Questions tagged [wireshark]

Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

Filter by
Sorted by
Tagged with
1
vote
0answers
48 views

How to fix TCP stream in Wireshark with spurious retransmission?

This was for a CTF (it ended yesterday, so I'm not cheating), but I've spent so many hours on it that I really just want to understand what I should have done. Here is the PasteBin Hex Dump. I ...
0
votes
1answer
76 views

Cant see data packets when capturing in monitor mode

On linux kali. I got an Atheros wireless adapater. I'm trying to capture data packets off the air and decrypt them as an exercise. I apologize if this question is silly. The problem is that when I ...
1
vote
3answers
177 views

Intercept HTTP Traffic of an android app?

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
0
votes
0answers
37 views

Wireshark and tlsv1.2 packets decryption

Thank you in advance for responding to my question. I have recently installed an application in my computer, I have noticed that it contacts an external server I did this using Wireshark, the ...
1
vote
0answers
85 views

Is it possible to decrypt TLS traffic through OpenSSL?

I have a web server that uses the ECDHE-RSA-AES256-GCM-SHA384 cipher suite. I noticed that when given the "(Pre)-master-secret log" file (generated by the browser), Wireshark is able to ...
1
vote
1answer
75 views

why wireshark shows tls1.2 but it's actually tls1.0

Why does Wireshark show tls1.2 but it's actually tls1.0? and sometimes, in almost the same situation it shows tlsV1
1
vote
0answers
50 views

Wireshark how do I see data from a phone on the same network

So I am wondering how can I see the data on wireshark? I have my router setup to where there is no password so I can automatically connect whatever devices on to my network. First I connect my phone ...
0
votes
2answers
102 views

Does HSTS prevent packet capturing in Wireshark

If a site is enforcing HSTS, does that prevent packet capturing of a GET requests in Wireshark? If it prevents it, is it possible to achieve the same using Bettercap or any other alternatives? ...
0
votes
1answer
94 views

Locate WhatsApp message destination [duplicate]

I've been interested in message tracing, so I played a bit with Cisco's Packet Tracer and Wireshark. Is it possible to locate the destination IP of a message (packages) been sent via WhatsApp? I am ...
0
votes
0answers
44 views

BLE pairing method with Passkey entry - is it possible to sniff passkey value?

I have my custom made Android app which is connecting to my BLE controller. I want to prove that BLE is secured from passive eavesdropping. I have Adafruit Bluefruit BLE Sniffer and Wireshark. I can ...
0
votes
0answers
31 views

Is possible to use promiscuous mode to sniff traffic between to devices connected by WiFi from another using Wireshark? [duplicate]

I've been read a lot about it, but I'm not 100% sure about it. The most clear response I've found is https://security.stackexchange.com/a/167845/163215 So, according to this, in this scenario: I ...
0
votes
1answer
50 views

Unfamiliar user agents 'CON 1.0 urlexists' and 'VANILLA 1.0 vanillastub' - are they malicious?

I'm analyzing a pcap via Wireshark, and there are multiple get requests to the IP. These requests use different user agents, which I can't find anything about when I search. The user agents: CON 1.0 ...
0
votes
0answers
40 views

TLS Session ID from Client's First Visit

Why would a client send a TLS session ID (96b839ce3aadb65780923d28a3e7e767fc5bddc507884a7e70e506d8b85a06d3 on its first visit to a server/website? My understanding is that the client would include a ...
2
votes
3answers
518 views

Is it possible to extract a certificate that an application uses to connect to an API server?

There's an API server that only allows connections including specific SSL certificates. Talking about an Android application that has those certificates. Using Fiddler without SSL decryption as a ...
0
votes
2answers
169 views

Can MITM attacks now decrypt SSL & TLS traffic with POODLE vulnerability?

After the POODLE vulnerability was publicized, can MITM attacks now see https traffic? Previously only http websites showed info when sniffed, but now, what about https websites?
1
vote
1answer
804 views

Lots of TLSCiphertext length MUST NOT exceed 2^14 + 2048 in wireshark

We have small network with ~20 clients (Wifi and Lan). I captured a few seconds of our network traffic with wireshark and encountered a lot of TLSCiphertext length MUST NOT exceed 2^14 + 2048 errors ...
2
votes
3answers
241 views

Is there any point of arp spoofing on a wifi network?

I know that arp spoofing is required on a LAN network due to the fact that data is sent directly to a destination, but what about for a WLAN network? All packets can be seen if you are in promiscuous ...
-1
votes
2answers
84 views

Can Wireshark resolve https domain name?

Can I use Wireshark to see what websites are visited on my network? I'm just looking for the domain name, and not a full url or any credentials. Would I need any additional tools such as sslstrip to ...
0
votes
1answer
122 views

Does Kerberos authentication handle DNS names the same way between Windows 7 and Windows 10?

Recently, we migrated from Windows 7 to Windows 10 and during that migration, we progressively ran into some issues with our NAS device. To be more precise, we progressively noticed some tcp socket ...
2
votes
1answer
147 views

Why does airodump-ng shows 2.4GHz AP beacons, but wireshark does not?

I'm debugging some edits I made to hostapd which requires me to capture some beacon frames, but I can only capture them with airodump-ng and not with wireshark. I have a Panda PAU09 adapter running ...
0
votes
1answer
103 views

Monitor mode not sniffing from other devices on the same network

i'm currently running a 802.11n adapter in monitor mode on a kali linux PC. Monitor mode was enabled using airmon-ng. On the same network as the kali linux PC are 2 raspberry pi devices. Pinging from ...
1
vote
0answers
54 views

Packets shown are mostly 802.11 despite open network

I'm currently trying to see if it's possible to sniff MQTT packets between two raspberry pi's from a wireless adapter in monitor mode attached to my PC. I ran the following command on my PC (Kali ...
1
vote
1answer
156 views

Decrypt RSA ciphered TLS 1.2 traffic using client RSA private key (not server)

I am using stunnel as a MITM to decrypt TLS traffic in between an app and its web server. The traffic between the app and the MITM server cannot be decrypted simply with RSA cipher as the app is not ...
1
vote
0answers
85 views

Track HTTP(S) Network calls being made by an Android Device

I am planning to track the Network calls being made by apps and the website of an Android Device. I have used the Burp Suite tool for tracking the network calls. Until now the Android Device and the ...
6
votes
1answer
235 views

Professor wants a Wireshark capture of mail client and browser activity of my own machine

As part of a home exercise in my networking class, the professor is asking students to submit a Wireshark capture done on the students' private machines. The capture must contain activity of the ...
1
vote
1answer
168 views

What kind of attack? [closed]

I was able to find the Teardrop Attack. However, there is another one but I couldn't explain it. It keeps getting the warning: Source MAC must not be a group address. Is this some sort of ARP spoofing ...
2
votes
3answers
2k views

I can't figure out the abnormal behaviour from this Wireshark capture file

The capture file if needed There is supposed to be abnormal behaviour here, and I see that there is. But I can't figure out what it is. There is no response from the ICMP requests. Furthermore some ...
0
votes
1answer
347 views

ip_forward reverting back to 0 during ettercap subnet scanning [closed]

Im trying to arp spoof a local network but the /proc/sys/net/ipv4/ip_forward is reverting back to 0 when ettercap is performing subnet scan on a network hub. Even if i change it back to 1 after the ...
1
vote
2answers
1k views

SSL handshake not visible in Wireshark

In my organization we have a cloud proxy that work on a loopback address. The vendor of this proxy has deployed an app on our machine which listens on the loopback address. I have captured the apps ...
1
vote
0answers
72 views

How to intercept data my TV communicator sends and receives?

I wish to check how and what is being sent when I interact with my TV via the remote that talks to the communicator box (not smart tv). I am curious what protocols are used, and how often does the ...
1
vote
1answer
924 views

How to speed up brute forcing of finding a WEP key from a captured file?

I have been working on decrypting a WEP .cap file using crunch. It has 1268 IVs. I am wondering: Can I get a clue from the captured file to speed the process of brute-forcing? If not, what other ways ...
3
votes
0answers
97 views

Is there an easy way to dissect .NET Remoting traffic for reverse engineering?

I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
1
vote
0answers
201 views

How to decode kerberos tickets on wireshark? [closed]

It has been two days in a row that I spend hours trying to decrypt kerberos traffic using wireshark. For learning purposes, I want to be able to read the encrypted parts of tickets and authenticators ...
0
votes
0answers
195 views

Is there a way to detect network traffic encrypted by MACsec?

We are going to analyse some traffic on our network. Some streams are encrypted and we know that the encrypted protocols aren't IPsec. We suspect it is using MACsec and we are looking for some way to ...
0
votes
0answers
103 views

Watch Encrypted IMAP Responses

I'm trying to see if I can decipher the messages coming back from Exchange when I try and login via secure IMAP. My office 365 accounts are under attack and I've disabled IMAP (and legacy login) but ...
0
votes
1answer
47 views

Is it possible to infer advanced cookie properties like expiration from Wireshark

I want to perform a cookie injection attack for demonstration purposes. I could achieve this using Firefox Cookie-Editor extension. However, the attack can only succeed if I enter the cookie name, ...
0
votes
0answers
371 views

Decryption of TLS/SSL Traffic With the debug file of fiddler on wireshark

I wanna decrypt some packets on Wireshark, when I search the Internet, some people were said to use SSLKEYLOGFILE environment, I do the stuff, but it looks like that chorme doesn`t update that file ...
0
votes
1answer
88 views

Intercept network traffic with a hub [closed]

If I plugged a hub inbetween a switch and firewall, that also had a device running wireshark or similar capture software connected, due to the way a hub operates, would I be able to read ALL of the ...
0
votes
2answers
168 views

Can wireshark capture the exact payload and end point of API used by my Mobile APP?

I was just wondering if someone having total control over his/her network, is running my mobile app. Also wireshark is capturing all requests made using the network. My app is calling API endpoint ...
1
vote
0answers
132 views

Infected usb drives in mice

I bought a mouse on aliexpress. It was reasonably cheap. It works well enough to be on par with a mouse I can buy here for 4 times the price. I know, this is a well known business model, and those ...
2
votes
0answers
137 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
2
votes
0answers
828 views

Wireshark does not decrypt TLS, decrypt tab does not appear

What I did: Setup the env var "SSLKEYLOGFILE" as "C:\ssl-keys.log" and ensure it is valid. Enter its path in Wireshark 3 preferences -> protocols -> tls -> pre-master-secret-log filename -> "C:\ssl-...
-1
votes
2answers
484 views

Unable to inject cookies

As part of an exercise, I need to sniff cookies from a login page and inject them in the same login page. If the cookie injection is successful the user must be login without entering the user name ...
1
vote
1answer
1k views

How can I inject cookie from Wireshark into a browser sesson [duplicate]

For education and research purpose, I need to inject a cookie value into my browser to allow me login indirectly (without entering the user name and password). I collected traffic during a login ...
0
votes
1answer
2k views

Wireshark - How to see the domain of HTTPS websites visited

How can I see the domain name of https websites that are visited on my network? I know I'm not able to see the full url, just the websites ip or domain. I think it my be possible with a reverse dns ...
1
vote
1answer
490 views

Capturing traffic on WiFi Network using Wireshark [duplicate]

Is it possible to capture, using Wireshark, regular data sent by another machine inside my Wireless LAN?
1
vote
2answers
518 views

How to analyze .pcap file to write a generic snort rule to detect c&c activity

I am diving into snort and trying to figure out what everything does but I'm having a little trouble. I have a .pcap file I want to analyse and I know there is malicious c&c traffic on it. (...
2
votes
1answer
245 views

Is there a way to change the format of the output from snort?

I'm pretty new to snort and don't know too much about it. I am trying to put together a report of my snort files but, I only want the connections not the entire flows. For example, say I have a few ...
0
votes
1answer
852 views

Decrypting application data from pcap

Full disclosure I am front end developer with hardly any knowledge of security trying to complete a security challenge. All info below I picked up in the last 12 hours so if it doesn’t make sense feel ...
1
vote
1answer
168 views

Determine victim of port scan's OS

I am taking part in a practice sandbox, and have a pcap file in Wireshark: with the traffic depicting a Vertical Port Scan. Is there anyway to find out the "victim"'s Operating System? The packets are ...

1
2 3 4 5
7