Tag Info

Hot answers tagged

21

This is because in an SSL/TLS connection the asymmetric key exchange uses the server's public key to exchange the pre-master secret. A client certificate is only used for client authentication if the server requests it. The pre-master secret is what's used to generate the session keys. This is why you need the server's private key, not the client's. ...


12

The keylogger looks to be sending email using Gmail but the SMTP communication is encrypted with TLS (SSL). Simple Mail Transfer Protocol Command Line: STARTTLS\r\n Command: STAR Request parameter: TLS Simple Mail Transfer Protocol Response: 220 2.0.0 Ready to start TLS\r\n Response code: <domain> Service ready (220) ...


11

The thing about passive sniffing is that you don't get other people's network traffic unless you're either in a position to see that traffic due to network topology (e.g. you're sniffing a trunk port) or are doing network spoofing (e.g. ARP spoofing) that causes packets to be sent to your device. If they're doing the latter, you just need to look out for ...


7

A key log file created by the NSS library, you can use it for decrypting SSL traffic. Find the (Pre)-Master-Secret log filename option at Edit -> Preferences, Protocols -> SSL or pass the -o ssl.key_logfile:/absolute/path/to/keys.log to wireshark. I originally found this trick in this blog entry which described the use of the environment variable ...


6

Looking at the packet capture you've got there, it looks like your computer is rejecting the connection attempts (the port unreachable messages), so it's not necessarily that there's something running on your system causing the traffic, more that other computer are trying to reach you. What's apparent though is that there's no firewall restricting access ...


6

If by remote you mean "on my local LAN but not me" then the answer is possibly; If by remote you mean "on a remote LAN" then the answer is "No, not with Wireshark." You'd be looking for something like a network probe with RMON capabilities. You could use a Span or Mirrored port as Lucas points out or you could force the switch to begin forwarding packets ...


6

Capture filters work when the capture is taking place. It tells Wireshark which packets to capture and save to a pcap file. Display filters works on already captured network traffic. It's simply a filter to that tells Wireshark which packets to display.


6

There's two ways to decrypt SSL traffic in-transit: The first is to have the private key of the server. If you have that, you can feed it to wireshark which will do the rest. There are a handful of dedicated tools for this as well. But it can't be done without the server's private key. The second is to MITM the connection. Fiddler will do this, as ...


6

You can technically start sniffing away without "connecting" to the network. Terry is correct, if the network is open (no encryption, WEP/WPA/WPA2) then you can just "Join" the network and sniff the traffic. However, you do not need to join the network to sniff the traffic. WLANs use radio frequencies, all you have to do is match the freq (channel) and ...


5

It looks like you should be able to easily pull the cookies from your pcaps with Wireshark or tshark using filters based around HTTP Cookies. You should be able to match against http.cookie as a string according to the filters protocol reference: http://www.wireshark.org/docs/dfref/h/http.html Some more general information about filter syntax (including ...


5

If an attacker roots a system they can install drivers which will hide malicious traffic from sniffers like wireshark, tools like netstat, or process utilities like task manager or PS. An attacker could have keyloggers, spam bots, ddos tools, anything they like running on a system and even administrators would be completely oblivious unless they ran an ...


5

The private key is private to the webserver. If you don't control the webserver you shouldn't be able to obtain it. The certificate only holds the public key so it wouldn't be of much use to you. You could try to setup a proxy https server and do a man-in-the-middle attack - in that case you would have the key of your proxy server. Are you trying to crack ...


5

Because client uses server public key for encrypting communication during phase 4 of negotiation (wikipedia) : 4 - Using all data generated in the handshake thus far, the client (with the cooperation of the server, depending on the cipher in use) creates the pre-master secret for the session, encrypts it with the server's public key (obtained from ...


4

It seems there is nothing wrong with uTorrent protocol. These are incomming connections, but as you mentioned before you don't have any Torrent client running. Did you have it before? Torrent clients try to open a connection with you if your IP was in their cache, so basically they are knocking at your closed door.


4

If you can "expose the premaster secret", though the key exchange uses ephemeral Diffie-Hellman, then you have privileged access to either the client or the server. That's one of the points of DHE: the actual key exchange uses newly generated DH key pairs, which neither client or server stores anywhere except in its own RAM. Having a copy of the permanent ...


4

The first step in any sort of MITM attack on a network is connecting to the network. With a wired network, that involves somehow connecting your machine to the network through the use of an Ethernet cable. With a wireless network, you just need to connect to the network.. well, wirelessly. Without a requiring a password to connect to a wireless network, ...


4

Generally speaking, unless there's something specific that prevents them from doing so, then they can. Legally speaking, a contract might make this disallowed, but it's very unlikely that this would be in your contract. Similarly, local privacy laws might protect you. Either way, it's lawyer time - but how will you ever know? Technically speaking, ...


4

Are you sure that the data in the capture is sensitive data? If it's the MAC address that you are worried about, I can assure you that it is not sensitive, and not useful at all to any potential attacker. MAC addresses are not traceable nor are they used for any kind of authentication (besides WIFI whitelists, which would require the technician to actually ...


3

You're misinterpreting the categorization. **[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]** [Message: HTTP/1.1 200 OK\r\n] [Severity level: Chat] Other things that might show up there are "note", "warn", and "error". If this were expanded to two words, it would be protocol chat. What this is pointing out is that this packet ...


3

If your switch supports port mirroring, I would definitely go that route. Port mirroring will essentially duplicate all traffic coming through the switch, and send it to a single port. You would then want to connect a machine to this port and run whichever packet capturing tool (such as Wireshark) for analysis. I wouldn't want to go with the ARP poisoning ...


3

Meaning their data can't be sniffed. Is it possible to do so? How would they do it? One plausible way of accomplishing this is encrypting the data before sending it out. To the perspective of the packet sniffer, the data will appear as an encrypted stream without knowing what actually is being sent. The server receiving the data stream can then decrypt ...


3

Network traffic can be either unicast or broadcast (or multicast, but that's not relevant right now.) NBNS (NetBIOS Name Service) is broadcast, so the switch (your wireless "router" in this case) has a responsibility to deliver it to every host "attached" to it. Most other traffic is unicast, which means the switch should send it directly to the recipient. ...


3

There is no way to do that unless you can monitor the installed programs on your users´ PCs with a software like EMCO Software scanner.


3

Wireshark is a very powerful tool. In most cases, the (addon-less) debug consoles of the browsers firefox and chrome should be enough. Both have network monitors that are sufficient most time. Be aware that the firefox' monitor doesn't support websockets yet. If you still wanted to use wireshark, then consider utilizing the SSLKEYLOGFILE file, more help at ...


3

This is a configuration issue with the database. Most modern databases offer transport encryption, though many are not enabled by default. Here are some links for setting up SSL on popular SQL databases: 6.3.6 Using SSL for Secure Connections How to enable SSL encryption for an instance of SQL Server by using Microsoft Management Console


3

Cracking that tunnel is a non-trivial exercise. The short answer is that key store is located in the file /private/var/keybags/systembag.kb and retrieved with the kernel service called AppleEffaceableStorage under the locker tag \BAG1. This is the architecture: The keys themselves are further encrypted and checksummed using AES and HMAC. It would be a big ...


3

I am not an expert of how Gmail login works, but I am guessing it relies on cookies, which are normal HTTP headers. In SPDY, HTTP headers are gzip compressed in the SYN_STREAM frame on a per-connection basis (not per-frame), and that is why you cannot search for strings representing header values like you can do with plain HTTP. Wireshark has a SPDY plugin ...


2

If you are connecting through a local proxy you should normally still be able to sniff all your own outgoing packets.


2

The source-address tab represents the address the packet claims it is coming from. Be adviced that this can be easily spoofed so it may in fact not be the actual sender of the packet. In your case it may not be trivial to know who all the IP addresses are. However if they are not RFC1918 (private IP addresses) you can run them through a geoip service to ...


2

I believe most of the answers you seek are in the analysis by Mike Pilkington presented at SANS Forensics and IR Summit – June, 2011: Blog posts: http://www.dshield.org/diary.html?storyid=11173 and http://computer-forensics.sans.org/blog/2010/06/01/protecting-admin-passwords-remote-response-forensics/ PDF of presentation slides: ...



Only top voted, non community-wiki answers of a minimum length are eligible