0

How can I see the domain name of https websites that are visited on my network? I know I'm not able to see the full url, just the websites ip or domain. I think it my be possible with a reverse dns lookup, but how can I retrieve the dns address?

Thanks!

2

There are four possible meaning of a server's domain name:

  1. The raw value of the IP address in the IP packet. Check out the Dst value in the IP panel

  2. The result of reverse name lookup on the IP address in the IP packet. Note that a single IP may have multiple domain names attached to it, and some names may not appear in reverse lookup, so this isn't always a reliable way to get the actual domain name used by the user. See: https://osqa-ask.wireshark.org/questions/37680/can-wireshark-automatically-resolve-the-ip-address-into-host-names

  3. The value of the SNI (Server Name Indication) header of the TLS connection. See: https://superuser.com/questions/538130/filter-in-wireshark-for-tlss-server-name-indication-field

  4. If you are able to decrypt the TLS, the Host header of the HTTP request. Note that this value may differ from the domain name in SNI. Use the HTTP panel to see HTTP header values.

  • I would change the order to 3(SNI)-4(Host)-1-2 because the 1(dst) & 2(PTR) are inaccurate methods for finding the domain name. – Esa Jokinen Apr 23 '19 at 5:00
  • @Esa Jokinen: The list wasn't ordered by accuracy, but rather by layers in the TCP/IP or OSI model, as accuracy is subjective. If you ask me which are most accurate though, then IP address is the only reliable value, as it is the only one that cannot be forged (if you try to forge the IP address, the packet will just go to that destination). On the other hand, SNI and Host header can be faked by design. If you send an IP packet through the internet with the IP address of a Yahoo server, but SNI indicating www.google.com and Host header requesting microsoft.com, your packet will arrive at Yahoo – Lie Ryan Apr 23 '19 at 9:51
  • That's all true. So actually the only accurate way to determine the host is to first get it from SNI and then compare whether that hostname has a matching A record for the IP (3+1). The IP alone doesn't tell anything, because there might be multiple sites on the same host. – Esa Jokinen Apr 23 '19 at 11:16
  • That's a good strategy yes. The server could still process a different Host header than what's claimed in SNI, but assuming that your capture doesn't decrypt the HTTP traffic, then that's the next best thing you can do under the given circumstances. – Lie Ryan Apr 23 '19 at 11:50
  • It should work for standard HTTPS traffic i.e. all major browsers. Of course you can circumvent that in non-standard setups. – Esa Jokinen Apr 23 '19 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.