I guess that this is a dumb question, but i really thought for a longtime that the wireless sniffing attack consists of listening to all the packets that get over the air, but apparently it isn't that, cause no matter how I try, i can only see my traffic with wireshark (even in promiscuous mode).
So what is the wireless sniffing attack, how is it done, and what is the damage that it can do.
PS : I've tried wireshark both on Ubuntu 15.10 (with Linux version > 4), and on Windows 7.
So what is the wireless sniffing attack
It is capturing packets (recording some traffic) that traverse your wireless network, without you knowing about it.
how is it done
You need a network card that supports monitor mode, an OS and version that properly supports delivering traffic captured in monitor mode, and drivers that properly support it. Linux is your best bet here.
In this mode, your wireless card will receive packets without having to be associated to an AP. It will capture all traffic it hears on a given Wifi channel. Other STAs or APs won't know this is happening.
This is different than promiscuous mode - a wireless NIC has to be associated before promiscuous mode will work. Monitor mode has no such requirement.
what is the damage that it can do
Collect valid MAC addresses to bypass SSID hiding.
Passively and undetectably collect data needed to break WEP/WPA (not WPA2) encryption.
Receive all data transmitted/received on open networks/networks without encryption, with the ability to read any plaintext information.
So lets say you got an normal wifi network with wpa 2 encryption.
First you need to ensure your card is in monitor mode and listening on the channel the AP is transmitting on.
Now you are going to capture all the packets. But they won't make sense since they are encrypted But then you will of course say I got the key well you do but the key is only used to encrypt the 4 way handshake which occurs when a client associates with the ap after that the client and the AP encrypt the traffic with what is stated in the 4way handshake.
So what you need to do is to capture the 4 way handshake. This can be done easily with wireshark. But you need to wait for somebody to connect to the AP so that you can capture this 4 way handshake.
This would take a long time good thing there is this awesome toolkit made by mistrx called aircrack-Ng which allows you to do mess around with wifi and even deauthenticate sombody which are authenticated making the handshake occur again.
What you do is this Aireplay-Ng -0 1 -a [mac of ap] -c [mac to deauth] (name of wifi card)
You should have wireshark running already for this
You should then or even before go to (in wireshark) Edit->prefrences->protocols->iee 802.11 and ad your keys If you have any difficulty You could follow this
https://wiki.wireshark.org/HowToDecrypt802.11
Stay safe
