monitoring a network
if one were to capture packets sent to an AP, could they determine what website and/or applications the computer has visited/used throughout the duration of the capture? and what program should be used to analyze these packets?
wireshark is the one I know off my head, and if the data is encrypted you won't be able to decrypt it easily unless you have the key and whatever else is required to decrypt.
website and/or applications are heavily dependant on the filters and your knowledge. Maybe making kismet and running layer7 through kis device.
In either case why don't you setup an advanced AP that could do much more than just a small crappy AP?
Both urlsnarf and webspy are able to strip put the visited URL addresses from a cap file. You will however need to replay the captured file on the lo interface using for example tcpreplay in order for this to work.Originally Posted by benzslr123
-Monkeys are like nature's humans.
thanks for the advice
Tron,
Can webspy or urlsnarp be utilized "on the fly" ?
They both function fine in a live manner alongside a MITM attack using for example ettercap.
-Monkeys are like nature's humans.
If you are lazy and just want to see the pictures, driftnet will monitor the interface and show you the multimedia content.
When using Driftnet, you must always be aware of the "meantime to goatse".
A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.
I feel like this gets asked many times over and over and theres no definitive guide.
I have gotten driftnet,urlspy, etc to work "on the fly" using airtun.
I put my card in monitor mode and start capturing packets, then create a tunnel interface from my card to "atX" and use wireshark/driftnet/etc to sniff on atX.
The only problem is that there is no rhyme or reason on what works or what doesnt. Some images come in, some websites do, but others dont and theres no explanation as to why. If someone can offer some more insight on this, I would be very interested.
I also too am very interested on why sometimes some sites work and some others do not. I am on my own network and i can use driftnet to view my own pictures as i go about online. but then i have a labtop next to me and i log on to facebook or something and nothing happens. I'm on my same wireless router and everything. I don't get it...
Posting Permissions
