how can you view an HTTP request in transit?

Question

In Google Chrome, sometimes you will see the https: protocol in the URL bar with a red strike through it. Clicking on the info button says that not all elements on the page are encrypted, and may be viewed by others while in transit.

My question is: how can one view any/all requests while in transit? I have read a little about HTTP sniffers, but those seem to be inspecting incoming/outgoing requests from your own machine. How can you intercept a request out in the ether, in a particular network?

Answer 1

Packet Sniffers

Packet sniffers allow you to see everything that is travelling on the network. Wireshark is the most popular and free and is easy to download and install.

With a packet sniffer, you can read in plaintext anything that is not encrypted.

These require that you have access to the network where the communication is coming from (either server or host). You cannot read packets on a network that you do not have access to. That is why you have heard that they read what is coming from your own computer.

But, it is possible to gain access to other networks. Wifi (public or hacked private) is a popular and easy means of gaining access to other's network traffic. Some attackers go to great lengths to physically install sniffers in corporate networks so that they can access this type of data.

HTTPS

HTTPS encrypts information between a browser and the server so that sniffers cannot read the actual content of the communication. For a site that has a mix of HTTP and HTTPS content, parts of the communication will be readable, and some will not.

Testing

This is easy to test. Download and install Wireshark and start a capture. Then launch a web browser and navigate to a website that is not HTTPS. Stop the Wireshark capture, then look through the data. You will find the actual text of the website in the capture.

Try again on an HTTPS website (google, for instance) and you will see that you cannot read the text from the website.

Now try the whole process on a mixed website, and you will see what is encrypted and what is not. It is possible that ads and other 3rd party content has not been encrypted, for instance.

Impacts

Packet sniffers are the technical tools, but pre-packaged hacking tools use packet sniffers built into themselves to read this information and format it for malicious uses. Firesheep is the currently famous tool that can hijack someone's connection to Facebook and Twitter.

Answer 2

In order to capture packets "out in the ether" you need to be able to control the endpoint or the medium in which the communication is operating. In the case of wired connections, you need to control the server, switch, router, etc, or tap into the line directly. In the case of wifi, you can use wireshark as @schroeder has mentioned coupled with your wifi card. The problem here is that if the wifi router uses encryption, then without effort you will only be able to see your own traffic.

As for your own usage, depending on your operating system, you might find Fiddler2 to be a much lighter-weight and easier to use/understand debugging proxy for Windows. Start it up and Chrome should automatically use it. All requests can go through there. And to top it all off, you can introduce an SSL certificate to allow you to decrypt your HTTPS sessions.

Answer 3

A slight aside, but in the OP's specific case of viewing a web page in chrome: you can hit f12, or ctrl-shift-i to bring up the developers tools and click on the network tab. Refresh the page to see a list of all network requests made by the browser. Click an individual request in the list to see details of that request.

Answer 4

You can use any packet sniffer that you are comfortable with, the main feature allowing you to listen all packets at Ether belonging to your network is Listening in Promiscuous Mode.

Normally, tools like Wireshark allow to listen in promiscuous mode at ethrent w/o any external config. But even if its not working, you can search for your NIC to be configured in promiscuous mode (given it supports that).

Answer 5

Can I suggest using scapy for this?

I have a post on Stack Overflow talking about how to do this. Not sure how much programming experience you have but this solution should be plug and play after you get Scapy and Python installed on the box.

What this will provide is an easier and quick snapshot of each and every http request you make on your box without needing to stop and drill down into a packet.

Please see Stack Overflow post about the same subject..

Answer 6

I think the best way understand how easy is to sniff HTTP traffic is read about Firesheep

With WiFi access you don't need to seat on the wire any more.

Answer 7

Another great tool that hasn't been recommended is mitmproxy.

It lets you:

• Intercept and modify HTTP traffic on the fly
• Save HTTP conversations for later replay and analysis
• Replay both HTTP clients and servers
• Make scripted changes to HTTP traffic using Python
• SSL interception certs generated on the fly

Answer 8

What you are looking for is a man in the middle attack.

A man in the middle attack is when someone between you an the server is reading/modifying your communication.

Some know methods of archiving this is:

Arp-spoofing: arp-spoofing is used on local network to insert you in the communication between your target and your gateway to the internet. Cain and abel is a tool that can do this and can also find passwords and usernames from unencrypted connections.

DNS-spoofing: a URL like www.google.com translates to a IP by DNS. So if you control the DNS you control where all URL points. So then you point all sites to your computer and make it act like a proxy.