Hot answers tagged

93

If what you describe is true, your chat room is designed badly. The view of the server and what packets it receives should be forwarded to other users should be independent from whatever packets are coming in or going out. Manipulating the traffic on a client should only interfere with that client's view of the chat room, never with other clients. If you ...


49

The short answer: use better chat room software. Your question is lacking details about what kind of chat room program you're using. I am going to assume that it's either a simple client-server model, or a direct peer-to-peer. Either way, you have a sender who types and sends a message, and a receiver (either another client, or a centralized server). From ...


25

Your question is lacking detailed description of what's going on. Therefore, it's impossible to solve the problem you described. However, it might be helpful to point out a different one. If what you described is true, that isn't your problem. Your problem is a much bigger one. Namely that you trust the user. Never trust the user! I assume that you tell ...


5

Yes. A Harris Stingray, Boeing DRT box, or other cell simulator can intercept SMS messages. These are monitoring devices that have secretly been used by police agencies for over a decade. They come with strict non-disclosure agreements where the agencies that purchase them are not even allowed to acknowledge their existence to the public, and certainly ...


5

If you sniff on the exit node and the connection is not https/hidden service, then you will have the traffic in clear but you will not be able to know from who it came. Unless the traffic itself is revealing the identity. In other cases, as far as we know, you can't decrypt tor. As other said, tor will be useless if it was possible.


5

You have to know what software the administrators are using to sniff the packets, additionally you have to know a vulnerability that is capable of crashing the application. If these requirements apply, the answer to your question is yes. For reference, take a look at past wireshark vulnerabilitys: ...


4

According to scuzzy-delta, yes: It is possible to detect that someone on your network is using Tor (e.g. You're a network administrator at a workplace, and an employee is using it), and the fact that you're using it is in itself interesting information. His answer: http://security.stackexchange.com/a/27848/76663 Using a bridged TOR connection is a ...


4

You can intercept the traffic by building a bridge between the AP and the uplink. This can be done by using the bridgeutils and two network interfaces. The software side is described here. This will allow you to capture and view all traffic. You can then display the data in wireshark or use a transparent proxy to get the informations you want in a protocol ...


3

You may not understand https, so I'd like to explain it a little bit. What Happens With HTTPS? Since it uses HTTPS, you generally don't have to worry about packet sniffing if it's properly implemented. With or without HTTPS, the program is not safe from packet sniffing (few things are). Is that a problem? No. Why? Because with properly implemented crypto, ...


3

The NSS SSL Keylog file is a non-obtrusive way to extract SSL session keys from an application using the NSS library for SSL/TLS, but there is no standard way to do the same in all applications. (A generic approach would involve a man in the middle attack, but this is not really non-obtrusive.) The idea of the extracting session keys directly from the ...


3

NMAP has a sniffer-detect script built-into it, it's probably the most simple solution out there. I have seen no comparison of the two tools on their effectiveness. Note that all these solutions do is try and find interfaces running promiscuous mode, there are many ways to sniff a network which would leave no traces at all, for instance taps and spans.


3

I presume that by "router", you mean each of these is a "router/NAT/firewall" combination appliance. Most home routers include firewall capabilities, which is most likely what you're relying upon here. (Note that NAT is a connection sharing technology, but not a defense mechanism.) To directly answer your question, if a hacker gets inside your first ...


3

If user B is in same network, so he can use ARP poisoning for capturing the data that transfer from user A to the server. This type of attack called MITM ( man in the middle) attack. But if user B is not in the same network, the only way is that installs a backdoor or trojan on the computer of A. Anothe way is that before that user A open web browser, user ...


2

If you can login remotely, then there will be very little that you cannot do. Once you have a root shell, you can easily run tcpdump. You can read the local databases that supply encryption keys elsewhere. If within that shell, you are missing commands; you can write, or simply go find the commands you want. If you do manage to get in, there is probably ...


2

These types of question has depends answers. The answer varies depending on the policies of owner of open WiFi and plans among other factors. but This question specially has 2 aspects: (second aspect may be your answer) First one: connecting people to an open WiFi network, without having the owner's permission and following his/her terms of service is ...


2

It depends on how the VPN is set up. One of the possible setups is the following: VPN connection to allow remote access to internal network servers of the company, but all other traffic is direct from you to the internet (so not routed through the VPN). All traffic is routed through the VPN making all traffic between you and the company secure. All other ...


2

If it is a PSTN line a simple tape recorder attached to the lines could do the trick. For ISDN I suspect you need a DAC but its also easy, as long as you have physical access to the line. Any connection using a Telephone line (digital or analogue) is easy to understand for anyone that knows the encoding schema. To realy protect it you should use the same ...


2

There is a possibility that Promiscuous mode can be detected by another device on the network! You can/must configure your sniffer tool/software so that it doesn't allows to detect if you are in promiscuous mode. For that you have to configure your sniffer tool so that your machine doesn't reply to the packets/requests that are usually used to detect the ...


2

Is it must for a packet sniffer to enable promiscuous mode?Can packets be sniffed without the NIC being in promiscuous mode? No it is not a must and sniffing can be done in non-promiscuous too. Also when in promiscuous mode the NIC accepts all packets which are not addressed to it's MAC address.Does it also mean that it responds to all ...


2

You can check network packets against public Tor node list (for example https://torstatus.blutmagie.de/) using WireShark or any other packet sniffing software.


2

According to the paper "WhatsApp network forensics: Decrypting and understanding the WhatsApp call signaling messages" from 2015 WhatsApp does not use HTTP(S) but: WhatsApp uses the FunXMPP protocol for message exchange which is a binary-efficient encoded Extensible Messaging and Presence Protocol (XMPP) Which means that you will not be able to ...


2

SSL/TLS encryption is done end-to-end, meaning only each end can successfully decrypt the session. The point of it being that Wireshark, or other network capture/sniffing tools, cannot eavesdrop on the data contained. In a LAN or corporate environment, SSL interception looks like this: Client workstations tries to go to https://somesite. Inspection ...


2

The difficulties involved in passively intercepting mobile telephone signals can be summed up as follows: Capturing the signals Analyzing the traffic Decrypting the traffic Capturing the signals on the downlink (base station to mobile) is relatively straightforward. You have to be in range of the transmitter and have a suitable receiver. GSM is a popular ...


2

Yes. You are looking for promiscuous mode or monitor mode. http://security.stackexchange.com/a/37000/28585


2

You need to run in monitor mode; promiscuous mode doesn't always work with Wi-Fi adapters (and may not even be supported for Wi-Fi on some OSes or with some Wi-Fi adapters). Whether Wireshark can do it by itself depends on the OS. On OS X, it can; on Linux, it could, in theory, but for complicated reasons it can't, on most if not all distributions, in ...


2

Depends. If the server responded to the PHP Easter eggs they found out you're on PHP. Now they're probably running through a list of common PHP frameworks looking for those URLs. You need to make sure those URLs aren't able to be accessed by anyone other than yourself and your predefined IP address in the .htaccess file. Otherwise they'll eventually find the ...


2

Short Answer: Mostly Likely Not. Your Traffic will be encrypted. However, it is possible to read the data by other means. If the sniffer is some type of malware on either your machine or the receiving end as it could view the data before the payload is encrypted or after its de-capsulated. If the attacker obtained the SSL certificate and is performing ...


1

You can passively determine the operating system by figuring out TTL's and Window Sizes from analyzing Wireshark packet captures. These two sites may at least get you started: http://www.netresec.com/?page=Blog&month=2011-11&post=Passive-OS-Fingerprinting ...


1

Mark's answer is correct regarding the HTTPS and packet capture. To answer your second question: While the traffic is encrypted, that does not guarantee that the messages themselves are encrypted. It may be possible for someone else to recover and read your messages off the chat server. This is a much less likely vector, but it may be possible for the chat ...


1

It's hard to say what your definition of "OK" is, but generally, I'd say, no, you're not ok with your current setup. I'll cover your points individually. The data being transferred is strongly encrypted. This is good. In other words, you could put the file with a download link up on a public website. If you trust the encryption, then your data is ...



Only top voted, non community-wiki answers of a minimum length are eligible