 views

Display all packets but not these TCP packets? [closed]

I'm trying to filter packets with wireshark, I would like to display all packets but terminal service communications, but if I do: tcp.dstport != 3389 && tcp.srcport != 3389 It would ...
0
votes
1answer
320 views

How to decrypt passwords gained by wireshark? [closed]

We are trying to see who is using network VPN. I used Wireshark to sniff the network, I gained some users and passwords. The usernames were in plain text, but the passwords were in two different ...
0
votes
1answer
109 views

How to extract the top-level of protocols into the csv file by using tshark command?

Here is what I tried: tshark -r test.pcap -T fields -e ip.proto > output.csv But this can only show all the protocols in the csv files. I want to show only the top level of protocol numbers such as ...
0
votes
1answer
87 views

Why do I get all of these bad header checksum messages?

Every time I open my browser, I get tons of these bad header reports. What does this stem from?
0
votes
1answer
482 views

What utilities can be used for Ping of death attack?

Can somebody tell me what program can mess with pockets and enlarge them for Ping of death attack? (i need it for lab) Is there anywhere step-by-step instructions of this attack? I'm not a hacker ...
0
votes
1answer
1k views

Wireshark Gratuitous ARP

I'm playing around with scapy and wireshark and I have sent a packet to a destination that does not exist (10.0.2.14). Wireshark shows an ARP attempt to resolve the address but as its not there the ...
0
votes
0answers
35 views

I Need Wireshark Confirmation on Full Implementation of SSL for YouTube

I've just noticed today that YouTube have implemented SSL over the entire service (including video transfer). I've analyzed the partial SSL YouTube had before and it encrypted the video request but ...