Skip to main content
36 votes
Accepted

Can an HTTPS request be sent twice?

There are multiple mechanisms to detect duplicates. At the TCP level there is the sequence number sent within each TCP packet, which allows to detect if a packet was received twice, or more generally ...
Steffen Ullrich's user avatar
24 votes
Accepted

How can I extract the certificate from this pcap file?

With new versions of wireshark: Make sure the traffic is decoded as SSL, i.e. setup the SSL analyzer for this TCP stream in Analyze >> Decode As. Now it will show the SSL details for the ...
Steffen Ullrich's user avatar
10 votes
Accepted

Is packet sniffing or other manipulation possible at a DSL or cable wire between my modem and the ISP?

Can a DSL or cable wire between my modem and the ISP be manipulated in any way at the hardware level to sniff the traffic data? In theory, yes - the data isn't encrypted and the line code isn't a ...
Zac67's user avatar
  • 386
7 votes

Is my router spying on my network traffic?

It most likely checks for updates. I've noticed such behavior in many recent routers: they periodically check their home site for new firmware. If there is a new version available, it will notify you ...
Overmind's user avatar
  • 8,899
6 votes

Does https prevent man in the middle attacks by proxy server?

The proxy can block https and only allow http from the browser. Then it can initiate its own https connection to pass the requests to the server. Most users will not notice. HSTS is supposed to ...
Erik van Velzen's user avatar
5 votes
Accepted

Is there any way capture HTTPS Request with Python?

HTTPS runs on top of TLS. That is the entire HTTP request and response is encrypted, and an application eavesdropping on the network traffic will not be able to decrypt the traffic. That said, you ...
dr jimbob's user avatar
  • 39.4k
5 votes
Accepted

Is it possible to sniff MAC addresses from a client that is not connected to an AP?

802.11 devices send probe requests to identify if a given network is nearby. Probe requests still contain standard MAC headers - which would contain destination and sender address fields. The ...
Hector's user avatar
  • 11k
5 votes
Accepted

Can your ISP pull off a man-in-the-middle attack over unencrypted DNS?

It is very much possible that your ISP could be messing with your DNS request. Regular old DNS defaults to being UDP based, unencrypted and unauthenticated (yes, it can be TCP based and can be ...
MadsRC's user avatar
  • 98
4 votes
Accepted

Unsecure FTP with Encrypted file and Wireshark leakage

You cannot open a remote file with GPG through FTP. Instead you would need to download the file to the local system and open it there. Because of this the decryption will be done only locally (and ...
Steffen Ullrich's user avatar
4 votes

How to protect against request intercepting and parameter-tampering?

You can not stop user from intercepting the traffic that your application generates. There're following alternatives that you can do for making your application works correctly :- 1) User Secured ...
Mangu Singh Rajpurohit's user avatar
4 votes

How to sniff ECDH HTTPS traffic?

I suppose that by "sniffing" you mean "obtaining the cleartext traffic". Basically, SSL/TLS has been designing specifically to ward off attackers who want to do that kind of sniffing. When ...
Thomas Pornin's user avatar
3 votes
Accepted

Wireless - why can't i view ARP broadcasts in monitor mode on encrypted networks?

Because they're encrypted It is my understanding that 802.11 networks using WEP encryption do not encrypt ARP packets. Nope. Instead the attack relies on the very fact that they ARE encrypted. From ...
StackzOfZtuff's user avatar
3 votes

Can a .DER be converted to a .PFX / .P12 ?

Can I convert directly from a .der to a .pfx/.p12? I don't think so because Openssl uses PEM encoding for certificates by default unless you set it explicitly using -inform or -outform arguments. ...
Makif's user avatar
  • 176
3 votes

How can I extract the certificate from this pcap file?

Natively, through Wireshark: How to obtain the SSL certificate from a Wireshark packet capture: From the Wireshark menu choose Edit > Preferences and ensure that “Allow subdissector to ...
HopelessN00b's user avatar
  • 3,417
3 votes
Accepted

Where would I place a sniffer to capture data in a home network with the following topology?

First case: Your sky router has a mirroring port / You can dedicate a port to mirroring. Should be very simple to tap the traffic, check your router specs/doc. Second case: you want to do it by ...
Baptiste's user avatar
  • 1,703
3 votes
Accepted

How to go from wifi password to computer access

You're mostly right - and indeed, as default commented, "they" are wrong. What you might do if you had access to the wifi access point would be to lie to the connected devices and turn something they'...
LSerni's user avatar
  • 22.9k
3 votes

Can an HTTPS request be sent twice?

In general, no - the TLS protocol prevents replay attacks, so if data was copied and resent, it would be discarded. There is one exception to this, a new feature in the TLS 1.3 protocol - 0-RTT. This ...
paj28's user avatar
  • 33.5k
2 votes

Encrypted traffic analysis

Short Answer: Mostly Likely Not. Your Traffic will be encrypted. However, it is possible to read the data by other means. If the sniffer is some type of malware on either your machine or the ...
Jeff Meigs's user avatar
2 votes

Blind SQL Injection using OOB DNS Practical Sniffing Help

Interesting video. In my opinion, to setup this kind on technique, you need to: Own a domain name, say mysite.com Each domain name has an "Authoritative name server". Usually the Authoritative name ...
Max's user avatar
  • 351
2 votes

Iterate through and decode Dot11Elt layers -- Scapy

Given the info in https://stackoverflow.com/a/29989032, you need to iterate over them like this: dot11elt = packet.getlayer(Dot11Elt) while dot11elt: print dot11elt.ID, dot11elt.info ...
solsTiCe's user avatar
  • 241
2 votes

Sniffing TLS/SSL communication with Wireshark, possible?

Firefox and Chrome both support logging the symmetric session key used to encrypt TLS traffic, and therefore, can also be used to decrypt using Wireshark. Here is a link that explains how to do this ...
Tyler Gallenbeck's user avatar
2 votes

Sending Probe Request Frames | Receving Probe Response -- Scapy

That's because you didn't include the "Dot11Elt" layer, try this: RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")/Dot11Elt(ID="SSID", ...
MistSpark's user avatar
2 votes

User authentication protected against all attack vectors

I presume you are using https with a reasonable key length, to access the login API and receive the JWT and sending the JWT is SSL sessions. If this is the case accessing the JWT from a packet capture ...
Tim Ebenezer's user avatar
2 votes

How do hackers intercept messages?

The "listener" you talk about is called a "man in the middle", and your question is basically "how does one get into the middle". This can be done in many ways, and any point that the traffic passes ...
Anders's user avatar
  • 65.6k
2 votes

How do hackers intercept messages?

No, anybody with a computer Sometimes If it is connected to a network, yes. IOT is an emerging threat now. You just have to know what to look for. You can find an insane amount of information ...
Digital Shiba's user avatar
2 votes
Accepted

What are the core differences between Airodump-ng, Wireshark, and TCPdump?

Airdump-ng is for capturing 802.11 frames, so you use this tool exclusively for wireless networks. Wireshark and TCPdump are similar but Wireshark is more complex, also has a GUI. E.g. you can set ...
skooog's user avatar
  • 1,008
2 votes
Accepted

How can I decrypt traffic on a WPA encrypted network?

Short answer No, you need the pre-shared key. Longer answer WPA-PSK and WPA2-PSK encrypt traffic per client and session keys, which are derived from the pre-shared key. So if you know the pre-...
Jeroen's user avatar
  • 5,841
2 votes

How to intercept http/https requests done by an Android app in plain text?

Using a packet capture tool like the other answers suggest will give you the raw network traffic, but will not help decrypt HTTPS traffic. For that you will probably need to install a certificate and ...
J.A.K.'s user avatar
  • 4,853
2 votes

How can I capture all data from a specific device on my network?

You can start with Wireshark. You will also need AirSnort or AiroPeek. For real advanced stuff check out KISMET. Finally if you intention is non-intrusive, non-disruptive, you might want to use a ...
bj_dinesh's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible