Questions tagged [sniffing]
A sniffer is a program that monitors and analyzes network traffic.
176
questions
51
votes
2
answers
74k
views
Why is it possible to sniff an HTTPS / SSL request?
I'm new to the realm of HTTP requests and security and all that good stuff, but from what I've read, if you want your requests and responses encrypted, use HTTPS and SSL, and you'll be good. Someone ...
- 611
27
votes
3
answers
7k
views
Firebug appears to be decrypting SSL traffic: is it the correct behaviour?
In my company we were writing a small web application which would be hosted and tested under HSTS protocol.
One of my tester complained that the username and password can be seen in cleartext so it ...
- 5,107
24
votes
3
answers
7k
views
How to deal with WPE users
I own a chat room and some users use a program Winsock Packet Editor, "WPE PRO".
With it they manage to bypass chat rules, like they can't be muted or kicked, and they can send messages fast ...
- 381
24
votes
2
answers
5k
views
Is telnet secure through SSH tunneling
Firstly sorry, maybe dumb question, but I have one service running on my server which can be operated only by telnet (port 23), but I know that telnet is insecure, so I blocked port 23 in iptables ...
- 389
14
votes
6
answers
4k
views
How can a user defend against session hijacking?
Given a website with various security flaws, one of them is session hijacking, session token continuously being sent as an argument over unsecured HTTP. In my field it's not surprising that others ...
- 2,154
12
votes
4
answers
8k
views
Eavesdropping vs. sniffing
I'm taking a coursera course, and they take pains when talking about network security to distinguish between eavesdropping and sniffing.
According to their definitions, sniffing involves reading or ...
- 243
12
votes
4
answers
5k
views
Can someone use WiFi snooping to see data I send through Tor Browser when I'm not using SSL?
(NOTE: I've read other similar questions, but I'm not at all certain about this, therefore I'm asking.)
I travel a lot, and I generally use public WiFi spots and hotels/hostels/boarding houses etc. ...
- 121
10
votes
3
answers
4k
views
Can network traffic between Docker containers be sniffed?
On normal networks, it is a security risk to send plaintext data, since attackers can sniff or even manipulate all traffic. Encryption is required for secure communication. When using Docker ...
- 29.6k
9
votes
1
answer
1k
views
Hacking/Sniffing/recording GSM like Karsten Nohl
For a course at college, I wanted to reproduce the attack on GSM shown in this video by Karsten Nohl: https://www.youtube.com/watch?v=0hjn-BP8nro.
From what I understand he used an USRP radio to ...
- 91
8
votes
2
answers
12k
views
Is promiscuous mode sufficient to sniff packets in a wifi network?
I'm connected to my WiFi network and I want to capture and analyze packets that other clients are exchanging with the gateway. I don't want to modify the content of these packets and I don't need to ...
user113574
6
votes
2
answers
2k
views
Sniffing unencrypted traffic in datacenter
Please explain how is it possible to sniff packets from within the datacenter.
Some background. I am studying networking options for DigitalOcean. My goal is to make sure that data exchange between ...
- 163
6
votes
2
answers
2k
views
Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP
I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers.
Most questions I see here about man-...
- 105
6
votes
1
answer
4k
views
Sniffing WhatsApp Traffic
I was wondering if its possible to obtain private keys for Whatsapp to be able to sniff traffic between two WhatsApp Android devices (both under my control). I understand that WhatsApp traffic is now ...
- 257
5
votes
3
answers
4k
views
Why aren't TCP sockets encrypted by default?
I've been wondering this for as long as I've been programming, Why aren't TCP sockets encrypted by default? Everyone always says that using raw sockets is dangerous as all packets sent are susceptible ...
- 882
5
votes
2
answers
413
views
Why isn't a standard for encrypted but open WiFi developed?
With passwordless public WiFi hotspots, it's easy to demonstrate that packets can be sniffed and (in the case of non-HTTPS traffic) private information gained. While the long-term solution would be to ...
- 161
5
votes
2
answers
3k
views
What does WPA2 traffic look like to a packet sniffer that is not connected to the network?
Imagine there is a wireless network using WPA2, and an attacker has come along with his wireless card in monitor mode. What will the packets from that network look like? Is any information disclosed i....
- 83
5
votes
3
answers
3k
views
What are the advantages and disadvantages of using a HackRF One compared to specific protocol sniffers?
I am performing some research on IoT test tools and came across the HackRF One which can transmit and receive from 1 MHz to 6 GHz. I therefore think that it can analyze many protocols, but I cannot ...
- 187
5
votes
1
answer
2k
views
Unable to obtain TCP/HTTP traffic from WPA2 packets even with full handshake and decryption
The Problem
On my WPA2 network, I have been successfully able to get intercept a full four-message EAPOL handshake from a particular computer on my network. It is my understanding that with this ...
- 235
5
votes
1
answer
2k
views
Where would I place a sniffer to capture data in a home network with the following topology?
I am aware of the various techniques that there are to sniff around a network that has Hubs or Switches (port mirroring, hubbing out, use of taps), but I am not sure which method would be more ...
- 649
5
votes
1
answer
1k
views
ARP poison on divided network (every PC in it's own subnet)
Let's say that we have a room with a router and 30 PC's plugged in. Every PC has it's own 'subnet'. If we check for available hosts via ettercap/wireshark (on any PC), it only discoveres two hosts: ...
- 61
5
votes
1
answer
277
views
Are there any products/techniques for low-effort DSL sniffing?
Inspired by the "can my neighbour listen to my phonecalls" question, I'd like to ask what would be required for an attacker to snoop on an ADSL connection given physical access to the wire (so, "...
- 827
4
votes
3
answers
339
views
I just found out I have unknowingly been sending a password not using SSL, how likely is it that I have been compromised?
I just realized that I have been connecting (sending user name and password) to my production MongoDB database for several weeks using MongoChef (a database GUI) without the SSL option enabled. I ...
- 43
4
votes
4
answers
2k
views
Sniff packets of a wired computer
in my home network my own PC is connected with a wire to the router. I want to do some analysis on the packets so I got an old laptop and tried to sniff my PC packets with the laptop (that is ...
- 41
4
votes
1
answer
158
views
Would it be possible for an ISP to guess specific requests on an HTTPS site using package size? [duplicate]
In light of the recent senate decision in the US to allow ISPs to sell users' browsing history, I've been reading of recommendations on how users can retain their privacy. One of the common ...
- 204
4
votes
1
answer
5k
views
How can I exploit a web application if content sniffing is not disabled?
I just come across one of the customer's website for penetration testing having JSON callback reflecting the user input in the response body.
like this:
https://example.com/somepage?callback=<...
- 313
4
votes
1
answer
816
views
Is there a reason why ARP spoofing would be used for spying instead of sniffing promiscuously?
I am a student trying to demonstrate an ARP spoofing attack. To test whether my attack was working I decided to use wireshark to sniff the packets on the attacking machine. At first I thought I was ...
- 143
4
votes
1
answer
404
views
Can smart power meters read key presses on a wired keyboard?
Smart power meters are becoming quite prevalent. Question: Can a smart power meter (with patched firmware) read the keys pressed on a wired PS/2 or USB keyboard, connected to a desktop computer? What ...
- 205
4
votes
0
answers
132
views
Can I detect unique identifiers from random radio chatter?
I am trying to find out if I can uniquely identify smartphones (I would like to find constant identifiers such as IMEI) by passively sniffing the cellular data frequencies.
I know that sensitive data ...
- 565
3
votes
2
answers
1k
views
How to identify L2 devices in a Wide Area Network?
This is sample of a traceroute to google.com:
TraceRoute from Network-Tools.com to 216.58.194.46 [google.com]
Hop (ms) (ms) (ms) IP Address Host name
1 0 0 0 ...
- 1,627
3
votes
2
answers
2k
views
Does someone need to be connected to my network to sniff HTTP requests?
TL;DR Would a potential attacker need to have my Wi-Fi password and be connected to my network in order to read HTTP requests?
Over the past year or so, I have made a few DIY home automation projects....
- 205
3
votes
2
answers
496
views
Do VPNs even protect ftp and virtual machine connections?
I have to go out of town and stay in a hotel.
During these days I will also have to work on some websites code and VMs that call external APIs.
Not being a system administrator nor a security ...
- 271
3
votes
1
answer
15k
views
Google Drive photo security and publicly visible lh*.googleusercontent.com
I thought Google Drive was more secure than this.
If I upload a photo to Google Drive, I don't care that it's entrusted to them and I also assume someone working there can look at it. No big deal. ...
- 133
3
votes
2
answers
4k
views
How to intercepting iOS HTTPS traffic
How can I intercept & parse through the SSL traffic (incoming & outgoing) generated by my iPad application?
- 1,769
3
votes
1
answer
1k
views
Is eavesdropping possible over smpp?
I don't know much about the SMPP protocol, but I often hear that it is not a secure protocol.
If Alice sends a SMS to Bob, can Eve view what Alice sent to him? If yes, can you give an example on how ...
- 91
3
votes
1
answer
1k
views
Is a Captive Portal Wifi AP as insecure as an open unencrypted Wifi?
As far as I understand, the captive portal is implemented by some sort of iptable firewall rules. Since there is no handshake established during the initial association with the AP(As no passphrase is ...
- 439
3
votes
2
answers
678
views
Counter measures against traffic sniffing inside a LAN
Here's the problematic I'm stuck with, in the next months I'm going to move in, in a little house in France. For the network connectivity the house owner decides to buy a single internet connection.
...
- 41
3
votes
4
answers
2k
views
Can I set up a 3g/4g Connection Proxy for Table/Phone App Pen Testing?
I would like to set up a testing environment for smartphone and tablet apps that can intercept 3g/4g communications and provide a traffic dump. I'd like to see all the 3g/4g traffic coming from, or ...
- 1,844
3
votes
1
answer
2k
views
Network packet obfuscation
Suppose I am wirelessly transmitting network traffic between a computer and a router. As I understand it, even though the traffic is encrypted, it is possible for a third party attacker to intercept ...
- 133
3
votes
1
answer
16k
views
Wireshark - How to see the domain of HTTPS websites visited
How can I see the domain name of https websites that are visited on my network? I know I'm not able to see the full url, just the websites ip or domain. I think it my be possible with a reverse dns ...
- 31
3
votes
1
answer
2k
views
How to redirect someone packets connected over the same wifi into my computer using Wireshark? [closed]
I am using Windows 10. I just installed Wireshark 2.2.1. I am connected over a wifi network with security type WPA2-Personal. Many people are connected on this same network.
I have the password of ...
- 31
3
votes
1
answer
636
views
Security onion only Seeing broadcast traffic and its own traffic
I am attempting to test my new security onion install. I have it set up on a static IP Ethernet adapter in a virtual machine with an IP of 10.0.3.47
When I go launch Sguill, it seems to work well ...
- 133
3
votes
1
answer
523
views
Detecting unusual network activity
I have a small business network consisting of ca. 15 devices, a few switches and a two routers. Recently it occurred to me that all the security measures I have been doing are not very productive: I ...
- 133
3
votes
1
answer
2k
views
Securely read encryption key from NVRAM of TPM 1.2
I have configured a disk encryption in linux using LUKS with TPM with secure boot.
The encryption key is loaded from TPM from NV memory using command TPM_NV_ReadValueAuth.
The problem is that it is ...
- 1,119
3
votes
1
answer
2k
views
Can't decrypt captured HTTP connection from WPA Network
Hi I am attempting to sniff HTTP packet traffic using Wireshark on Kali Linux. I have added my wpa-pwd correctly to the IEEE 802.11 protocol and enabled "decryption".
Currently I can only view the ...
- 33
3
votes
3
answers
4k
views
How to sniff 802.11 packets without going into monitor mode?
Is it possible to sniff or capture 802.11 packets which sends my computer to the router (AP). I know that I can't sniff packets which have a other destination MAC address without going into monitor ...
- 159
2
votes
2
answers
183
views
Is using a network sniffer for host discovery a viable option?
Would a packet sniffer like tcpdump be effective for network host discovery and if so how effective is it compared to more active methods such as the infamous network mapper nmap?
- 23
2
votes
2
answers
2k
views
Data sniffing on a WEP 128-bit encryption
I am relatively new to cybersecurity and hacking and I aim to learn ethical hacking as a passion alongside my mainstream education(Electrical Engineering).
My setup: I have set up my very own WEP ...
- 121
2
votes
1
answer
4k
views
What does SSI signal does mean in captured packets in wireshark?
In the packet captured below, captured by wireshark
does the SSI Signal in dBm represents the power at which the sniffing network adapter (say USB network adapter wlan1 on Raspberry Pi3) received ...
- 145
2
votes
1
answer
4k
views
Intercepting TCP traffic through MITM attack
I'm trying to capture TCP requests through Burp Suite with this hacky method.
Basically it listens for user selected protocol requests (TCP/UDP) and then forwards them to Burp Suite (or any other ...
- 43
2
votes
3
answers
4k
views
Is there any point of arp spoofing on a wifi network?
I know that arp spoofing is required on a LAN network due to the fact that data is sent directly to a destination, but what about for a WLAN network? All packets can be seen if you are in promiscuous ...
user227237