Hot answers tagged

93

If what you describe is true, your chat room is designed badly. The view of the server and what packets it receives should be forwarded to other users should be independent from whatever packets are coming in or going out. Manipulating the traffic on a client should only interfere with that client's view of the chat room, never with other clients. If you ...


50

The short answer: use better chat room software. Your question is lacking details about what kind of chat room program you're using. I am going to assume that it's either a simple client-server model, or a direct peer-to-peer. Either way, you have a sender who types and sends a message, and a receiver (either another client, or a centralized server). From ...


25

Your question is lacking detailed description of what's going on. Therefore, it's impossible to solve the problem you described. However, it might be helpful to point out a different one. If what you described is true, that isn't your problem. Your problem is a much bigger one. Namely that you trust the user. Never trust the user! I assume that you tell ...


5

You have to know what software the administrators are using to sniff the packets, additionally you have to know a vulnerability that is capable of crashing the application. If these requirements apply, the answer to your question is yes. For reference, take a look at past wireshark vulnerabilitys: ...


5

If you sniff on the exit node and the connection is not https/hidden service, then you will have the traffic in clear but you will not be able to know from who it came. Unless the traffic itself is revealing the identity. In other cases, as far as we know, you can't decrypt tor. As other said, tor will be useless if it was possible.


5

Yes. A Harris Stingray, Boeing DRT box, or other cell simulator can intercept SMS messages. These are monitoring devices that have secretly been used by police agencies for over a decade. They come with strict non-disclosure agreements where the agencies that purchase them are not even allowed to acknowledge their existence to the public, and certainly ...


4

You can intercept the traffic by building a bridge between the AP and the uplink. This can be done by using the bridgeutils and two network interfaces. The software side is described here. This will allow you to capture and view all traffic. You can then display the data in wireshark or use a transparent proxy to get the informations you want in a protocol ...


4

You cannot open a remote file with GPG through FTP. Instead you would need to download the file to the local system and open it there. Because of this the decryption will be done only locally (and will be independent from that way the file arrived on the local system) and thus password for the file will thus stay local too.


3

You may not understand https, so I'd like to explain it a little bit. What Happens With HTTPS? Since it uses HTTPS, you generally don't have to worry about packet sniffing if it's properly implemented. With or without HTTPS, the program is not safe from packet sniffing (few things are). Is that a problem? No. Why? Because with properly implemented crypto, ...


3

The NSS SSL Keylog file is a non-obtrusive way to extract SSL session keys from an application using the NSS library for SSL/TLS, but there is no standard way to do the same in all applications. (A generic approach would involve a man in the middle attack, but this is not really non-obtrusive.) The idea of the extracting session keys directly from the ...


3

I presume that by "router", you mean each of these is a "router/NAT/firewall" combination appliance. Most home routers include firewall capabilities, which is most likely what you're relying upon here. (Note that NAT is a connection sharing technology, but not a defense mechanism.) To directly answer your question, if a hacker gets inside your first ...


3

NMAP has a sniffer-detect script built-into it, it's probably the most simple solution out there. I have seen no comparison of the two tools on their effectiveness. Note that all these solutions do is try and find interfaces running promiscuous mode, there are many ways to sniff a network which would leave no traces at all, for instance taps and spans.


2

The difficulties involved in passively intercepting mobile telephone signals can be summed up as follows: Capturing the signals Analyzing the traffic Decrypting the traffic Capturing the signals on the downlink (base station to mobile) is relatively straightforward. You have to be in range of the transmitter and have a suitable receiver. GSM is a popular ...


2

Is it must for a packet sniffer to enable promiscuous mode?Can packets be sniffed without the NIC being in promiscuous mode? No it is not a must and sniffing can be done in non-promiscuous too. Also when in promiscuous mode the NIC accepts all packets which are not addressed to it's MAC address.Does it also mean that it responds to all ...


2

There is a possibility that Promiscuous mode can be detected by another device on the network! You can/must configure your sniffer tool/software so that it doesn't allows to detect if you are in promiscuous mode. For that you have to configure your sniffer tool so that your machine doesn't reply to the packets/requests that are usually used to detect the ...


2

According to the paper "WhatsApp network forensics: Decrypting and understanding the WhatsApp call signaling messages" from 2015 WhatsApp does not use HTTP(S) but: WhatsApp uses the FunXMPP protocol for message exchange which is a binary-efficient encoded Extensible Messaging and Presence Protocol (XMPP) Which means that you will not be able to ...


2

You can not stop user from intercepting the traffic that your application generates. There're following alternatives that you can do for making your application works correctly :- 1) User Secured Connection(SSL/TLS). Although users on the same network will be able to view the network traffic generated, but they'll not able to figure out any meaning out ...


2

Short Answer: Mostly Likely Not. Your Traffic will be encrypted. However, it is possible to read the data by other means. If the sniffer is some type of malware on either your machine or the receiving end as it could view the data before the payload is encrypted or after its de-capsulated. If the attacker obtained the SSL certificate and is performing ...


2

SSL/TLS encryption is done end-to-end, meaning only each end can successfully decrypt the session. The point of it being that Wireshark, or other network capture/sniffing tools, cannot eavesdrop on the data contained. In a LAN or corporate environment, SSL interception looks like this: Client workstations tries to go to https://somesite. Inspection ...


2

Depends. If the server responded to the PHP Easter eggs they found out you're on PHP. Now they're probably running through a list of common PHP frameworks looking for those URLs. You need to make sure those URLs aren't able to be accessed by anyone other than yourself and your predefined IP address in the .htaccess file. Otherwise they'll eventually find the ...


2

You need to run in monitor mode; promiscuous mode doesn't always work with Wi-Fi adapters (and may not even be supported for Wi-Fi on some OSes or with some Wi-Fi adapters). Whether Wireshark can do it by itself depends on the OS. On OS X, it can; on Linux, it could, in theory, but for complicated reasons it can't, on most if not all distributions, in ...


2

Yes. You are looking for promiscuous mode or monitor mode. http://security.stackexchange.com/a/37000/28585


2

With new versions of wireshark: Make sure the traffic is decoded as SSL, i.e. setup the SSL analyzer for this TCP stream in Analyze >> Decode As. Now it will show the SSL details for the packets. Pick the packet which contains the certificate, in this case packet 6. In the packet details expand Secure Socket Layer etc until you get to the certificate ...


1

You can passively determine the operating system by figuring out TTL's and Window Sizes from analyzing Wireshark packet captures. These two sites may at least get you started: http://www.netresec.com/?page=Blog&month=2011-11&post=Passive-OS-Fingerprinting ...


1

Mark's answer is correct regarding the HTTPS and packet capture. To answer your second question: While the traffic is encrypted, that does not guarantee that the messages themselves are encrypted. It may be possible for someone else to recover and read your messages off the chat server. This is a much less likely vector, but it may be possible for the chat ...


1

I have a similar set-up, a whitelisted linux ftp server, receiving an encrypted file in the clear, and have asked similar questions. For one, I have it set up as anonymous, since what is the point of a login in the clear? Second, it is whitelisted, so the only theoretical vulnerability is IP spoofing. I read up on IP spoofing specifically in regard to ftp, ...


1

It's hard to say what your definition of "OK" is, but generally, I'd say, no, you're not ok with your current setup. I'll cover your points individually. The data being transferred is strongly encrypted. This is good. In other words, you could put the file with a download link up on a public website. If you trust the encryption, then your data is ...


1

The best way to mitigate this attack is likely to have good knowledge of the systems on your internal network and control access as much as possible. One common way to address this is to make use of things like 802.1x authentication for endpoints, such that connecting a rogue system to the network will not provide an IP address and the connectivity that ...


1

I am certainly no expert on NTP, so I can't give you a full answer, but: delorean expects you to specify an interface via its IP address, as opposed to the name that is displayed in ifconfig. This was what kept me busy for a couple of hours when I tried the tool ;) Maybe you are having the same issue?


1

Promiscuous mode is a passive state so it cannot be detected by the network on its own. Of course once you start doing your "hacking" actively, the network may detect you but that wouldn't be detection of promiscuous but rather a rogue node. Why? In passive mode the NIC just doesn't drop the packets that would come to it anyway. The dropping is silent so in ...



Only top voted, non community-wiki answers of a minimum length are eligible