Questions tagged [wireshark]

Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

Decrypting Data field of HTTP2 packet in Wireshark

I have pcap file that consists of HTTP/2 requests. Communication between two machines used basically done through Encryption using JSON Web Encryption (JWE) and encapsulate and encapsulates the ...
user avatar
  • 1
0 votes
0 answers
30 views

Is SSL necessary when sending password to a API from a server?

I have bought a online service which allows me to send SMS messages by making a call to the provider's SOAP-API. This is the WSDL I need to send a message: <?xml version="1.0"?> <...
user avatar
  • 2,740
-1 votes
1 answer
105 views

Trying to decrypt my home network

I've put my wireless card in monitor mode following this tutorial. After that, I started monitor my wifi home and, after a few seconds, I stop it. Every packet was crypted (obviously), so I follow ...
user avatar
  • 101
0 votes
1 answer
71 views

Application ip control

My goal is to analyze the traffic of an Android application, to check if it contacts any unofficial IPs. Using PCAPRemote I created a connection log file and transferred it to the PC, where I am ...
user avatar
  • 1
0 votes
0 answers
149 views

Wireshark Output | [Malformed Packet: Laplink: length of contained item exceeds length of containing item] from Russian IP

While running some traces for one of our production servers, an interesting item kept popping up in our Wireshark: [Malformed Packet: Laplink: length of contained item exceeds length of containing ...
user avatar
  • 1,227
2 votes
1 answer
463 views

Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?

We are using IIS on Windows 2012-R2 server to host dotnet apps. From the app, when we try connecting to an external 3rd party api we see TLS handshake failure. On running ssllabs test on that api, I ...
user avatar
0 votes
1 answer
70 views

Can the usage of Wireshark be detected when sniffing for packets in promiscuous mode? [duplicate]

I know that port scanning can set off IDS systems on certain networks due to the suspicious traffic it generates. Can the usage of Wireshark be detected on a network? If so, will using it set off any ...
user avatar
1 vote
1 answer
320 views

How to extract Kerberos ticket from Wireshark?

I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
user avatar
  • 79
0 votes
1 answer
289 views

How to decrypt HTTPS traffic with tshark when I have the .key and .crt file?

I have my domain .key and .crt file. the key file include "-----BEGIN PRIVATE KEY-----" when i use command on centos: tshark -r /tmp/xx.pcap -o 'ssl.keys_list:any,443,http,/tmp/private.key' -...
user avatar
15 votes
3 answers
3k views

Can an HTTPS request be sent twice?

When sniffing network traffic, one can see an HTTPS packet and all its (encrypted) data. I am wondering what would happen if this packet is copied and then re-sent. Is there a protocol at some layer ...
user avatar
  • 161
0 votes
1 answer
130 views

Can't find anomalies / abnormalities in wireshark capture

Previous post was deleted for not enough context, which I apologise for. I will try to provide as much context as I can. I am aware this appears to be an example of a SYN flood attack with spoofed ip ...
user avatar
0 votes
0 answers
100 views

VLAN Hopping (Switch Spoofing) not working in GNS3?

In the below scenario, I'm using Yersinia for VLAN Hopping through switch spoofing. Steps are: eth0 on kali is unset. runing Yersinia and launch a DTP attack (Sending DTP packet or Enabling trunk ...
user avatar
  • 1
0 votes
2 answers
177 views

Using Hydra not sending traffic to target VM

I have 3 VM's 1 with Ubuntu server version 20.04, apache2, php, mysql and DVWA. (10.0.2.4) 1 with Ubuntu client version 20.04 with hydra installed. (10.0.2.5) 1 with Kali 2021.3. (10.0.2.6) All VM's ...
user avatar
0 votes
0 answers
153 views

Running ARP Spoof disables internet access on target machine, doesn't intercept traffic as well

So I'm learning to run MITM attacks on my own WiFi network but I seem to be running into an issue. I'm following this tutorial. The process is simple and I'm running the attack from my Ubuntu laptop. ...
user avatar
0 votes
0 answers
117 views

Sending meaningless Addresses requests to a series of malicious IPs

i was testing somethings on browsers(It has nothing to do with what I am going to say) and accidentally i faced a case that when i browse meaningless addresses like abc/ signortest/ word/ the request ...
user avatar
  • 101
1 vote
0 answers
119 views

Detecting and understanding malware/spyware [closed]

Recently, stumbled upon the new FB 500m+ leak and decided to satisfy my curiosity and poke around. Basically just wanted to see how 500m+ user records were kept and what info was released( it was ...
user avatar
  • 11
0 votes
0 answers
161 views

Do iPhones still send packets when they are completely shutdown?

Do iPhones (or just a smart phones in general) send packets when they are fully shutdown? I have heard that they do, but I have not been able to verify such a claim. In an effort to investigate, I ARP ...
user avatar
  • 1
1 vote
0 answers
162 views

How to extract Wireshark keylog from a Java JSSE TLSv1.3 Session

Is it possible to extract the Wireshark keylog information directly from the TLSv1.3 handshake in a Java app? If so, how do I map the fields, or is additional material not shared in the handshake ...
user avatar
1 vote
0 answers
74 views

How does one label malicious traffic in generated workloads?

I have been writing on some code that automatically puts together differently parameterized attacks of common pen testing tools, i.e. sqlmap, nmap, patator etc. These attacks are then launched against ...
user avatar
  • 111
0 votes
2 answers
478 views

How to know whether mysql connection is using SSL or TLS connection?

I want to verify whether mysql remote connection is using tls/ssl connection for security purposes. I ran status command to check initially: mysql> status -------------- mysql Ver 8.0.19 for osx10....
user avatar
4 votes
2 answers
455 views

Wireshark - How to monitor TLS traffic from a malware? (It does not write into the SSLKEYLOGFILE)

I recently found malware that uses TLS 1.2 to communicate with the c2 server. I wanted to check the content of that but is encrypted. I have tried the method with the SSLKEYLOGFILE but unlike for ...
user avatar
  • 41
0 votes
1 answer
838 views

How to decrypt TLS traffic originating from a Windows service on my Windows 10 PC?

Some months ago I bought a peripheral device for my Windows 10 computer (think of something like a game controller). My home router has a function that allows it to capture all incoming and outgoing ...
user avatar
  • 31
1 vote
1 answer
208 views

Did Wireshark capture an update of Adobe Acrobat Reader over an unencrypted connection?

My home router is an AVM FritzBox and it's able to log all incoming and outgoing traffic in a file format readable by Wireshark. Some days ago I started capturing all traffic for about an hour to get ...
user avatar
  • 31
0 votes
1 answer
414 views

Can I elicit responses from "any remote host" on "all protocols" if I want to?

An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”. After some research, this is something that can be exploited. It is explained here that: By default, WSDAPI will listen ...
user avatar
1 vote
0 answers
563 views

How to fix TCP stream in Wireshark with spurious retransmission?

This was for a CTF (it ended yesterday, so I'm not cheating), but I've spent so many hours on it that I really just want to understand what I should have done. Here is the PasteBin Hex Dump. I ...
user avatar
0 votes
1 answer
1k views

Can't see data packets when capturing in monitor mode

On Kali Linux, I have an Atheros wireless adapater. I'm trying to capture data packets off the air and decrypt them as an exercise. The problem is that when I turn on the wifi monitor mode and choose ...
user avatar
2 votes
3 answers
2k views

Intercept HTTP Traffic of an android app?

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
user avatar
  • 121
1 vote
0 answers
554 views

Is it possible to decrypt TLS traffic through OpenSSL?

I have a web server that uses the ECDHE-RSA-AES256-GCM-SHA384 cipher suite. I noticed that when given the "(Pre)-master-secret log" file (generated by the browser), Wireshark is able to ...
user avatar
  • 11
1 vote
1 answer
920 views

why wireshark shows tls1.2 but it's actually tls1.0

Why does Wireshark show tls1.2 but it's actually tls1.0? and sometimes, in almost the same situation it shows tlsV1
user avatar
1 vote
0 answers
282 views

Wireshark how do I see data from a phone on the same network

So I am wondering how can I see the data on wireshark? I have my router setup to where there is no password so I can automatically connect whatever devices on to my network. First I connect my phone ...
user avatar
  • 11
0 votes
2 answers
363 views

Does HSTS prevent packet capturing in Wireshark

If a site is enforcing HSTS, does that prevent packet capturing of a GET requests in Wireshark? If it prevents it, is it possible to achieve the same using Bettercap or any other alternatives? ...
user avatar
0 votes
1 answer
602 views

Locate WhatsApp message destination [duplicate]

I've been interested in message tracing, so I played a bit with Cisco's Packet Tracer and Wireshark. Is it possible to locate the destination IP of a message (packages) been sent via WhatsApp? I am ...
user avatar
  • 1
0 votes
0 answers
36 views

Is possible to use promiscuous mode to sniff traffic between to devices connected by WiFi from another using Wireshark? [duplicate]

I've been read a lot about it, but I'm not 100% sure about it. The most clear response I've found is https://security.stackexchange.com/a/167845/163215 So, according to this, in this scenario: I ...
user avatar
  • 1
0 votes
1 answer
88 views

Unfamiliar user agents 'CON 1.0 urlexists' and 'VANILLA 1.0 vanillastub' - are they malicious?

I'm analyzing a pcap via Wireshark, and there are multiple get requests to the IP. These requests use different user agents, which I can't find anything about when I search. The user agents: CON 1.0 ...
user avatar
0 votes
0 answers
107 views

TLS Session ID from Client's First Visit

Why would a client send a TLS session ID (96b839ce3aadb65780923d28a3e7e767fc5bddc507884a7e70e506d8b85a06d3 on its first visit to a server/website? My understanding is that the client would include a ...
user avatar
2 votes
3 answers
1k views

Is it possible to extract a certificate that an application uses to connect to an API server?

There's an API server that only allows connections including specific SSL certificates. Talking about an Android application that has those certificates. Using Fiddler without SSL decryption as a ...
user avatar
0 votes
2 answers
622 views

Can MITM attacks now decrypt SSL & TLS traffic with POODLE vulnerability?

After the POODLE vulnerability was publicized, can MITM attacks now see https traffic? Previously only http websites showed info when sniffed, but now, what about https websites?
user avatar
2 votes
1 answer
3k views

Lots of TLSCiphertext length MUST NOT exceed 2^14 + 2048 in wireshark

We have small network with ~20 clients (Wifi and Lan). I captured a few seconds of our network traffic with wireshark and encountered a lot of TLSCiphertext length MUST NOT exceed 2^14 + 2048 errors ...
user avatar
  • 23
2 votes
3 answers
2k views

Is there any point of arp spoofing on a wifi network?

I know that arp spoofing is required on a LAN network due to the fact that data is sent directly to a destination, but what about for a WLAN network? All packets can be seen if you are in promiscuous ...
user avatar
-1 votes
2 answers
378 views

Can Wireshark resolve https domain name?

Can I use Wireshark to see what websites are visited on my network? I'm just looking for the domain name, and not a full url or any credentials. Would I need any additional tools such as sslstrip to ...
user avatar
0 votes
1 answer
290 views

Does Kerberos authentication handle DNS names the same way between Windows 7 and Windows 10?

Recently, we migrated from Windows 7 to Windows 10 and during that migration, we progressively ran into some issues with our NAS device. To be more precise, we progressively noticed some tcp socket ...
user avatar
  • 151
3 votes
1 answer
414 views

Why does airodump-ng shows 2.4GHz AP beacons, but wireshark does not?

I'm debugging some edits I made to hostapd which requires me to capture some beacon frames, but I can only capture them with airodump-ng and not with wireshark. I have a Panda PAU09 adapter running ...
user avatar
  • 135
0 votes
1 answer
332 views

Monitor mode not sniffing from other devices on the same network

i'm currently running a 802.11n adapter in monitor mode on a kali linux PC. Monitor mode was enabled using airmon-ng. On the same network as the kali linux PC are 2 raspberry pi devices. Pinging from ...
user avatar
1 vote
0 answers
103 views

Packets shown are mostly 802.11 despite open network

I'm currently trying to see if it's possible to sniff MQTT packets between two raspberry pi's from a wireless adapter in monitor mode attached to my PC. I ran the following command on my PC (Kali ...
user avatar
  • 11
1 vote
1 answer
406 views

Decrypt RSA ciphered TLS 1.2 traffic using client RSA private key (not server)

I am using stunnel as a MITM to decrypt TLS traffic in between an app and its web server. The traffic between the app and the MITM server cannot be decrypted simply with RSA cipher as the app is not ...
user avatar
  • 13
1 vote
0 answers
128 views

Track HTTP(S) Network calls being made by an Android Device

I am planning to track the Network calls being made by apps and the website of an Android Device. I have used the Burp Suite tool for tracking the network calls. Until now the Android Device and the ...
user avatar
  • 111
6 votes
1 answer
286 views

Professor wants a Wireshark capture of mail client and browser activity of my own machine

As part of a home exercise in my networking class, the professor is asking students to submit a Wireshark capture done on the students' private machines. The capture must contain activity of the ...
user avatar
  • 61
1 vote
1 answer
842 views

What kind of attack? [closed]

I was able to find the Teardrop Attack. However, there is another one but I couldn't explain it. It keeps getting the warning: Source MAC must not be a group address. Is this some sort of ARP spoofing ...
user avatar
2 votes
3 answers
4k views

I can't figure out the abnormal behaviour from this Wireshark capture file

The capture file if needed There is supposed to be abnormal behaviour here, and I see that there is. But I can't figure out what it is. There is no response from the ICMP requests. Furthermore some ...
user avatar
  • 21
-1 votes
1 answer
834 views

ip_forward reverting back to 0 during ettercap subnet scanning [closed]

Im trying to arp spoof a local network but the /proc/sys/net/ipv4/ip_forward is reverting back to 0 when ettercap is performing subnet scan on a network hub. Even if i change it back to 1 after the ...
user avatar
  • 19

1
2 3 4 5
7