Questions tagged [wireshark]
Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.
337
questions
1
vote
1
answer
55
views
Decrypt SSL with Wireshark supported browsers
I've been following the guide:
https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/
Using it for chrome and Safari on MacOS does not populate any keys in the file, Did browsers stop keys ...
- 11
1
vote
2
answers
174
views
Decrypting network traffic and finding HTTPS private key
I've been battling with one school task for couple days and can't seem to find any idea how to solve it. The task is pretty simple:
Log in to the server using SSH. The answer to the task is in ...
- 75
2
votes
1
answer
82
views
Capturing packets in an android application or ios application?
I've an android and ios app. They run on the same application server on Linux. I want to capture the packets when users are trying to log in to the app. How do I proceed? I'm thinking of doing it with ...
- 21
2
votes
1
answer
44
views
DHE key exchange with p value 257 bytes but a pubkey of 256 bytes
I came across a packet capture in Wireshark where p length = 257 bytes and pubkey length = 256 bytes. See the ServerKeyExchange snip below:
Diffie-Hellman Server Params
p Length: 257
p: ...
- 23
0
votes
0
answers
83
views
Wireshark can't decrypt TLS from a specific python library
I have a problem. I'm using Wireshark 4.0.8. I created my ssl file to store my "(pre)-master-secrets". I can thus decrypt TLS from my browser or from different python libraries without ...
- 1
0
votes
0
answers
75
views
How can I verify that my DoS attack is effective?
I was trying to simulate a DoS attack on the CORE network emulator using hping3 (Ubuntu). The topology is like three PCs connected by a router. The client's IP is 10.0.0.20/24, The server's IP is 10.0....
0
votes
0
answers
42
views
Is it normal for Apple push notifications to use the IRC protocol?
Seeing traffic like this on my network and wondering if it’s normal to see IRC being used in macOS push notifications and if anyone has any idea what the apparently escaped code (based on all of the ...
- 133
1
vote
0
answers
134
views
Wireshark decrypt TLS 1.2 from WCF client
I have managed to decrypt TLS 1.2 data using Wireshark on a connection from the browser to the WCF service, but cannot manage to do the same with the WCF client.
I'm not sure what is the difference, ...
- 11
0
votes
1
answer
246
views
Does wireshark detect all unauthorized access?
A security engineer told me that my computer must have a trojan horse, but it has not been found yet.
The security engineer captured and analyzed traffic pcap files with Wireshark, and said that there ...
1
vote
0
answers
44
views
What is sequence number and why is it used as the ACK number for the next ACK packet? [closed]
I am currently trying to learn the TCP session creating (3 way handshake) process in detail. I was wondering what the sequence number means and also why is the ack num for the next ACK packet always ...
- 11
1
vote
2
answers
220
views
What are some symptoms of malware exfiltrating data in packet captures?
I am concerned that my Linux laptop has been compromised with malware that is remotely and regularly monitoring my activity. I ran Wireshark for a day to see if I could find any symptoms of data being ...
- 11
0
votes
0
answers
163
views
Using Wireshark to detect Evil Twin attack in a private wireless network
I wanted to learn what would be the best way(s) to detect an Evil Twin attack on a private network. I see a lot of literature about detecting the attack in a public setting, which seems to make the ...
- 83
0
votes
1
answer
66
views
For a proper traffic analysis between 2 computers, does wireshark need to be on a third laptop or just one of the two?
Looking at a situation where two machines use a secure communication protocol like this:
Machine (or a VM) A <--------> Machine (or a VM) B
and I want to use Wireshark to capture the traffic ...
- 180
1
vote
1
answer
1k
views
SNI visible in HTTP/3, QUIC connection?
Client Hello should be encrypted in HTTP/3 and QUIC, but in Wireshark I can still see SNI of the QUIC connection when using DoH.
The names should be encrypted inside the Handshake/CRYPTO packets.
is ...
user285140
1
vote
0
answers
308
views
ISP-provided router sending constant ARP requests
A few weeks ago I changed my ISP provider and router at home. It is a small network (less than 10 devices). From a user perspective everything seems to work correctly, nothing notable.
However, today ...
- 11
0
votes
0
answers
3k
views
How to decrypt a tls1.3 tcp packets in wireshark
I generated the public and private key with
openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout server_key.pem -out cert.pem
and I am using c sockets for the server and client with openssl, ...
- 1
-2
votes
2
answers
294
views
Can a connection stay hidden from Wireshark?
I'm monitoring my home network with Wireshark, since I believe my computer is being actively hacked. I looked up a LOT of IP addresses, but didn't find any suspicious ones.
Can a connection be hidden ...
- 39
1
vote
1
answer
602
views
0
votes
0
answers
49
views
Is SSL necessary when sending password to a API from a server?
I have bought a online service which allows me to send SMS messages by making a call to the provider's SOAP-API.
This is the WSDL I need to send a message:
<?xml version="1.0"?>
<...
- 2,770
-2
votes
1
answer
183
views
Trying to decrypt my home network
I've put my wireless card in monitor mode following this tutorial. After that, I started monitor my wifi home and, after a few seconds, I stop it. Every packet was crypted (obviously), so I follow ...
- 99
0
votes
0
answers
1k
views
Wireshark Output | [Malformed Packet: Laplink: length of contained item exceeds length of containing item] from Russian IP
While running some traces for one of our production servers, an interesting item kept popping up in our Wireshark:
[Malformed Packet: Laplink: length of contained item exceeds length of containing ...
- 1,237
4
votes
1
answer
3k
views
Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?
We are using IIS on Windows 2012-R2 server to host dotnet apps. From the app, when we try connecting to an external 3rd party api we see TLS handshake failure. On running ssllabs test on that api, I ...
-1
votes
1
answer
1k
views
Can the usage of Wireshark be detected when sniffing for packets in promiscuous mode? [duplicate]
I know that port scanning can set off IDS systems on certain networks due to the suspicious traffic it generates. Can the usage of Wireshark be detected on a network? If so, will using it set off any ...
1
vote
1
answer
1k
views
How to extract Kerberos ticket from Wireshark?
I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
- 79
2
votes
1
answer
2k
views
How to decrypt HTTPS traffic with tshark when I have the .key and .crt file?
I have my domain .key and .crt file.
the key file include "-----BEGIN PRIVATE KEY-----"
when i use command on centos:
tshark -r /tmp/xx.pcap -o 'ssl.keys_list:any,443,http,/tmp/private.key' -...
- 23
15
votes
3
answers
4k
views
Can an HTTPS request be sent twice?
When sniffing network traffic, one can see an HTTPS packet and all its (encrypted) data.
I am wondering what would happen if this packet is copied and then re-sent.
Is there a protocol at some layer ...
- 161
0
votes
1
answer
531
views
Can't find anomalies / abnormalities in wireshark capture
Previous post was deleted for not enough context, which I apologise for. I will try to provide as much context as I can. I am aware this appears to be an example of a SYN flood attack with spoofed ip ...
0
votes
2
answers
425
views
Using Hydra not sending traffic to target VM
I have 3 VM's
1 with Ubuntu server version 20.04, apache2, php, mysql and DVWA. (10.0.2.4)
1 with Ubuntu client version 20.04 with hydra installed. (10.0.2.5)
1 with Kali 2021.3. (10.0.2.6)
All VM's ...
- 111
0
votes
0
answers
995
views
Running ARP Spoof disables internet access on target machine, doesn't intercept traffic as well
So I'm learning to run MITM attacks on my own WiFi network but I seem to be running into an issue. I'm following this tutorial.
The process is simple and I'm running the attack from my Ubuntu laptop. ...
- 101
0
votes
0
answers
126
views
Sending meaningless Addresses requests to a series of malicious IPs
i was testing somethings on browsers(It has nothing to do with what I am going to say) and accidentally i faced a case that when i browse meaningless addresses like abc/ signortest/ word/
the request ...
- 101
1
vote
0
answers
140
views
Detecting and understanding malware/spyware [closed]
Recently, stumbled upon the new FB 500m+ leak and decided to satisfy my curiosity and poke around.
Basically just wanted to see how 500m+ user records were kept and what info was released( it was ...
- 11
0
votes
0
answers
207
views
Do iPhones still send packets when they are completely shutdown?
Do iPhones (or just a smart phones in general) send packets when they are fully shutdown? I have heard that they do, but I have not been able to verify such a claim. In an effort to investigate, I ARP ...
- 1
1
vote
0
answers
268
views
How to extract Wireshark keylog from a Java JSSE TLSv1.3 Session
Is it possible to extract the Wireshark keylog information directly from the TLSv1.3 handshake in a Java app? If so, how do I map the fields, or is additional material not shared in the handshake ...
- 111
1
vote
0
answers
78
views
How does one label malicious traffic in generated workloads?
I have been writing on some code that automatically puts together differently parameterized attacks of common pen testing tools, i.e. sqlmap, nmap, patator etc. These attacks are then launched against ...
- 111
0
votes
2
answers
2k
views
How to know whether mysql connection is using SSL or TLS connection?
I want to verify whether mysql remote connection is using tls/ssl connection for security purposes.
I ran status command to check initially:
mysql> status
--------------
mysql Ver 8.0.19 for osx10....
4
votes
2
answers
874
views
Wireshark - How to monitor TLS traffic from a malware? (It does not write into the SSLKEYLOGFILE)
I recently found malware that uses TLS 1.2 to communicate with the c2 server.
I wanted to check the content of that but is encrypted. I have tried the method with the SSLKEYLOGFILE but unlike for ...
- 41
1
vote
1
answer
2k
views
How to decrypt TLS traffic originating from a Windows service on my Windows 10 PC?
Some months ago I bought a peripheral device for my Windows 10 computer (think of something like a game controller). My home router has a function that allows it to capture all incoming and outgoing ...
- 141
1
vote
1
answer
326
views
Did Wireshark capture an update of Adobe Acrobat Reader over an unencrypted connection?
My home router is an AVM FritzBox and it's able to log all incoming and outgoing traffic in a file format readable by Wireshark. Some days ago I started capturing all traffic for about an hour to get ...
- 141
0
votes
1
answer
1k
views
Can I elicit responses from "any remote host" on "all protocols" if I want to?
An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”.
After some research, this is something that can be exploited.
It is explained here that:
By default, WSDAPI will listen ...
- 11
2
votes
0
answers
1k
views
How to fix TCP stream in Wireshark with spurious retransmission?
This was for a CTF (it ended yesterday, so I'm not cheating), but I've spent so many hours on it that I really just want to understand what I should have done.
Here is the PasteBin Hex Dump. I ...
- 121
1
vote
1
answer
3k
views
Can't see data packets when capturing in monitor mode
On Kali Linux, I have an Atheros wireless adapater. I'm trying to capture data packets off the air and decrypt them as an exercise. The problem is that when I turn on the wifi monitor mode and choose ...
- 21
2
votes
3
answers
3k
views
Intercept HTTP Traffic of an android app?
I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
- 131
1
vote
0
answers
977
views
Is it possible to decrypt TLS traffic through OpenSSL?
I have a web server that uses the ECDHE-RSA-AES256-GCM-SHA384 cipher suite. I noticed that when given the "(Pre)-master-secret log" file (generated by the browser), Wireshark is able to ...
- 11
1
vote
1
answer
2k
views
why wireshark shows tls1.2 but it's actually tls1.0
Why does Wireshark show tls1.2 but it's actually tls1.0?
and sometimes, in almost the same situation it shows tlsV1
- 147
1
vote
0
answers
811
views
Wireshark how do I see data from a phone on the same network
So I am wondering how can I see the data on wireshark?
I have my router setup to where there is no password so I can automatically connect whatever devices on to my network.
First I connect my phone ...
- 11
0
votes
2
answers
604
views
Does HSTS prevent packet capturing in Wireshark
If a site is enforcing HSTS, does that prevent packet capturing of a GET requests in Wireshark?
If it prevents it, is it possible to achieve the same using Bettercap or any other alternatives?
...
- 197
0
votes
1
answer
2k
views
Locate WhatsApp message destination [duplicate]
I've been interested in message tracing, so I played a bit with Cisco's Packet Tracer and Wireshark.
Is it possible to locate the destination IP of a message (packages) been sent via WhatsApp? I am ...
- 1
0
votes
0
answers
47
views
Is possible to use promiscuous mode to sniff traffic between to devices connected by WiFi from another using Wireshark? [duplicate]
I've been read a lot about it, but I'm not 100% sure about it. The most clear response I've found is https://security.stackexchange.com/a/167845/163215
So, according to this, in this scenario:
I ...
- 1
0
votes
2
answers
123
views
Unfamiliar user agents 'CON 1.0 urlexists' and 'VANILLA 1.0 vanillastub' - are they malicious?
I'm analyzing a pcap via Wireshark, and there are multiple get requests to the IP. These requests use different user agents, which I can't find anything about when I search. The user agents:
CON 1.0 ...
0
votes
0
answers
243
views
TLS Session ID from Client's First Visit
Why would a client send a TLS session ID (96b839ce3aadb65780923d28a3e7e767fc5bddc507884a7e70e506d8b85a06d3 on its first visit to a server/website? My understanding is that the client would include a ...
- 101