6

So people always talk about how if you use http over a shared wifi hotspot, people will be able to see your unencrypted data, but I have never been able to make the direct connection from a network security standpoint. I would like to know how to intercept such data and how to view it in a form that is usable. If I connect to a wifi spot and get Wireshark to listen on wlan0 (wireless interface), is this going to be sufficient to view everyone else's traffic? It would seem that when another user on that lan navigates to a website, they will maybe send a broadcast/arp to everyone, but I don't see how their http traffic would ever go through my wlan interface when it would be destined for the default gateway?

Secondly, wireshark has a lot of sporadic meta data that goes passing through. I know of a unix security tool called dsniff that is supposed to render only password data (not http in partcular) and this is the only tool I have found to render useful data like http traffic. Are there any better tools for this?

Improve this question

3 Answers 3

Reset to default
13

You may be having difficultly because it's not a network based interception of http, it's a radio based interception of data at layer 1 (physical).

Essentially, on a wired network:

  • Layer 1 (physical): Copper or fiber wires and physical devices (NIC, GBIC, switch, router, firewall).
    • Interception at Layer 1 (i.e. using port mirroring on a switch to direct a copy of all traffic on Port X to Port A(ttacker) is quite simple, but requires physical access at some level (access to the cable in Port A, at a minimum).
  • Layer 7 (application): HTTP or HTTPS
  • Once Layer 1 has been compromised, HTTP traffic is completely available. HTTPS traffic is not; additional protections are provided by HTTPS.

On an 802.11a/b/g/n/ac Wifi network:

  • Layer 1 (physical): Radio waves being broadcast from one antenna, which induce current in every antenna they're in range on (where range depends on both the inverse square law as well as the receiving equipment's sensitivity, gain, and losses).

  • Interception at Layer 1 can be done by anyone who can manage to get a "good enough" signal to their receiving hardware.

    • Higher sensitivity receiving hardware has a lower bar to the "good enough" standard.
    • Using a poorly designed or implemented antenna (your belt buckle) requires a stronger signal than using a well designed and implemented antenna (a properly calculated antenna tuned specifically for the frequency in use, with a very short run of low loss cable, matched impedance, etc.).

  • Layer 2 (data link): WPA/WPA2, if enabled, provide protections here by encrypting the payload of 802.11 frames.

  • Layer 7 (application): HTTP or HTTPS
  • Once Layer 1 has been compromised, if there is no encryption at Layer 2, or if that encryption has been defeated, HTTP traffic is completely available. HTTPS traffic is not; additional protections are provided by HTTPS.

Wireshark is quite capable of using a wide variety of Wifi cards in monitor mode ("promiscuous" mode in wired NICs) if the OS lets it, which Linux does much more easily than Windows.

If you want to see this ON YOUR OWN WIFI NETWORK ONLY (see local, regional, and national laws in your location), try a Kali (previously known as Backtrack) LiveCD. Or buy an AirPcap wifi adapter. Or use many USB Wifi adapters in a Linux (Kali or other) guest OS in a VM on your Windows host. Use either Wireshark or Airodump-ng.

For Wireshark, further details are available at the Wireshark CaptureSetup/WLAN page.

For Airodump-ng, part of the Aircrack-ng suite, information is available at pages like the Aircrack-ng FAQ "What is the best wireless card to buy" page.

Improve this answer
1
  • Titles or executive summaries for each network type would make this answer much easier to read.
    – problemofficer - n.f. Monica
    Jun 30, 2017 at 5:26
8

Your wireless card needs to run in 'promiscuous' mode. Only a few can and work with wireshark, but they are known.

In a switched LAN environment, you would only see broadcast traffic from other users, like you say, but in a wifi environment, there is no switch and everyone sees everything. Each wifi device is broadcasting over the air.

Wireshark is the best tool, you just need the correct filters to limit what you see to what you want to see.

Improve this answer
2

Think a bit outside the box. What's WLAN in hardware? A pair of antennas broadcasting and receiving. Where is that antenna at your device sending to? Directionally to the hotspot? No, it is sending everywhere, in every direction, hoping the hotspot picks it up. When the network doesn't use a password, this signal is unencrypted. All you need to eavesdrop is an antenna in the general area.

Improve this answer
1
  • 1
    I think schroeder's answer is little clearer in explaining how that data is available most easily to a common person. Your answer is right but still makes it sound non-trivial to get to cracking traffic. An antenna isn't easy to use unless it's connected to a wireless card that you can put in promiscuous mode and filter the data. (Which isn't too hard, thus why people should be careful on wireless).
    – pacifist
    Mar 27, 2014 at 23:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .