I have a new IoT type of device that requires a wifi connection to work. I have no use for the device but I'd like to poke around it and learn more about it.

How should I go about intercepting every packet that goes in and out of the IoT device? Should I use WireShark and connect to the same wifi the device will be using or should I do a MiTM attack?

What are the differences between the WireShark approach and the MiTM approach?

  • You can't decrypt SSL with Wireshark without the private key of the server certificate, but an MiTM will allow you to see the unencrypted traffic given that the device doesn't check for valid certificates. – MadWard Jun 23 '16 at 12:09
  • Does your IoT device support a proxy in the network settings? I've used Fiddler as a proxy for an iPad to inspect HTTP traffic. This won't get every packet but may still help. telerik.com/blogs/using-fiddler-with-apple-ios-devices – user2320464 Jun 23 '16 at 19:08

As MadWard 4 mentioned you can't decrypt the SSL without the private key but sadly most of the IoT devices out there don't use encryption so depending on your device you may in fact be able to see everything anyway and if nothing else you can learn things about where the device is communicating to and its frequency of communication even if SSL is present.

If it's an option I would recommend having a computer act as a wireless access point / router / ad-hoc network and then connect the IoT device to that computers WiFi interface and run wireshark or tshark on that computers wireless interface. The reason for this is you would be in a better place to capture all of the wireless traffic.

  • Yes, this sounds like what I want. The device doesn't have an interface for me to configure anything else than the SSID and key. – springloaded Jun 23 '16 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.