0

Whenever you visit a website without HTTPS (because for whatever reason there are still quite a few of them even in 2022) typically the browser will announce that you should not enter any sensitive information since it can get sniffed by third parties. Can somebody explain to me how exactly that happens and what software one would use for such a purpose? Must the sniffer be somebody 'close' to you (i.e. local network / ISP / ... ) or could it be basically anyone from the world?

I tried to search on the internet for the subject but couldn't quite find anything concrete.

1
  • 4
    "I tried to search on the internet for the subject but couldn't quite find anything concrete." - no idea how concrete you like it but searching for sniff web traffic results in lots of useful information. "or could it be basically anyone from the world?" - one need to be in the path of the traffic in order to sniff the traffic. Jan 19, 2022 at 14:43

1 Answer 1

1

how exactly that happens and what software one would use for such a purpose?

Once they're in the traffic path (the http traffic is flowing through equipment they control), there are tons of tools available. Unencrypted traffic can now be seen just like a text file. You could try this yourself with plain old tcpdump (or wireshark if you want a gui) and then cat or notepad to just look at the plain text (or use the wireshark gui). There are tools that make this easier, mitmproxy, fiddler etc are some examples but there are hundreds.

or could it be basically anyone from the world?

Yes, it could be anywhere in the world. As @Steffen Ullrich commented, someone just needs to be in the traffic path, this doesnt really have to relate to physical location at all. An attacker could already be in the path (ISP, school, office, ISP, server host etc), or they could steer traffic to themselves - ARP poison (probably needs to be done from the same local network as you), DNS forgery, Proxy Autoconfig - web search for methods/tools/mitigations for this.

5
  • Thanks, edited to be more targeted. The question is "how can someone see unencrypted traffic" - I figured tcpdump is in the same box as wireshark, or even lower, as a super basic tool - you dont need to install anything fancy. The others are just examples of tools that answer the same question "how can someone see unencrypted traffic". The MITM can read and change traffic - the "change" part was just an additional note. ARP poisoning requires that you are in the same broadcast domain no? This could be over a badly configured WAN joining networks on different continents. Jan 19, 2022 at 16:34
  • The edit is clearer. And that would have to be a horribly configured WAN with so many other issues for ARP poisoning to work over WAN. I'm not sure that I would include it practically.
    – schroeder
    Jan 19, 2022 at 16:37
  • How about we agree to "no, the attacker doesnt need to be in spitting distance from you, ARP probably means they're on the same local network, but there are many other ways of forcing your traffic to go via the attacker that are global" :) Jan 19, 2022 at 16:39
  • I'd go for that
    – schroeder
    Jan 19, 2022 at 16:41
  • BGP hijiacking could be used as well (not very stealthy however). Another option would be for the attacker to attacker the user modem/router (eg. using a CSRF or DNS rebinding attack to internal administration interface of the modem/router).
    – ysdx
    Jan 23, 2022 at 21:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .