Tag Info

Hot answers tagged

50

Yes they can but unless your neighbor has the required technical expertise, its highly doubtful. To view incoming and outgoing traffic you need specific software to monitor network packets and the tech knowledge to actually do it. Most routers only keep a syslog and unless they are using software like wireshark to monitor/capture your packets, they cannot ...


42

The entire point of SSL is its resistance to eavesdropping by man-in-the-middle attacks like the one you're proposing. If you cannot make the client device trust your self-signed certificate, then your only options are: Intercept an initial HTTP request and never let the communication be upgraded to HTTPS (this will not work if the site has an HSTS record ...


39

If you get a VPN and use that for browsing, that will hide all your traffic from both your neighbour and their ISP.


30

What about using tor? Keep in mind that your speed will be affected*. As other people said, using any private mode in your browser is not going to be of any help. *EDIT: The slowdown heavily depends on the network topology, the number of nodes, how much traffic the nodes are handling and what you are downloading. Here you can find some explanations about ...


25

Yes they can actually. What it boils down to is that they can see which websites you are running by looking at: Clear HTTP traffic DNS requests sent One thing you could do is purchase an encrypted VPN and run all your internet traffic through the VPN. This way your neighbours will not be able to see what you are doing.


11

In practice, it depends on the router they're using (and, specifically, on the firmware it's running). Basically all home WiFi routers have the technical ability to log visited URLs, as long as their firmware includes such a feature (and it's not exactly a complicated one). The main questions are: whether the router firmware supports such a logging ...


11

When my laptop is using a network I don't control (basically anything that's not home) it wears pretty red socks to reroute all traffic into the SOCKS5 proxy built into OpenSSH and then to a server I rent anyways for my website to protect my traffic. You can use tor as well but I intensely dislike tor (for reasons off topic here). This is the socks_up ...


11

Any suggestions? Is is doable? You need to own a certificate trusted by the device to intercept the traffic. How this can be achieved depends on how proper and open the certificate validation on the device is. The device might have a buggy or non-existing validation of certificates. This is typically No validation at all, in which case you could use ...


5

If I understand correctly, your connection to the Internet gateway is wired and everyone else is WiFi. If that is the case, the WiFi users cannot capture your FTP credentials because there is no need for the WiFi AP to transmit them, and it won't. But really, the answer is to convince the people at the other end to replace FTP with SFTP.


4

If you can do it (with Wireshark or another tool), then any program that has the same privilege level as you can theoretically do it as well. So if the question is: can the loopback interface be sniffed? I'd reply YES. From what I know, it's more or less the reason why it was created in the first place.


3

nmap has the ability to guess the operating system by looking at variations in how a device reacts to TCP/IP probes (see the nmap website for details). You can also make a guess at the identity of a device by looking at who its MAC address was allocated to. For example, something with an address in a Hewlett-Packard block is probably a network printer.


3

Free software to demodulate the signal exists, see http://bellard.org/linmodem.html For the physical signal acquisition on first approximation I'd use a digital oscilloscope, something like https://www.sparkfun.com/products/11219 but it should be possible to do it a lot cheaper unless you plan to reuse it for other projects. If you can cut the line two ...


3

Right, the corporate network admins implement a man-in-the-middle attack against the TLS client with their own CA so that they can see what's leaving their network. They will probably have a device that will create a certificate on the fly that is valid for gmail.com when you visit gmail.com. The reason they do this isn't to play Dr. Evil, it's so they can ...


3

In a WiFi network, all information which is sent over the network is broadcasted over the air. Usually network interfaces are configured to just ignore any network traffic not addressed to them, but there are tools available which change them to "promiscuous mode" which allows them to also log and show any traffic which they receive even though it is ...


3

In "Promiscous mode", the driver still outputs standard ethernet frames belonging to the one wireless network you are currently associated to (identified by the BSSID). Possibly the device will only dump packets from the AP to wireless devices, but not packets from wireless clients to the AP, as receiving packets from non-AP devices is not used in AP client ...


3

Can This be done? I would say yes, but with some caveats. Depending on the cable and the data, you would need some very expensive / sensitive equipment to pull this off. To me this is a similar issue to the old Van Eck Phreaking (http://en.wikipedia.org/wiki/Van_Eck_phreaking). Intel has some tech to circumvent this kind of attack: ...


3

No, the very nature of HTTPS is that the certificate is required to decrypt it. You could sniff the traffic, but it would be encrypted and useless to you.


3

No. This is the point of SSL, to prevent this kind of unauthorized snooping. To authorize your proxy you need to tell the device to trust the proxy certificate, and tell the device clients to trust your certificate or use the devices private key, which it sounds like you don't have access to. For more information: ...


3

Take a Look at the FREAK tls vulnerability. you should be able to inject data into the SSL negotiation to trick the device into a RSA Export cipher, and from there the decryption of traffic by a man in the middle is significantly easier ( aka possible. ) Charles is written in java, shouldn't be too hard to modify to exploit this automatically.


2

I'd like to suggest Ettercap, a free and open-source network security tool for man-in-the-middle attacks. I recently used its ARP spoofing functionality in an Ethical Hacking / Penetration Testing training, and was amazed how easy it is to set up. It's included in the Kali Linux distribution.


2

As others have said, it is very easy indeed and there are many simple tools available for intercepting data in the clear. It is also very common. The delivery of malware is generally automated and industrial in scale, many 10's of thousands of machines in a typical botnet. Targeted attacks are more limited in scale but are generally not discovered for ...


2

'How common' is not answerable or useful - you need to look at your risk. 'How easy' is much simpler to answer. It is incredibly easy if you are on the same network segment as an endpoint, but it is also easy if you can compromise a router or switch. So, if you have data communications that are a target for an attacker, then they will work out how much ...


2

No, this is not the case. A certificate signed by a CA contains only the public key, but for decrypting you need the private key too. This private key is not needed for the CA to sign the key, so they usually don't have it either. But, some CA offer to simplify the process of certificate generation by generating a key pair for the certificate too. In this ...


2

These days basic Software Defined Radio (SDR) kit has become very affordable so you can now obtain the RTL-SDR USB stick for about $15 and perform some GSM sniffing on a standard laptop running Wireshark. The GSM capture is done using the RTL-SDR and the airprobe tool (which builds on GnuRadio) that relays the packets to Wireshark, via the GSMTAP port (UDP ...


1

How to sniff data from an upstream router? It is a bit like tracking the comings and goings of your neighbours and their guests on the first floor, while you live in an apartment on the second floor. Technically you cannot. No way. Nada. This problem, as it stands, is unsolvable. No solutions. But maybe you can change the problem a little bit? ...


1

You cannot passively sniff packets that aren't passing through the part of the network you control, no. However, attackers sometimes use a related kind of attack, where they compromise either the router or the hosts in the target network to make them send packets where they shouldn't. Then they can be passively sniffed.


1

If you are able to monitor the network, and assuming that the clients are not network devices like routers that may hide behind them other devices, it is possible to determine (with some accuracy) what operating system the device owning that IP address has just by monitoring what IPs that device connects to. For instance, a device that connects regularly to ...


1

Unless you use a VPN to tunnel through their network, they can see your activity and the destination of your traffic, just like your ISP could. (They are effectively your ISP.) If you want to avoid them being able to see everything you are doing, you must encrypt your communications across their network. If you use a VPN, they will be able to tell you are ...


1

The HTTPS traffic is encrypted, you can trick a computer into not using HTTPS but for this you'll need to setup a man in the middle attack. Then use something like sslstrip to trick the client into not using HTTPS. Kali linux has all these tools build in, so that would be a good OS to start with.


1

Yes, Wireshark will do the job. If you want to sniff your own mails just start it on the corresponding interface. If you want to sniff all mails in the network you have to somehow put yourself in a man in the middle position. You could use Cain for that if you have it installed anyway and it supports ARP poisoning, which is one possible method. After ...



Only top voted, non community-wiki answers of a minimum length are eligible