Questions tagged [wireshark]

Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

Filter by
Sorted by
Tagged with
0 votes
0 answers
14 views

How do I extract audio from a youtube video using wireshark pcaps [closed]

I would like to know if it is possible to extract or create an audio file that comes from a youtube video based on the pcap of wireshark. Is there a tool I can use to be able to successfully have an ...
DjangoMania's user avatar
0 votes
1 answer
96 views

wireshark captures vpn tun0 smtp as unencrypted, why?

I am trying to learn more about cryptography and am stumped, i dont know what direction to move to even research an answer myself so would appreciate any input. I have a vpn set up to an adapter, tun0,...
joboi_lax's user avatar
2 votes
1 answer
128 views

Decrypt SSL with Wireshark supported browsers

I've been following the guide: https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/ Using it for chrome and Safari on MacOS does not populate any keys in the file, Did browsers stop keys ...
S3Im's user avatar
  • 21
3 votes
2 answers
462 views

Decrypting network traffic and finding HTTPS private key

I've been battling with one school task for couple days and can't seem to find any idea how to solve it. The task is pretty simple: Log in to the server using SSH. The answer to the task is in ...
Paul's user avatar
  • 95
2 votes
1 answer
487 views

Capturing packets in an android application or ios application?

I've an android and ios app. They run on the same application server on Linux. I want to capture the packets when users are trying to log in to the app. How do I proceed? I'm thinking of doing it with ...
barnyard9's user avatar
  • 143
2 votes
1 answer
84 views

DHE key exchange with p value 257 bytes but a pubkey of 256 bytes

I came across a packet capture in Wireshark where p length = 257 bytes and pubkey length = 256 bytes. See the ServerKeyExchange snip below: Diffie-Hellman Server Params p Length: 257 p: ...
ayivaak's user avatar
  • 23
0 votes
0 answers
133 views

Wireshark can't decrypt TLS from a specific python library

I have a problem. I'm using Wireshark 4.0.8. I created my ssl file to store my "(pre)-master-secrets". I can thus decrypt TLS from my browser or from different python libraries without ...
Big BG's user avatar
  • 1
0 votes
0 answers
137 views

How can I verify that my DoS attack is effective?

I was trying to simulate a DoS attack on the CORE network emulator using hping3 (Ubuntu). The topology is like three PCs connected by a router. The client's IP is 10.0.0.20/24, The server's IP is 10.0....
Harsha Gangari's user avatar
0 votes
0 answers
80 views

Is it normal for Apple push notifications to use the IRC protocol?

Seeing traffic like this on my network and wondering if it’s normal to see IRC being used in macOS push notifications and if anyone has any idea what the apparently escaped code (based on all of the ...
Patrick Dark's user avatar
1 vote
0 answers
198 views

Wireshark decrypt TLS 1.2 from WCF client

I have managed to decrypt TLS 1.2 data using Wireshark on a connection from the browser to the WCF service, but cannot manage to do the same with the WCF client. I'm not sure what is the difference, ...
gitzko's user avatar
  • 11
0 votes
1 answer
342 views

Does wireshark detect all unauthorized access?

A security engineer told me that my computer must have a trojan horse, but it has not been found yet. The security engineer captured and analyzed traffic pcap files with Wireshark, and said that there ...
john-trmb's user avatar
1 vote
0 answers
72 views

What is sequence number and why is it used as the ACK number for the next ACK packet? [closed]

I am currently trying to learn the TCP session creating (3 way handshake) process in detail. I was wondering what the sequence number means and also why is the ack num for the next ACK packet always ...
Flqmmable's user avatar
1 vote
2 answers
300 views

What are some symptoms of malware exfiltrating data in packet captures?

I am concerned that my Linux laptop has been compromised with malware that is remotely and regularly monitoring my activity. I ran Wireshark for a day to see if I could find any symptoms of data being ...
nooblet's user avatar
  • 11
0 votes
1 answer
94 views

For a proper traffic analysis between 2 computers, does wireshark need to be on a third laptop or just one of the two?

Looking at a situation where two machines use a secure communication protocol like this: Machine (or a VM) A <--------> Machine (or a VM) B and I want to use Wireshark to capture the traffic ...
U. User's user avatar
  • 190
1 vote
1 answer
2k views

SNI visible in HTTP/3, QUIC connection?

Client Hello should be encrypted in HTTP/3 and QUIC, but in Wireshark I can still see SNI of the QUIC connection when using DoH. The names should be encrypted inside the Handshake/CRYPTO packets. is ...
user avatar
1 vote
0 answers
441 views

ISP-provided router sending constant ARP requests

A few weeks ago I changed my ISP provider and router at home. It is a small network (less than 10 devices). From a user perspective everything seems to work correctly, nothing notable. However, today ...
JDD's user avatar
  • 11
1 vote
0 answers
4k views

How to decrypt a tls1.3 tcp packets in wireshark

I generated the public and private key with openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout server_key.pem -out cert.pem and I am using c sockets for the server and client with openssl, ...
anon's user avatar
  • 11
-2 votes
2 answers
363 views

Can a connection stay hidden from Wireshark?

I'm monitoring my home network with Wireshark, since I believe my computer is being actively hacked. I looked up a LOT of IP addresses, but didn't find any suspicious ones. Can a connection be hidden ...
kiec00's user avatar
  • 39
1 vote
1 answer
766 views

Is this wireshark capture using TLS 1.2 or 1.3?

Which version of TLS is being used here?
Oliver's user avatar
  • 35
0 votes
0 answers
76 views

Is SSL necessary when sending password to a API from a server?

I have bought a online service which allows me to send SMS messages by making a call to the provider's SOAP-API. This is the WSDL I need to send a message: <?xml version="1.0"?> <...
O'Niel's user avatar
  • 2,914
-2 votes
1 answer
218 views

Trying to decrypt my home network

I've put my wireless card in monitor mode following this tutorial. After that, I started monitor my wifi home and, after a few seconds, I stop it. Every packet was crypted (obviously), so I follow ...
Pablo D's user avatar
  • 99
0 votes
0 answers
1k views

Wireshark Output | [Malformed Packet: Laplink: length of contained item exceeds length of containing item] from Russian IP

While running some traces for one of our production servers, an interesting item kept popping up in our Wireshark: [Malformed Packet: Laplink: length of contained item exceeds length of containing ...
MrDuk's user avatar
  • 1,237
4 votes
1 answer
4k views

Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?

We are using IIS on Windows 2012-R2 server to host dotnet apps. From the app, when we try connecting to an external 3rd party api we see TLS handshake failure. On running ssllabs test on that api, I ...
dhanush shetty's user avatar
-1 votes
1 answer
2k views

Can the usage of Wireshark be detected when sniffing for packets in promiscuous mode? [duplicate]

I know that port scanning can set off IDS systems on certain networks due to the suspicious traffic it generates. Can the usage of Wireshark be detected on a network? If so, will using it set off any ...
GreatWhite's user avatar
1 vote
1 answer
2k views

How to extract Kerberos ticket from Wireshark?

I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
Bob's user avatar
  • 89
2 votes
1 answer
3k views

How to decrypt HTTPS traffic with tshark when I have the .key and .crt file?

I have my domain .key and .crt file. the key file include "-----BEGIN PRIVATE KEY-----" when i use command on centos: tshark -r /tmp/xx.pcap -o 'ssl.keys_list:any,443,http,/tmp/private.key' -...
xxddpac's user avatar
  • 23
15 votes
3 answers
4k views

Can an HTTPS request be sent twice?

When sniffing network traffic, one can see an HTTPS packet and all its (encrypted) data. I am wondering what would happen if this packet is copied and then re-sent. Is there a protocol at some layer ...
Reedy's user avatar
  • 161
0 votes
1 answer
644 views

Can't find anomalies / abnormalities in wireshark capture

Previous post was deleted for not enough context, which I apologise for. I will try to provide as much context as I can. I am aware this appears to be an example of a SYN flood attack with spoofed ip ...
John Franker's user avatar
0 votes
2 answers
463 views

Using Hydra not sending traffic to target VM

I have 3 VM's 1 with Ubuntu server version 20.04, apache2, php, mysql and DVWA. (10.0.2.4) 1 with Ubuntu client version 20.04 with hydra installed. (10.0.2.5) 1 with Kali 2021.3. (10.0.2.6) All VM's ...
Rob The Ranger's user avatar
0 votes
0 answers
1k views

Running ARP Spoof disables internet access on target machine, doesn't intercept traffic as well

So I'm learning to run MITM attacks on my own WiFi network but I seem to be running into an issue. I'm following this tutorial. The process is simple and I'm running the attack from my Ubuntu laptop. ...
YaddyVirus's user avatar
0 votes
0 answers
147 views

Sending meaningless Addresses requests to a series of malicious IPs

i was testing somethings on browsers(It has nothing to do with what I am going to say) and accidentally i faced a case that when i browse meaningless addresses like abc/ signortest/ word/ the request ...
Signor's user avatar
  • 101
1 vote
0 answers
159 views

Detecting and understanding malware/spyware [closed]

Recently, stumbled upon the new FB 500m+ leak and decided to satisfy my curiosity and poke around. Basically just wanted to see how 500m+ user records were kept and what info was released( it was ...
Tol's user avatar
  • 11
0 votes
0 answers
225 views

Do iPhones still send packets when they are completely shutdown?

Do iPhones (or just a smart phones in general) send packets when they are fully shutdown? I have heard that they do, but I have not been able to verify such a claim. In an effort to investigate, I ARP ...
John's user avatar
  • 1
1 vote
0 answers
303 views

How to extract Wireshark keylog from a Java JSSE TLSv1.3 Session

Is it possible to extract the Wireshark keylog information directly from the TLSv1.3 handshake in a Java app? If so, how do I map the fields, or is additional material not shared in the handshake ...
Yuri Schimke's user avatar
1 vote
0 answers
93 views

How does one label malicious traffic in generated workloads?

I have been writing on some code that automatically puts together differently parameterized attacks of common pen testing tools, i.e. sqlmap, nmap, patator etc. These attacks are then launched against ...
cybel's user avatar
  • 111
0 votes
2 answers
3k views

How to know whether mysql connection is using SSL or TLS connection?

I want to verify whether mysql remote connection is using tls/ssl connection for security purposes. I ran status command to check initially: mysql> status -------------- mysql Ver 8.0.19 for osx10....
ANWESH MOHAPATRA's user avatar
5 votes
2 answers
984 views

Wireshark - How to monitor TLS traffic from a malware? (It does not write into the SSLKEYLOGFILE)

I recently found malware that uses TLS 1.2 to communicate with the c2 server. I wanted to check the content of that but is encrypted. I have tried the method with the SSLKEYLOGFILE but unlike for ...
user's user avatar
  • 51
1 vote
1 answer
2k views

How to decrypt TLS traffic originating from a Windows service on my Windows 10 PC?

Some months ago I bought a peripheral device for my Windows 10 computer (think of something like a game controller). My home router has a function that allows it to capture all incoming and outgoing ...
luke359's user avatar
  • 141
1 vote
1 answer
374 views

Did Wireshark capture an update of Adobe Acrobat Reader over an unencrypted connection?

My home router is an AVM FritzBox and it's able to log all incoming and outgoing traffic in a file format readable by Wireshark. Some days ago I started capturing all traffic for about an hour to get ...
luke359's user avatar
  • 141
0 votes
1 answer
1k views

Can I elicit responses from "any remote host" on "all protocols" if I want to?

An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”. After some research, this is something that can be exploited. It is explained here that: By default, WSDAPI will listen ...
Freddy Nova's user avatar
2 votes
0 answers
1k views

How to fix TCP stream in Wireshark with spurious retransmission?

This was for a CTF (it ended yesterday, so I'm not cheating), but I've spent so many hours on it that I really just want to understand what I should have done. Here is the PasteBin Hex Dump. I ...
XRBtoTheMOON's user avatar
1 vote
1 answer
3k views

Can't see data packets when capturing in monitor mode

On Kali Linux, I have an Atheros wireless adapater. I'm trying to capture data packets off the air and decrypt them as an exercise. The problem is that when I turn on the wifi monitor mode and choose ...
Crankdat's user avatar
2 votes
3 answers
3k views

Intercept HTTP Traffic of an android app?

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
hanan's user avatar
  • 131
1 vote
0 answers
1k views

Is it possible to decrypt TLS traffic through OpenSSL?

I have a web server that uses the ECDHE-RSA-AES256-GCM-SHA384 cipher suite. I noticed that when given the "(Pre)-master-secret log" file (generated by the browser), Wireshark is able to ...
Martin's user avatar
  • 11
1 vote
1 answer
3k views

why wireshark shows tls1.2 but it's actually tls1.0

Why does Wireshark show tls1.2 but it's actually tls1.0? and sometimes, in almost the same situation it shows tlsV1
欧阳维杰's user avatar
1 vote
0 answers
976 views

Wireshark how do I see data from a phone on the same network

So I am wondering how can I see the data on wireshark? I have my router setup to where there is no password so I can automatically connect whatever devices on to my network. First I connect my phone ...
Seng's user avatar
  • 11
0 votes
2 answers
655 views

Does HSTS prevent packet capturing in Wireshark

If a site is enforcing HSTS, does that prevent packet capturing of a GET requests in Wireshark? If it prevents it, is it possible to achieve the same using Bettercap or any other alternatives? ...
Joel Deleep's user avatar
0 votes
1 answer
3k views

Locate WhatsApp message destination [duplicate]

I've been interested in message tracing, so I played a bit with Cisco's Packet Tracer and Wireshark. Is it possible to locate the destination IP of a message (packages) been sent via WhatsApp? I am ...
Miki's user avatar
  • 1
0 votes
0 answers
48 views

Is possible to use promiscuous mode to sniff traffic between to devices connected by WiFi from another using Wireshark? [duplicate]

I've been read a lot about it, but I'm not 100% sure about it. The most clear response I've found is https://security.stackexchange.com/a/167845/163215 So, according to this, in this scenario: I ...
p0kero's user avatar
  • 1
0 votes
2 answers
139 views

Unfamiliar user agents 'CON 1.0 urlexists' and 'VANILLA 1.0 vanillastub' - are they malicious?

I'm analyzing a pcap via Wireshark, and there are multiple get requests to the IP. These requests use different user agents, which I can't find anything about when I search. The user agents: CON 1.0 ...
user232836's user avatar

1
2 3 4 5
7