Tag Info

Hot answers tagged

11

The keylogger looks to be sending email using Gmail but the SMTP communication is encrypted with TLS (SSL). Simple Mail Transfer Protocol Command Line: STARTTLS\r\n Command: STAR Request parameter: TLS Simple Mail Transfer Protocol Response: 220 2.0.0 Ready to start TLS\r\n Response code: <domain> Service ready (220) ...


10

The thing about passive sniffing is that you don't get other people's network traffic unless you're either in a position to see that traffic due to network topology (e.g. you're sniffing a trunk port) or are doing network spoofing (e.g. ARP spoofing) that causes packets to be sent to your device. If they're doing the latter, you just need to look out for ...


6

If by remote you mean "on my local LAN but not me" then the answer is possibly; If by remote you mean "on a remote LAN" then the answer is "No, not with Wireshark." You'd be looking for something like a network probe with RMON capabilities. You could use a Span or Mirrored port as Lucas points out or you could force the switch to begin forwarding packets ...


6

You can technically start sniffing away without "connecting" to the network. Terry is correct, if the network is open (no encryption, WEP/WPA/WPA2) then you can just "Join" the network and sniff the traffic. However, you do not need to join the network to sniff the traffic. WLANs use radio frequencies, all you have to do is match the freq (channel) and ...


6

Looking at the packet capture you've got there, it looks like your computer is rejecting the connection attempts (the port unreachable messages), so it's not necessarily that there's something running on your system causing the traffic, more that other computer are trying to reach you. What's apparent though is that there's no firewall restricting access ...


6

There's two ways to decrypt SSL traffic in-transit: The first is to have the private key of the server. If you have that, you can feed it to wireshark which will do the rest. There are a handful of dedicated tools for this as well. But it can't be done without the server's private key. The second is to MITM the connection. Fiddler will do this, as ...


5

It looks like you should be able to easily pull the cookies from your pcaps with Wireshark or tshark using filters based around HTTP Cookies. You should be able to match against http.cookie as a string according to the filters protocol reference: http://www.wireshark.org/docs/dfref/h/http.html Some more general information about filter syntax (including ...


4

It seems there is nothing wrong with uTorrent protocol. These are incomming connections, but as you mentioned before you don't have any Torrent client running. Did you have it before? Torrent clients try to open a connection with you if your IP was in their cache, so basically they are knocking at your closed door.


4

The first step in any sort of MITM attack on a network is connecting to the network. With a wired network, that involves somehow connecting your machine to the network through the use of an Ethernet cable. With a wireless network, you just need to connect to the network.. well, wirelessly. Without a requiring a password to connect to a wireless network, ...


4

If you can "expose the premaster secret", though the key exchange uses ephemeral Diffie-Hellman, then you have privileged access to either the client or the server. That's one of the points of DHE: the actual key exchange uses newly generated DH key pairs, which neither client or server stores anywhere except in its own RAM. Having a copy of the permanent ...


3

If your switch supports port mirroring, I would definitely go that route. Port mirroring will essentially duplicate all traffic coming through the switch, and send it to a single port. You would then want to connect a machine to this port and run whichever packet capturing tool (such as Wireshark) for analysis. I wouldn't want to go with the ARP poisoning ...


3

You're misinterpreting the categorization. **[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]** [Message: HTTP/1.1 200 OK\r\n] [Severity level: Chat] Other things that might show up there are "note", "warn", and "error". If this were expanded to two words, it would be protocol chat. What this is pointing out is that this packet ...


3

Generally speaking, unless there's something specific that prevents them from doing so, then they can. Legally speaking, a contract might make this disallowed, but it's very unlikely that this would be in your contract. Similarly, local privacy laws might protect you. Either way, it's lawyer time - but how will you ever know? Technically speaking, ...


3

Meaning their data can't be sniffed. Is it possible to do so? How would they do it? One plausible way of accomplishing this is encrypting the data before sending it out. To the perspective of the packet sniffer, the data will appear as an encrypted stream without knowing what actually is being sent. The server receiving the data stream can then decrypt ...


3

Network traffic can be either unicast or broadcast (or multicast, but that's not relevant right now.) NBNS (NetBIOS Name Service) is broadcast, so the switch (your wireless "router" in this case) has a responsibility to deliver it to every host "attached" to it. Most other traffic is unicast, which means the switch should send it directly to the recipient. ...


2

The source-address tab represents the address the packet claims it is coming from. Be adviced that this can be easily spoofed so it may in fact not be the actual sender of the packet. In your case it may not be trivial to know who all the IP addresses are. However if they are not RFC1918 (private IP addresses) you can run them through a geoip service to ...


2

I believe most of the answers you seek are in the analysis by Mike Pilkington presented at SANS Forensics and IR Summit – June, 2011: Blog posts: http://www.dshield.org/diary.html?storyid=11173 and http://computer-forensics.sans.org/blog/2010/06/01/protecting-admin-passwords-remote-response-forensics/ PDF of presentation slides: ...


2

The Whole != thing doesn't work very well. If you notice your expression filter text area is yellow when you do that. Try this instead. !(tcp.dstport == 3389) && !(tcp.srcport == 3389) I recommend reading the wireshark user guide. Section 6.4.4 specifically references the problem you had. User Guide -- Filter Section


2

You could try HTTP proxy debugger such as fiddler and Burp Suite, because HTTPS also send data over SSL layer, which is the same as your custom protocol over SSL layer. The proxy debuggers use man-in-the-middle approach so you must set Fiddler's certificate to be trusted by the client. You don't need to generate a certificate by using this approach.


2

If you are using a span port on a switch or something similar (hub, wifi), then you can see all traffic. In wireshark you can then set a display filter like: ip.src == 10.43.54.65 or ip.dst == 10.43.54.65


2

A key log file created by the NSS library, you can use it for decrypting SSL traffic. Find the (Pre)-Master-Secret log filename option at Edit -> Preferences, Protocols -> SSL or pass the -o ssl.key_logfile:/absolute/path/to/keys.log to wireshark. I originally found this trick in this blog entry which described the use of the environment variable ...


2

Ooops !!! You cannot do that . Why ? You cannot Decrypt the wireshark dump without having the Private key corresponding to the server's ssl certificate. If you do have the SSL certificate's corresponding private key , then with the latest wireshark . Goto Edit-> Preferences -> Protocol -> SSL --> RSA KeysList -> Edit , provide the server IP , Protocol as ...


2

What does the hex dump say? In general, 8-bit and non-printables are printed as '.' by most viewers. Pretty much like this (just on a Linux prompt though): $ echo H€llo | hd 00000000 48 e2 82 ac 6c 6c 6f 0a |H...llo.| 00000008 And here is an example of how to decode the hex: $ perl -ne 'chomp; s/ //g; print pack("H".length, ...


2

Enable SCHANNEL logging; http://support.microsoft.com/kb/260729 The following will log everything; Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL] "EventLogging"=dword:00000007 You will then have events in the SYSTEM log for example; An SSL client handshake completed successfully. ...


2

If an attacker roots a system they can install drivers which will hide malicious traffic from sniffers like wireshark, tools like netstat, or process utilities like task manager or PS. An attacker could have keyloggers, spam bots, ddos tools, anything they like running on a system and even administrators would be completely oblivious unless they ran an ...


2

Are you looking to monitor packets between your computer as a client on the network and the router and other wireless clients and the router? If you're using windows, it looks like the answer is yes: you'll need to purchase Airpcap. http://ask.wireshark.org/questions/8504/supported-adapters-for-wireless-packet-capturing If you're attempting to monitor at ...


1

With SSL Bump, Squid runs a Man-in-the-Middle attack between the client and the server; it poses as a fake server with a fake certificate when talking to the client, and as a fake client when talking to the true SSL server. Squid thus obtains all the data. If you want to see what Squid sees, then it seems that the best option would be to simply ask Squid to ...


1

A gratuitous ARP is basically an ARP response that never had a request for it and is how most ARP spoofing programs work. Normally you send an ARP request and wait for the ARP response. A gratuitous ARP is when you just send your details even though there was no request. These can happen legitimately when say your IP or MAC address change so you can update ...


1

There are two type of filter in wireshark: Display Filter Capture Filter Display filter is filter introduced by wireshark. It's user friendly, powerful and many things to filter. It has modular form. For example,filter to display HTTP Post is: http.request.method=POST Wireshark loads packet first, and then apply display filter. So it is applied in ...


1

Check the session data (source and destination IP address, source and destination port, volume and date&time) to find more about the traffic. Run netstat -tunap to see which process are making established network traffic. You can then have a better idea which program made the above request. This could also cause of GTalk widget if you are using one on ...



Only top voted, non community-wiki answers of a minimum length are eligible