Tag Info

Hot answers tagged

11

The keylogger looks to be sending email using Gmail but the SMTP communication is encrypted with TLS (SSL). Simple Mail Transfer Protocol Command Line: STARTTLS\r\n Command: STAR Request parameter: TLS Simple Mail Transfer Protocol Response: 220 2.0.0 Ready to start TLS\r\n Response code: <domain> Service ready (220) ...


10

The thing about passive sniffing is that you don't get other people's network traffic unless you're either in a position to see that traffic due to network topology (e.g. you're sniffing a trunk port) or are doing network spoofing (e.g. ARP spoofing) that causes packets to be sent to your device. If they're doing the latter, you just need to look out for ...


6

Looking at the packet capture you've got there, it looks like your computer is rejecting the connection attempts (the port unreachable messages), so it's not necessarily that there's something running on your system causing the traffic, more that other computer are trying to reach you. What's apparent though is that there's no firewall restricting access ...


6

If by remote you mean "on my local LAN but not me" then the answer is possibly; If by remote you mean "on a remote LAN" then the answer is "No, not with Wireshark." You'd be looking for something like a network probe with RMON capabilities. You could use a Span or Mirrored port as Lucas points out or you could force the switch to begin forwarding packets ...


6

Capture filters work when the capture is taking place. It tells Wireshark which packets to capture and save to a pcap file. Display filters works on already captured network traffic. It's simply a filter to that tells Wireshark which packets to display.


6

There's two ways to decrypt SSL traffic in-transit: The first is to have the private key of the server. If you have that, you can feed it to wireshark which will do the rest. There are a handful of dedicated tools for this as well. But it can't be done without the server's private key. The second is to MITM the connection. Fiddler will do this, as ...


6

You can technically start sniffing away without "connecting" to the network. Terry is correct, if the network is open (no encryption, WEP/WPA/WPA2) then you can just "Join" the network and sniff the traffic. However, you do not need to join the network to sniff the traffic. WLANs use radio frequencies, all you have to do is match the freq (channel) and ...


5

It looks like you should be able to easily pull the cookies from your pcaps with Wireshark or tshark using filters based around HTTP Cookies. You should be able to match against http.cookie as a string according to the filters protocol reference: http://www.wireshark.org/docs/dfref/h/http.html Some more general information about filter syntax (including ...


5

If an attacker roots a system they can install drivers which will hide malicious traffic from sniffers like wireshark, tools like netstat, or process utilities like task manager or PS. An attacker could have keyloggers, spam bots, ddos tools, anything they like running on a system and even administrators would be completely oblivious unless they ran an ...


4

It seems there is nothing wrong with uTorrent protocol. These are incomming connections, but as you mentioned before you don't have any Torrent client running. Did you have it before? Torrent clients try to open a connection with you if your IP was in their cache, so basically they are knocking at your closed door.


4

If you can "expose the premaster secret", though the key exchange uses ephemeral Diffie-Hellman, then you have privileged access to either the client or the server. That's one of the points of DHE: the actual key exchange uses newly generated DH key pairs, which neither client or server stores anywhere except in its own RAM. Having a copy of the permanent ...


4

The first step in any sort of MITM attack on a network is connecting to the network. With a wired network, that involves somehow connecting your machine to the network through the use of an Ethernet cable. With a wireless network, you just need to connect to the network.. well, wirelessly. Without a requiring a password to connect to a wireless network, ...


4

A key log file created by the NSS library, you can use it for decrypting SSL traffic. Find the (Pre)-Master-Secret log filename option at Edit -> Preferences, Protocols -> SSL or pass the -o ssl.key_logfile:/absolute/path/to/keys.log to wireshark. I originally found this trick in this blog entry which described the use of the environment variable ...


3

You're misinterpreting the categorization. **[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]** [Message: HTTP/1.1 200 OK\r\n] [Severity level: Chat] Other things that might show up there are "note", "warn", and "error". If this were expanded to two words, it would be protocol chat. What this is pointing out is that this packet ...


3

If your switch supports port mirroring, I would definitely go that route. Port mirroring will essentially duplicate all traffic coming through the switch, and send it to a single port. You would then want to connect a machine to this port and run whichever packet capturing tool (such as Wireshark) for analysis. I wouldn't want to go with the ARP poisoning ...


3

Generally speaking, unless there's something specific that prevents them from doing so, then they can. Legally speaking, a contract might make this disallowed, but it's very unlikely that this would be in your contract. Similarly, local privacy laws might protect you. Either way, it's lawyer time - but how will you ever know? Technically speaking, ...


3

Meaning their data can't be sniffed. Is it possible to do so? How would they do it? One plausible way of accomplishing this is encrypting the data before sending it out. To the perspective of the packet sniffer, the data will appear as an encrypted stream without knowing what actually is being sent. The server receiving the data stream can then decrypt ...


3

Network traffic can be either unicast or broadcast (or multicast, but that's not relevant right now.) NBNS (NetBIOS Name Service) is broadcast, so the switch (your wireless "router" in this case) has a responsibility to deliver it to every host "attached" to it. Most other traffic is unicast, which means the switch should send it directly to the recipient. ...


3

There is no way to do that unless you can monitor the installed programs on your users´ PCs with a software like EMCO Software scanner.


2

If you are connecting through a local proxy you should normally still be able to sniff all your own outgoing packets.


2

The source-address tab represents the address the packet claims it is coming from. Be adviced that this can be easily spoofed so it may in fact not be the actual sender of the packet. In your case it may not be trivial to know who all the IP addresses are. However if they are not RFC1918 (private IP addresses) you can run them through a geoip service to ...


2

I believe most of the answers you seek are in the analysis by Mike Pilkington presented at SANS Forensics and IR Summit – June, 2011: Blog posts: http://www.dshield.org/diary.html?storyid=11173 and http://computer-forensics.sans.org/blog/2010/06/01/protecting-admin-passwords-remote-response-forensics/ PDF of presentation slides: ...


2

You could try HTTP proxy debugger such as fiddler and Burp Suite, because HTTPS also send data over SSL layer, which is the same as your custom protocol over SSL layer. The proxy debuggers use man-in-the-middle approach so you must set Fiddler's certificate to be trusted by the client. You don't need to generate a certificate by using this approach.


2

The Whole != thing doesn't work very well. If you notice your expression filter text area is yellow when you do that. Try this instead. !(tcp.dstport == 3389) && !(tcp.srcport == 3389) I recommend reading the wireshark user guide. Section 6.4.4 specifically references the problem you had. User Guide -- Filter Section


2

Ooops !!! You cannot do that . Why ? You cannot Decrypt the wireshark dump without having the Private key corresponding to the server's ssl certificate. If you do have the SSL certificate's corresponding private key , then with the latest wireshark . Goto Edit-> Preferences -> Protocol -> SSL --> RSA KeysList -> Edit , provide the server IP , Protocol as ...


2

If you are using a span port on a switch or something similar (hub, wifi), then you can see all traffic. In wireshark you can then set a display filter like: ip.src == 10.43.54.65 or ip.dst == 10.43.54.65


2

What does the hex dump say? In general, 8-bit and non-printables are printed as '.' by most viewers. Pretty much like this (just on a Linux prompt though): $ echo H€llo | hd 00000000 48 e2 82 ac 6c 6c 6f 0a |H...llo.| 00000008 And here is an example of how to decode the hex: $ perl -ne 'chomp; s/ //g; print pack("H".length, ...


2

Enable SCHANNEL logging; http://support.microsoft.com/kb/260729 The following will log everything; Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL] "EventLogging"=dword:00000007 You will then have events in the SYSTEM log for example; An SSL client handshake completed successfully. ...


2

Are you looking to monitor packets between your computer as a client on the network and the router and other wireless clients and the router? If you're using windows, it looks like the answer is yes: you'll need to purchase Airpcap. http://ask.wireshark.org/questions/8504/supported-adapters-for-wireless-packet-capturing If you're attempting to monitor at ...


2

Your logs are partial; you don't show all packets. Notably, there cannot be in SSL an "application data" record if a handshake has not been completed, and a complete handshake (abbreviated or not) necessarily contains two "change cipher spec" messages. Also, note that when a system sends several successive handshake messages (as is common for a server: the ...



Only top voted, non community-wiki answers of a minimum length are eligible