Questions tagged [wireshark]

Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

Filter by
Sorted by
Tagged with
1
vote
0answers
53 views

How do I use Npcap? [migrated]

I'm trying to packet capture a remote system using Wireshark on my primarily windows environment. I want to sniff out SMBv1 and HTTP traffic. I've read this was possible using WinPCap, but it's been ...
1
vote
1answer
111 views

How to speed up brute forcing of finding a WEP key from a captured file?

I have been working on decrypting a WEP .cap file using crunch. It has 1268 IVs. I am wondering: Can I get a clue from the captured file to speed the process of brute-forcing? If not, what other ways ...
3
votes
0answers
43 views

Is there an easy way to dissect .NET Remoting traffic for reverse engineering?

I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
1
vote
0answers
59 views

How to decode kerberos tickets on wireshark? [on hold]

It has been two days in a row that I spend hours trying to decrypt kerberos traffic using wireshark. For learning purposes, I want to be able to read the encrypted parts of tickets and authenticators ...
0
votes
0answers
63 views

Is there a way to detect network traffic encrypted by MACsec?

We are going to analyse some traffic on our network. Some streams are encrypted and we know that the encrypted protocols aren't IPsec. We suspect it is using MACsec and we are looking for some way to ...
0
votes
0answers
38 views

Watch Encrypted IMAP Responses

I'm trying to see if I can decipher the messages coming back from Exchange when I try and login via secure IMAP. My office 365 accounts are under attack and I've disabled IMAP (and legacy login) but ...
0
votes
0answers
53 views

Wireshark - capturing website info from other computers [duplicate]

I am trying to find out what websites computers on my network are visiting. Target device is a MacBook Air. I have a Bell Homehub 300 and I'm running Wireshark on Ubuntu Cinnamon 19.1 I'm running ...
0
votes
1answer
30 views

Is it possible to infer advanced cookie properties like expiration from Wireshark

I want to perform a cookie injection attack for demonstration purposes. I could achieve this using Firefox Cookie-Editor extension. However, the attack can only succeed if I enter the cookie name, ...
0
votes
0answers
100 views

Decryption of TLS/SSL Traffic With the debug file of fiddler on wireshark

I wanna decrypt some packets on Wireshark, when I search the Internet, some people were said to use SSLKEYLOGFILE environment, I do the stuff, but it looks like that chorme doesn`t update that file ...
0
votes
1answer
61 views

Intercept network traffic with a hub [on hold]

If I plugged a hub inbetween a switch and firewall, that also had a device running wireshark or similar capture software connected, due to the way a hub operates, would I be able to read ALL of the ...
0
votes
2answers
96 views

Can wireshark capture the exact payload and end point of API used by my Mobile APP?

I was just wondering if someone having total control over his/her network, is running my mobile app. Also wireshark is capturing all requests made using the network. My app is calling API endpoint ...
1
vote
0answers
125 views

Infected usb drives in mice

I bought a mouse on aliexpress. It was reasonably cheap. It works well enough to be on par with a mouse I can buy here for 4 times the price. I know, this is a well known business model, and those ...
2
votes
0answers
99 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
0
votes
0answers
199 views

Wireshark does not decrypt TLS, decrypt tab does not appear

What I did: Setup the env var "SSLKEYLOGFILE" as "C:\ssl-keys.log" and ensure it is valid. Enter its path in Wireshark 3 preferences -> protocols -> tls -> pre-master-secret-log filename -> "C:\ssl-...
0
votes
2answers
231 views

Unable to inject cookies

As part of an exercise, I need to sniff cookies from a login page and inject them in the same login page. If the cookie injection is successful the user must be login without entering the user name ...
0
votes
1answer
165 views

How can I inject cookie from Wireshark into a browser sesson [duplicate]

For education and research purpose, I need to inject a cookie value into my browser to allow me login indirectly (without entering the user name and password). I collected traffic during a login ...
0
votes
1answer
117 views

Wireshark - How to see the domain of HTTPS websites visited

How can I see the domain name of https websites that are visited on my network? I know I'm not able to see the full url, just the websites ip or domain. I think it my be possible with a reverse dns ...
1
vote
1answer
259 views

Capturing traffic on WiFi Network using Wireshark [duplicate]

Is it possible to capture, using Wireshark, regular data sent by another machine inside my Wireless LAN?
1
vote
2answers
155 views

How to analyze .pcap file to write a generic snort rule to detect c&c activity

I am diving into snort and trying to figure out what everything does but I'm having a little trouble. I have a .pcap file I want to analyse and I know there is malicious c&c traffic on it. (...
1
vote
1answer
99 views

Is there a way to change the format of the output from snort?

I'm pretty new to snort and don't know too much about it. I am trying to put together a report of my snort files but, I only want the connections not the entire flows. For example, say I have a few ...
0
votes
1answer
138 views

Decrypting application data from pcap

Full disclosure I am front end developer with hardly any knowledge of security trying to complete a security challenge. All info below I picked up in the last 12 hours so if it doesn’t make sense feel ...
1
vote
1answer
107 views

Determine victim of port scan's OS

I am taking part in a practice sandbox, and have a pcap file in Wireshark: with the traffic depicting a Vertical Port Scan. Is there anyway to find out the "victim"'s Operating System? The packets are ...
0
votes
1answer
271 views

Can I detect malware download using Wireshark?

I have been working on Wireshark lately. I am learning about malware behavior, but I am curious to know whether methods exist to detect malware download (via drive-by download) on systems. Anti-...
25
votes
2answers
7k views

Why is my computer making requests to my Roku about spotify?

I'm new to inspecting packets with Wireshark so this might be something very stupid on my part. That said, I don't really understand the transaction between my computer and my Roku. 17 1.129097 ...
0
votes
1answer
86 views

How can I see the data content (HTML, JS, etc) in HTTPS responses in Wireshark?

I'm learning packet sniffing and analysis with Wireshark. At first, I could only see DNS, TCP, and ARP packets. I learned I couldn't see any HTTP packets because it was all encrypted in the transport ...
-1
votes
1answer
128 views

Would sniffing all network traffic from android device to check for spyware be a viable solution

I suspect that my Google pixel (Android 9) phone has some sort of a spyware installed. There are no obvious symptoms like overheating, extreme data usage, or battery draining at an unusual rate. But I ...
0
votes
0answers
40 views

Identify SSL invalid handshake using Wireshark

I am doing a research on "Network flow anomaly detection" and use Wireshark for my work. I have a problem of identifying the packets with invalid SSL/TLS handshakes. Is there a way/algorithm to detect ...
0
votes
0answers
32 views

ICMP Packet collection fails with airodump-ng

I have 3 machines (A,B, and C) connected to the same wireless network. I can ping A to B and vice versa. Machine C is set to monitor mode using airmon-ng and airodump-ng commands. When I try to ...
4
votes
1answer
71 views

Wireshark DNS sniffing : too much junk -> Are there hostname “blacklists” for wireshark?

So I'm sniffing my DNS on wireshark. There's way too much junk because the websites include many advertising tools, web tracking, etc. Is there some blacklist that contains all those pesky hostnames, ...
3
votes
1answer
121 views

How do I know that the request and response is using encryption protocols in burp suite?

I know these things can easily be done on wireshark, tshark, etc but is it possible to know that the request I forwarded and the response I received is using protocols such as TLS, TLSv1.2, TCP, HTTP, ...
2
votes
0answers
60 views

How to identify the communication protocol used in a wireless device?

I really hope that this is the right place to ask. I need to analyze a baby monitor for any security or privacy weaknesses. The spec sheet of the baby monitor says, that it uses the ISM 2400~2483.5 ...
0
votes
1answer
592 views

Analyze / Sniff all packets from all devices connected to a router

First of all, before explaining what I'm trying to do, let me clarify that my intentions are not steal any information, as it's only for study purposes, not even for my own entertainment. I'm trying ...
0
votes
0answers
132 views

How to extract a hash (VNC, SSH2 or SMB) from a WireShark capture file

Until now I have only tested WPA hashes, and they have been extracted from a airodump-ng's capture file using tshark or aircrack-ng (-J option). I wanna go one step beyond, and in an effort to ...
0
votes
1answer
96 views

How can I found a source of HTTP request in Wireshark?

There are weird requests to/from the AWS: and another one to/from 177.143.198.104.bc.googleusercontent.com: ( http://whois.domaintools.com/177.143.198.104 ) I use Ubuntu 18.04 Desktop, web browsers ...
1
vote
1answer
114 views

Understanding OPENVAS Wireshark Capture

I was looking at a sample capture from a tutorial I was looking at and below is a snippet of a wireshark packet capture: OpenVAS:() { _; OpenVAS; } >_[$($())] { echo Content-Type: text/plain; ...
0
votes
1answer
41 views

Tls certificate correspondence

I am not really good in tls details, just know some basics. So there are couple of questions about it: Is there a way to decipher tls in wireshark if the cipher method is diffie hellman? I know that ...
3
votes
2answers
1k views

How wireshark capture packets in LAN without arpspoof?

I created a lab environment which has Windows 7 and Kali Linux in VMware. In Kali Linux, I opened Wireshark and started to listen to traffic on eth0. After that, in my Windows 7 machine, I opened an ...
0
votes
1answer
603 views

How to identify a Ping of Death attack by analyzing its packet in Wireshark? [closed]

I've tried researching it for a long while, but came out dry.
4
votes
1answer
179 views

GSM - Implementing Cipher Mode Command on YateBTS

I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!? I use the combination of BladeRF x40 FPGA and ...
2
votes
2answers
77 views

My AP is probing other device?

I just installed kismet 2018 Beta update on my kali and test run it on my host but i came across something that i dont understand and i would appreciate if someone would explain to me. When i check ...
12
votes
4answers
4k views

Eavesdropping vs. sniffing

I'm taking a coursera course, and they take pains when talking about network security to distinguish between eavesdropping and sniffing. According to their definitions, sniffing involves reading or ...
0
votes
1answer
70 views

Wireshark unable to capture layer 3 [closed]

I'm new to Wireshark. I'm trying to visit google.com and capture the packets. However, Wireshark is only showing me layer 2 packets as shown below: Hence, filters like ip and ip addr == x.x.x.x are ...
1
vote
2answers
1k views

How can i sniff Telegram packets before they get encrypted?

So how can I sniff packets that are being sent from my computer to their server and from their servers to me using a sniffing app like Wireshark? right now when i use Wireshark, they are all ...
1
vote
1answer
566 views

Save decrypted pcap or decrypt on reading with rdpcap

I created a small program with runs command: tshark -i2 -o wlan.enable_decryption:TRUE -o "uat:80211_keys:\"wpa-pwd\",\" Passphrase:SSID\"" -w test.pcapng This creates the file test.pcapng, but it ...
1
vote
0answers
114 views

Hide data from wireshark on localhost

Assuming you're working with an old network protocol, or insecure/unencrypted protocol (HTTP for example), is there a way to make it difficult for network sniffers from capturing the packets? An MITM ...
3
votes
2answers
2k views

How to understand “Encrypted Data” in TLS message type?

In this Wireshark screenshot, there is a message type "Encrypted Data". Does anyone know what this is and in which situations this message type will be sent?
3
votes
1answer
2k views

Optimal way to capture HTTP(S) traffic on proxy-unaware iOS applications

I am trying to capture HTTP(S) traffic from a proxy-unaware Xamarin iOS application. The current tools I have available is a Mac with a Linux Mint VM, Xcode and iOS developer tools, Burp Suite ...
0
votes
0answers
88 views

Wireshark showing all ports being probed from my tablet

The first two pictures: Wireshark shows a tablet device as the source and my computer as the destination and vice versa. This tablet has never been connected via USB, FTP, BT, nothing to the computer. ...
2
votes
1answer
8k views

Filter TLS in Wireshark or other monitoring tool

As part of the new best practices in hardening server communications I need to deny TLS 1.0 on the web server, before doing so I wish to identify the amount of clients whom connect with this level of ...
0
votes
1answer
652 views

Finding wpa2 key length

Is it possible to determine WPA key length through a successful handshake? Below is a screen capture showing the packet capture session of interest as displayed in Wireshark: My question came from ...