Tag Info

Hot answers tagged

33

With HTTPS the path and query string of the URL is encrypted, while the hostname is visible inside the SSL handshake as plain text if the client uses Server Name Indication (SNI). All modern clients use SNI because this is the only way to have different hosts with their own certificates behind the same IP address. The rest of the URL (i.e. everything but ...


25

This is because in an SSL/TLS connection the asymmetric key exchange uses the server's public key to exchange the pre-master secret. A client certificate is only used for client authentication if the server requests it. The pre-master secret is what's used to generate the session keys. This is why you need the server's private key, not the client's. ...


14

The keylogger looks to be sending email using Gmail but the SMTP communication is encrypted with TLS (SSL). Simple Mail Transfer Protocol Command Line: STARTTLS\r\n Command: STAR Request parameter: TLS Simple Mail Transfer Protocol Response: 220 2.0.0 Ready to start TLS\r\n Response code: <domain> Service ready (220) ...


14

Some background: Wireshark supports decryption of SSL sessions when you provide the private RSA key of the server. This works for cipher suites using a RSA key exchange where the pre-master secret is encrypted using the RSA public key of the server. For ephemeral Diffie-Hellman (DHE) cipher suites, the RSA public key is only used for signing the DH ...


11

The thing about passive sniffing is that you don't get other people's network traffic unless you're either in a position to see that traffic due to network topology (e.g. you're sniffing a trunk port) or are doing network spoofing (e.g. ARP spoofing) that causes packets to be sent to your device. If they're doing the latter, you just need to look out for ...


10

Both HTTP headers (containing requested URL) and application data in HTTPS is encrypted. You can see requested hostname, because browsers send it in Service Name Indication extension during handshake, so that server can choose matching SSL certificate.


9

As you guessed, Facebook uses HTTPS, what that means is that requests to Facebook.com regardless of whether they are GET or POST requests are not sent over HTTP, instead they are sent over HTTPS in an encrypted form which the 'http' filter in Wireshark wont be able to display as regular HTTP requests. If you want to view the encrypted HTTPS traffic including ...


7

There's two ways to decrypt SSL traffic in-transit: The first is to have the private key of the server. If you have that, you can feed it to wireshark which will do the rest. There are a handful of dedicated tools for this as well. But it can't be done without the server's private key. The second is to MITM the connection. Fiddler will do this, as ...


7

If by remote you mean "on my local LAN but not me" then the answer is possibly; If by remote you mean "on a remote LAN" then the answer is "No, not with Wireshark." You'd be looking for something like a network probe with RMON capabilities. You could use a Span or Mirrored port as Lucas points out or you could force the switch to begin forwarding packets ...


7

Using wireshark, you will be able to find out the host name, as mentioned by some other answers, due to SNI. Also, you'll be able to see some parts of certificates. The https URLs you've seen were probably the URLs of CRLs or OCSPs. If someone could get at your URLs by walking your site, and compare the size of the returned pages with the size of what's ...


6

Capture filters work when the capture is taking place. It tells Wireshark which packets to capture and save to a pcap file. Display filters works on already captured network traffic. It's simply a filter to that tells Wireshark which packets to display.


6

Looking at the packet capture you've got there, it looks like your computer is rejecting the connection attempts (the port unreachable messages), so it's not necessarily that there's something running on your system causing the traffic, more that other computer are trying to reach you. What's apparent though is that there's no firewall restricting access ...


6

If you can "expose the premaster secret", though the key exchange uses ephemeral Diffie-Hellman, then you have privileged access to either the client or the server. That's one of the points of DHE: the actual key exchange uses newly generated DH key pairs, which neither client or server stores anywhere except in its own RAM. Having a copy of the permanent ...


6

You can technically start sniffing away without "connecting" to the network. Terry is correct, if the network is open (no encryption, WEP/WPA/WPA2) then you can just "Join" the network and sniff the traffic. However, you do not need to join the network to sniff the traffic. WLANs use radio frequencies, all you have to do is match the freq (channel) and ...


6

I think it largely depends on what else you were doing at the time you created the capture. For example, if you were browsing the web, then obviously people would be able to see what websites you were visiting and the content of any unencrypted pages. If you were logging in to something that does not use encryption (for example, telnet, FTP, or a non HTTPS ...


6

In the Internet Protocol Version 4, the address 0.0.0.0 is a non-routable meta-address used to designate an invalid, unknown or non-applicable target. To give a special meaning to an otherwise invalid piece of data is an application of in-band signaling. In the context of servers, 0.0.0.0 means "all IPv4 addresses on the local machine". If a ...


5

It looks like you should be able to easily pull the cookies from your pcaps with Wireshark or tshark using filters based around HTTP Cookies. You should be able to match against http.cookie as a string according to the filters protocol reference: http://www.wireshark.org/docs/dfref/h/http.html Some more general information about filter syntax (including ...


5

If an attacker roots a system they can install drivers which will hide malicious traffic from sniffers like wireshark, tools like netstat, or process utilities like task manager or PS. An attacker could have keyloggers, spam bots, ddos tools, anything they like running on a system and even administrators would be completely oblivious unless they ran an ...


5

Wireshark is a very powerful tool. In most cases, the (addon-less) debug consoles of the browsers firefox and chrome should be enough. Both have network monitors that are sufficient most time. Be aware that the firefox' monitor doesn't support websockets yet. If you still wanted to use wireshark, then consider utilizing the SSLKEYLOGFILE file, more help at ...


5

The private key is private to the webserver. If you don't control the webserver you shouldn't be able to obtain it. The certificate only holds the public key so it wouldn't be of much use to you. You could try to setup a proxy https server and do a man-in-the-middle attack - in that case you would have the key of your proxy server. Are you trying to crack ...


5

Because client uses server public key for encrypting communication during phase 4 of negotiation (wikipedia) : 4 - Using all data generated in the handshake thus far, the client (with the cooperation of the server, depending on the cipher in use) creates the pre-master secret for the session, encrypts it with the server's public key (obtained from ...


5

Are you sure that the data in the capture is sensitive data? If it's the MAC address that you are worried about, I can assure you that it is not sensitive, and not useful at all to any potential attacker. MAC addresses are not traceable nor are they used for any kind of authentication (besides WIFI whitelists, which would require the technician to actually ...


5

What this screenshot wants to demonstrate, is that the SYN-ACK and the following packets have different TTLs (Time-To-Live). Each TCP packet has a TTL counter which starts at a specific value when a packet leaves a host and gets decremented by every router which forwards the packet. The payload having a lower TTL than the SYN-ACK packet means that it passed ...


4

The first step in any sort of MITM attack on a network is connecting to the network. With a wired network, that involves somehow connecting your machine to the network through the use of an Ethernet cable. With a wireless network, you just need to connect to the network.. well, wirelessly. Without a requiring a password to connect to a wireless network, ...


4

It seems there is nothing wrong with uTorrent protocol. These are incomming connections, but as you mentioned before you don't have any Torrent client running. Did you have it before? Torrent clients try to open a connection with you if your IP was in their cache, so basically they are knocking at your closed door.


4

Generally speaking, unless there's something specific that prevents them from doing so, then they can. Legally speaking, a contract might make this disallowed, but it's very unlikely that this would be in your contract. Similarly, local privacy laws might protect you. Either way, it's lawyer time - but how will you ever know? Technically speaking, ...


4

That first IP at least is owned by a Russian telecom: Address lookup canonical name broadband-46-18-200-212.clients.kubtel.ru. aliases addresses 46.18.200.212 Queried whois.ripn.net with "kubtel.ru"... domain: KUBTEL.RU And considering that many IP addresses are being checked for ICMP in less than 3 seconds, I would say that ...


4

There are several possibilities here: A tab in Firefox has a website that keeps connecting and refreshing an internal IP address. That might be a home NAS appliance that by coincidence has the same IP with your computer A Javascript script from a legitimate website attempts to scan the internal network using Cross Origin Requests or WebSockets. This ...


3

You're misinterpreting the categorization. **[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]** [Message: HTTP/1.1 200 OK\r\n] [Severity level: Chat] Other things that might show up there are "note", "warn", and "error". If this were expanded to two words, it would be protocol chat. What this is pointing out is that this packet ...


3

If your switch supports port mirroring, I would definitely go that route. Port mirroring will essentially duplicate all traffic coming through the switch, and send it to a single port. You would then want to connect a machine to this port and run whichever packet capturing tool (such as Wireshark) for analysis. I wouldn't want to go with the ARP poisoning ...



Only top voted, non community-wiki answers of a minimum length are eligible