[chunky]

Hello folks!
I just found this video and I thought it might be beneficial for some of you guys.

[Synthx]

Thanks for this share, I'd love to mess around with my friends or some people with this. This is actually really interesting to me.

[chunky]

That tutorial just teaches you how to sniff traffic on one of your own devices in case you wanna find out what your phone does or whatever.
It doesn't really teach you how to use this without the owners permission even tho the theory behind it could be used for abusive behaviour.

[x n]

This is really useful for what the video is showing, which is how to see how games and other stuff on mobile devices work.

It's too bad though that this is highly impractical in terms of "hacking" considering SSL/TLS encrypted traffic (which most juicy data happens to be nowadays) without a way to read it in plaintext is about as useful as lips on a chicken. You still have a few options though, you could use SSLstrip to force the user to use http links which is infeasible because it only works on very outdated browsers, MITMf + sslstrip2 to bypass the HSTS HTTP header which is improbable to work because it only works on pretty outdated browsers or if the user has never visited the website once in that browser, SSLstrip which is a transparent proxy that forges the target website's SSL certificate (minus the fingerprint) which works on anything however newer browsers will display a certificate warning (which will probably work on uneducated or gullible people), or you could install a self-signed certificate on the target device like he does in the video but this obviously won't be happening in a scenario where you're just trying to sniff the traffic of some random person a network.

[Nytelife26]

This is really useful for what the video is showing, which is how to see how games and other stuff on mobile devices work.

It's too bad though that this is highly impractical in terms of "hacking" considering SSL/TLS encrypted traffic (which most juicy data happens to be nowadays) without a way to read it in plaintext is about as useful as lips on a chicken. You still have a few options though, you could use SSLstrip to force the user to use http links which is infeasible because it only works on very outdated browsers, MITMf + sslstrip2 to bypass the HSTS HTTP header which is improbable to work because it only works on pretty outdated browsers or if the user has never visited the website once in that browser, SSLstrip which is a transparent proxy that forges the target website's SSL certificate (minus the fingerprint) which works on anything however newer browsers will display a certificate warning (which will probably work on uneducated or gullible people), or you could install a self-signed certificate on the target device like he does in the video but this obviously won't be happening in a scenario where you're just trying to sniff the traffic of some random person a network.

You have a valid point there.
However, I'll have to respectfully disagree with SSLstrip not working very effectively. Maybe in your experience it isn't very good, but in mine it works pretty damn well for its intention.
I've used SSLstrip numerous times in the past and it has worked almost every time. How has it been for you (that is, if you are basing it on experience)? Failed or do you just find it inefficient?

[chunky]

This is really useful for what the video is showing, which is how to see how games and other stuff on mobile devices work.

It's too bad though that this is highly impractical in terms of "hacking" considering SSL/TLS encrypted traffic (which most juicy data happens to be nowadays) without a way to read it in plaintext is about as useful as lips on a chicken. You still have a few options though, you could use SSLstrip to force the user to use http links which is infeasible because it only works on very outdated browsers, MITMf + sslstrip2 to bypass the HSTS HTTP header which is improbable to work because it only works on pretty outdated browsers or if the user has never visited the website once in that browser, SSLstrip which is a transparent proxy that forges the target website's SSL certificate (minus the fingerprint) which works on anything however newer browsers will display a certificate warning (which will probably work on uneducated or gullible people), or you could install a self-signed certificate on the target device like he does in the video but this obviously won't be happening in a scenario where you're just trying to sniff the traffic of some random person a network.

It can still be very helpful in terms of "hacking".

Imagine an application that blocks the WinPcap driver, wireshark and it won't work in a VM. You want to find out what it does so you can emulate their server in order to sign in. But just running a sniffing tool won't work since almost any windows tools use the WinPcap driver so just listening to it from another device would be a way to get around the applications limitations.

You can also use a similar method to read the traffic of video games. For example the well known game PUBG doesn't encrypt its traffic so you can just read player information without getting banned because the anticheat is running on a different machine than the actual "cheat".

But I gotta admit that your scenario where you're just trying to sniff the traffic of some random person a network won't work that way.

[Blink]

This is really useful for what the video is showing, which is how to see how games and other stuff on mobile devices work.

It's too bad though that this is highly impractical in terms of "hacking" considering SSL/TLS encrypted traffic (which most juicy data happens to be nowadays) without a way to read it in plaintext is about as useful as lips on a chicken. You still have a few options though, you could use SSLstrip to force the user to use http links which is infeasible because it only works on very outdated browsers, MITMf + sslstrip2 to bypass the HSTS HTTP header which is improbable to work because it only works on pretty outdated browsers or if the user has never visited the website once in that browser, SSLstrip which is a transparent proxy that forges the target website's SSL certificate (minus the fingerprint) which works on anything however newer browsers will display a certificate warning (which will probably work on uneducated or gullible people), or you could install a self-signed certificate on the target device like he does in the video but this obviously won't be happening in a scenario where you're just trying to sniff the traffic of some random person a network.

You have a valid point there.
However, I'll have to respectfully disagree with SSLstrip not working very effectively. Maybe in your experience it isn't very good, but in mine it works pretty damn well for its intention.
I've used SSLstrip numerous times in the past and it has worked almost every time. How has it been for you (that is, if you are basing it on experience)? Failed or do you just find it inefficient?

Have you tried recently? It hasn't really worked in years. There is SSLStrip2/SSLStrip+, however I'm not sure of the state of it currently though.

[Nytelife26]

This is really useful for what the video is showing, which is how to see how games and other stuff on mobile devices work.

It's too bad though that this is highly impractical in terms of "hacking" considering SSL/TLS encrypted traffic (which most juicy data happens to be nowadays) without a way to read it in plaintext is about as useful as lips on a chicken. You still have a few options though, you could use SSLstrip to force the user to use http links which is infeasible because it only works on very outdated browsers, MITMf + sslstrip2 to bypass the HSTS HTTP header which is improbable to work because it only works on pretty outdated browsers or if the user has never visited the website once in that browser, SSLstrip which is a transparent proxy that forges the target website's SSL certificate (minus the fingerprint) which works on anything however newer browsers will display a certificate warning (which will probably work on uneducated or gullible people), or you could install a self-signed certificate on the target device like he does in the video but this obviously won't be happening in a scenario where you're just trying to sniff the traffic of some random person a network.

You have a valid point there.
However, I'll have to respectfully disagree with SSLstrip not working very effectively. Maybe in your experience it isn't very good, but in mine it works pretty damn well for its intention.
I've used SSLstrip numerous times in the past and it has worked almost every time. How has it been for you (that is, if you are basing it on experience)? Failed or do you just find it inefficient?

Have you tried recently?  It hasn't really worked in years.  There is SSLStrip2/SSLStrip+, however I'm not sure of the state of it currently though.

Yes, I last used it a month or so ago, worked fine.
Could be different at the moment though, who knows.

[x n]

This is really useful for what the video is showing, which is how to see how games and other stuff on mobile devices work.

It's too bad though that this is highly impractical in terms of "hacking" considering SSL/TLS encrypted traffic (which most juicy data happens to be nowadays) without a way to read it in plaintext is about as useful as lips on a chicken. You still have a few options though, you could use SSLstrip to force the user to use http links which is infeasible because it only works on very outdated browsers, MITMf + sslstrip2 to bypass the HSTS HTTP header which is improbable to work because it only works on pretty outdated browsers or if the user has never visited the website once in that browser, SSLstrip which is a transparent proxy that forges the target website's SSL certificate (minus the fingerprint) which works on anything however newer browsers will display a certificate warning (which will probably work on uneducated or gullible people), or you could install a self-signed certificate on the target device like he does in the video but this obviously won't be happening in a scenario where you're just trying to sniff the traffic of some random person a network.

You have a valid point there.
However, I'll have to respectfully disagree with SSLstrip not working very effectively. Maybe in your experience it isn't very good, but in mine it works pretty damn well for its intention.
I've used SSLstrip numerous times in the past and it has worked almost every time. How has it been for you (that is, if you are basing it on experience)? Failed or do you just find it inefficient?

I tried using it less than two weeks ago and it didn't work. As far as I know it's now completely useless for stripping SSL/TLS from HTTPS because modern correct implementations of SSL/TLS utilize the HSTS header which forces HTTPS.

[x n]

This is really useful for what the video is showing, which is how to see how games and other stuff on mobile devices work.

It's too bad though that this is highly impractical in terms of "hacking" considering SSL/TLS encrypted traffic (which most juicy data happens to be nowadays) without a way to read it in plaintext is about as useful as lips on a chicken. You still have a few options though, you could use SSLstrip to force the user to use http links which is infeasible because it only works on very outdated browsers, MITMf + sslstrip2 to bypass the HSTS HTTP header which is improbable to work because it only works on pretty outdated browsers or if the user has never visited the website once in that browser, SSLstrip which is a transparent proxy that forges the target website's SSL certificate (minus the fingerprint) which works on anything however newer browsers will display a certificate warning (which will probably work on uneducated or gullible people), or you could install a self-signed certificate on the target device like he does in the video but this obviously won't be happening in a scenario where you're just trying to sniff the traffic of some random person a network.

It can still be very helpful in terms of "hacking".

Imagine an application that blocks the WinPcap driver, wireshark and it won't work in a VM. You want to find out what it does so you can emulate their server in order to sign in. But just running a sniffing tool won't work since almost any windows tools use the WinPcap driver so just listening to it from another device would be a way to get around the applications limitations.

You can also use a similar method to read the traffic of video games. For example the well known game PUBG doesn't encrypt its traffic so you can just read player information without getting banned because the anticheat is running on a different machine than the actual "cheat".

But I gotta admit that your scenario where you're just trying to sniff the traffic of some random person a network won't work that way.

When I said "hacking" I was referring to things like capturing credentials from traffic in a network or other important proprietary data.