[chmod]

Hello HC this is my little introduction to Wireshark. This tutorial will cover capturing cookies and passwords but there are a lot of other uses, I may cover some of them in other tutorials, so lets begin I'll assume you know how to install software so this won't be covered here. you can get Wireshark from wireshark.org.

First you need to start Wireshark and set the network adapter you are using, on Linux systems you will need to start Wireshark with superuser permissions



In my case I will be using wlp4s0 but your interface will most likely be different and click the green shark fin above to start capturing.

I will be using http://httprecipes.com/ for the purposes of this demonstration to keep my actual details safe



As you can see in the image I have set a cookie with the value "chocolate_chip" now back in Wireshark we can filter out our results to find what we are looking for easily. Head over to the filters bar and enter "http" (without quotes) to filter out only http traffic and scroll down until you find a "POST" heading and expand the "Hypertext Transfer Protocol" tab and the "POST" tab if they are not already and as you scroll down you will see

Code:

Cookie: test-cookie=chocolate_chip\r\n

I have highlighted the aforementioned sections in the next image to make it easier to spot



and that's it you have captured the cookie of your victim, you can now use something like greasemonkey for Firefox to inject this into your browser and hijack the session of the victim.

passwords work in much the same way again I will use httprecipes to keep my details safe and use their login form to capture the password as it is sent to the server.



back in Wireshark we set the filter to http again and are looking for another "POST" heading, this time head down to the bottom and expand "Line-based text data: " there you will find

Code:

uid=username&pwd=password

Again I have highlighted this in the image so you can see more clearly



And that's all there is to it, as for how to protect yourself: use a strong password for your router with WPA2 encryption turn off WPS and for extra security use a VPN or TOR which encrypt your packets as they leave your computer making this type of attack useless

[Ex094]

Good job mate, this is a nice introduction to WireShark's general usage

[chmod]

Thanks didn't want to go too in depth with it I may expand on it at a later date

[ᴄʀᴀᴢʏ.ᴛᴜᴛs.ʙᴅ]

Hi can you make a tut on how to use it to find some ones ip threw skype?

[chmod]

Hi can you make a tut on how to use it to find some ones ip threw skype?

That's fairly simple and can be done using the correct filters and a little know how

first open up skype and click advanced check which port Skype uses then open up Wireshark and select the interface as per this tutorial then go to the filters box and enter:

ip.src == <yourip> and udp.srcport == <skypeport>

click apply or press enter, then interact with the user you are trying to resolve message call whatever.

This won't work if you are connected to a VPN though as the traffic will be encrypted and Wireshark will not be able to capture anything

[ᴄʀᴀᴢʏ.ᴛᴜᴛs.ʙᴅ]

Hi can you make a tut on how to use it to find some ones ip threw skype?

That's fairly simple and can be done using the correct filters and a little know how

first open up skype and click advanced check which port Skype uses then open up Wireshark and select the interface as per this tutorial then go to the filters box and enter:

ip.src == <yourip> and udp.srcport == <skypeport>

click apply or press enter, then interact with the user you are trying to resolve message call whatever.

This won't work if you are connected to a VPN though as the traffic will be encrypted and Wireshark will not be able to capture anything

Thanks mate i just owned my friends got all there ip lol they are angry! thanks again!

[chmod]

This is an ethical community don't use the information found on here for things like that or you will quickly find people won't help you

[bmchris]

Can I use Wireshark to find IP adresses of people who are connected in the same connexion as me ?

[chmod]

Can I use Wireshark to find IP adresses of people who are connected in the same connexion as me ?

You mean on the same local network? you can but there are far easier ways of doing it, look up "ping sweeps"

[hunt3r972]

Thanks for this. Does it work 100% like this or some factor can hide the result ?