3

I created a lab environment which has Windows 7 and Kali Linux in VMware.

In Kali Linux, I opened Wireshark and started to listen to traffic on eth0. After that, in my Windows 7 machine, I opened an HTTP site and entered some login information to that site.

Wireshark was able to capture that login information.

How does Wireshark capture those packets? Windows 7 sent its packets to the router but Wireshark was able to capture them.

I didn't use arpspoof for MITM attack so I didn't trick Windows 7 into thinking the Kali machine was the gateway nor gateway as kali machine is windows 7. So my guess was Wireshark shouldn't capture those packets but it did capture them anyway.

Anybody can tell me why?

Improve this question
0

2 Answers 2

Reset to default
5

This is actually not a security question at all. The question you want to be asking is how one node on a network can see the packets that are not destined for it. For this answer, you need to understand how Ethernet networking works.

Ethernet networks are broadcast networks, meaning that every node on the same segment can see every other node's traffic. No tricks required.

A switch, and a wifi access point acts like a switch, breaks up these broadcast zones (mostly) so that only the nodes that need to talk to each other see the traffic. That's why you need to arp-spoof: you need to trick the victim node to send you the traffic first and then you pass it on to the intended destination.

But without a switch, everyone can see everyone's traffic. So, your Kali's Wireshark could simply and easily see the traffic being sent by the other node. No tricks required.

Improve this answer
16
  • So, because of my vmware environment hasn't got a switch (just router), my wireshark can sniff all packets inside that environment.Then, If I got an environment that has a switch and my victim and attacker machines are in the same VLAN, I needed to use arp-spoof to fool the Windows 7 as I am the router. So with arpspoof, I did change the mac address of router in windows 7's route table and give my mac address instead? Did I understand it correct? Or should I change the MAC address information in switch also?
    – G.Baysec
    Commented Nov 18, 2018 at 17:56
  • You have some language errors there, but it looks like you are correct. Please do some reading on Ethernet, networking, and broadcast zones.
    – schroeder ♦
    Commented Nov 18, 2018 at 17:58
  • Hm your VMware virtual switch should also not flood its ports with packets. How many VMs you had in your lab and on which of them was Wireshark running?
    – eckes
    Commented Nov 18, 2018 at 20:56
  • Routers also break up broadcast zones. But there point is there isn't a virtual switch or router in between Kali's virtual network card, and Windows. So they get to see each others' traffic. I guess VMware did it that way for maximum reliability and performance, because they could have added a virtual switch.
    – Criticizing Israel not allowed
    Commented Nov 19, 2018 at 0:03
  • @eckes I have 2 machines for this lab. One is windows 7 and other is kali linux.
    – G.Baysec
    Commented Nov 19, 2018 at 8:17
0

The reason why Wireshark can capture all packets is because of the NAT environment. IN NAT, VM's in VMware will use the physical adapter. That's the NIC of my computer. So VMware provides the ethernet card to the VM's. Both Windows 7 and kali will use the same ethernet card because VMware points my ethernet card to this VM's for internet access. So when I sniff eth0 from Wireshark, because of windows 7 use the same ethernet card, all packets will be captured by the Wireshark. This lab should be done in bridged-adapter network environment. In that environment, VMware should isolate the NIC's for the VM's. So that, there is a need of arpspoofing in order to capture traffic from kali.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .