Sniffing

Sniffing

NOTE: Hacking is a illegal activity so don't try on anyone. this tutorial is Only for educational purpose. If you want to use this tutorial for miscellaneous purpose please stop reading.

What Is Sniffing?

Sniffing is the process of monitoring and capturing data packets transmitted over a network. Pen testers use sniffing to uncover insecure transmissions of sensitive information, like passwords or session cookies, especially on unencrypted (HTTP) sites.

Step 1: Understand Sniffing in Penetration Testing

Sniffing involves capturing network traffic to analyze data packets. It can reveal:

• Plaintext credentials (HTTP, FTP).
• Session tokens.
• Sensitive data transmitted insecurely.

Tools commonly used:

Wireshark: For packet capture and analysis.

Tcpdump: Command-line packet analyzer.

Burp Suite: For intercepting HTTP/HTTPS traffic.

Step 2: Set Up Your Environment

Install Required Tools:

• Install Wireshark
• Install Burp Suite

Configure Network Interface:

Ensure your machine is on the same network as the target website (if testing locally or in a lab). For remote testing, use a VPN or proxy to route traffic through your machine.

Step 3: Capture Traffic with Wireshark

Open Wireshark and select the active network interface (e.g., Wi-Fi or Ethernet).

Start Capturing:

Click the shark fin icon to begin capturing packets.

Filter traffic to focus on the target website (e.g., ip.addr == <target_IP>).

Analyze Packets:

• Look for HTTP traffic (unencrypted) to find sensitive data like usernames, passwords, or session IDs.
• Use the "Follow TCP Stream" feature to reconstruct conversations.

Step 4: Intercept Traffic with Burp Suite

• Configure Browser Proxy:

          Set your browser to use Burp Suite as a proxy (usually 127.0.0.1:8080).

• Enable Interception:

         In Burp Suite, go to the "Proxy" tab and turn on "Intercept".

• Browse the Target Website:

     Traffic will be captured in Burp Suite. Analyze requests/responses for vulnerabilities (e.g., insecure cookies, tokens).

Step 5: Analyze Findings

Identify Vulnerabilities:

• Plaintext credentials in HTTP traffic.
• Session fixation or insecure cookies.
• Lack of HTTPS (man-in-the-middle opportunities).

Document Findings:

• Take screenshots of captured data (e.g., Wireshark packets, Burp Suite requests).
• Create a report with diagrams showing the attack flow.

Step 6: Mitigation Recommendations

Encrypt Traffic: Ensure all communications use HTTPS (TLS/SSL).

Secure Cookies: Use Secure and HttpOnly flags.

Avoid Plaintext Protocols: Replace FTP, Telnet with SFTP, SSH.

Diagrams for Clarity

1. Sniffing Attack Flow:

   Attacker -> [Network] -> Captures Traffic -> Analyzes Packets -> Extracts Sensitive Data

1. Burp Suite Interception:

   Browser -> Burp Proxy -> Target Website

Legal Disclaimer : This tutorial is completely for educational purpose only. For any misuse of this tutorial by any means the author will not be held responsible. 

If you have any queries Please comment my posts.