How to Sniff HTTP POST Password via Network Using Wireshark Network Analyzer?

<div dir="ltr" style="text-align: left;" trbidi="on"><ol style="text-align: left;"><div style="line-height: 0.19in; margin-bottom: 0in; text-align: left;"><span style="font-family: 'Trebuchet MS';"> </span><br /><div align="LEFT"><span style="font-family: 'Trebuchet MS';"><b><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="font-weight: normal;">How to Sniff HTTP POST Password via Network Using Wireshark Network Analyzer?</span></span></span></span></b></span><br /></div><span style="font-family: 'Trebuchet MS';"></span><br /><div align="LEFT"><span style="font-family: 'Trebuchet MS';"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: black;">Nowadays most website around the world more than 50% of them (in my opinion ) they didn't provide a secure access into a personal profile or some page that require authentication process where users input their username and password. As we know that data sent via port 80 (HTTP) was plain and without any encryption.</span></span></span></span></div><span style="font-family: 'Trebuchet MS';"></span><div align="LEFT"><span style="font-family: 'Trebuchet MS';"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: black;">This tutorial can be an angel and also devil in the same time, it depends to you who use this tutorial for which purpose…me as a writer of this tutorial just hope that all of you can be an angel and know the bad things can happen from it, because I believe that no one from you want your password sniffed by someone out there so don't do that to others too .</span></span></span></span></div><span style="font-family: 'Trebuchet MS';"><div align="LEFT"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: black;">Requirements :</span></span></span></div><div align="LEFT"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: black;">1.</span><span style="color: black;">Wireshark Network Analyzer (wireshark.org)</span></span></span></div><div align="LEFT"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: black;">2. Network Card (Wi-Fi Card, LAN Card, etc) fyi : for wi-fi it should support promiscious mode .</span></span></span></div><div align="LEFT"><br /><a name="more"></a><br /><br /></div></span></div><ol style="font-family: 'Trebuchet MS';"><li><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Before we go to step by step section, here's the scenario : v4L is an attacker and he was sitting and drink starbucks coffee with laptop on his table and he's connected to free wi-fi service there. He run Wireshark for a couple moment and he analyze the data sent across the network and he try to find the password that inputted by victim.</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Step by Step :</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><br /></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">1. Download your wireshark and install it (in Windows you just need to click NEXT and FINISH to install it), in Backtrack 5 it's already there. Run the program (Windows : double click the icon; Backtrack : open terminal and type wireshark).</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">from the picture above maybe your network card is different, just choose which one is your network card and click start..</span></span></span></div><div align="LEFT"><br /><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqVnGFly_hWI1Imf_sdnRBGDaAEqoffFZhhwMK4UsaTu_Cfos6YmD3O9lZbs9Y4SOiD4NZQvssk3aHI5kuETbhV-kqUD0tgthUb9T9Ge9zAKINaRAo_NUXj7fkK3rqlN0dY1zsdC85PC-O/s1600/wireshark0+%25281%2529.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="wireshark" border="0" height="328" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqVnGFly_hWI1Imf_sdnRBGDaAEqoffFZhhwMK4UsaTu_Cfos6YmD3O9lZbs9Y4SOiD4NZQvssk3aHI5kuETbhV-kqUD0tgthUb9T9Ge9zAKINaRAo_NUXj7fkK3rqlN0dY1zsdC85PC-O/s640/wireshark0+%25281%2529.jpg" title="wireshark" width="640" /></a></div><div style="line-height: 0.19in; margin-bottom: 0in; text-align: left;"></div><blockquote style="border: none; margin: 0 0 0 40px; padding: 0px;"><blockquote style="border: none; margin: 0 0 0 40px; padding: 0px;"><span style="font-size: small;"><span style="font-family: Trebuchet MS;"><br /></span></span></blockquote></blockquote><div align="LEFT"><b><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="font-weight: normal;">2. Victim with the same network with v4L was really love to open this two websit</span></span></span></span></b><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="font-weight: normal;">e.</span></span></span></span><b><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="font-weight: normal;"> </span></span></span></span></b><br /></div><div style="line-height: 0.19in; margin-bottom: 0in; text-align: left;"></div><blockquote style="border: none; margin: 0 0 0 40px; padding: 0px;"><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfGhIu4qb58j5OmuS5xkOcnPAfbFlbRa2HJT3XWs1vRti3CF3i92Y03ZgPcIKHlvN9MDGst_etFzP8fAS0HYylFtgGXQykHMiu7dWvH3Mw7bjw2wm8yRMgp0_WDx-9qxckpo_xebj7jfN3/s1600/wireshark1.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="wireshark" border="0" height="146" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfGhIu4qb58j5OmuS5xkOcnPAfbFlbRa2HJT3XWs1vRti3CF3i92Y03ZgPcIKHlvN9MDGst_etFzP8fAS0HYylFtgGXQykHMiu7dWvH3Mw7bjw2wm8yRMgp0_WDx-9qxckpo_xebj7jfN3/s400/wireshark1.jpg" title="wireshark-1" width="400" /></a></div><blockquote style="border: none; margin: 0 0 0 40px; padding: 0px;"><span style="font-size: small;"><span style="font-family: Trebuchet MS;"><br /></span></span></blockquote></blockquote><br /> <div align="LEFT"><b><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="font-weight: normal;">3. After victim open that two websites, wireshark on attacker computer catch some data cross the network.</span></span></span></span></b><br /></div><blockquote style="border: none; margin: 0 0 0 40px; padding: 0px;"><div style="line-height: 0.19in; margin-bottom: 0in; text-align: left;"></div><blockquote style="border: none; margin: 0 0 0 40px; padding: 0px;"><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlNqLLewCC9VvdULwXI25Gr4Lpl-xu7y32cQwLB7tSzm8grHOwt1UlViqnPJ1p82O2sPnNnUIMaHtrWJhA29xirpsbdE4byZCF22e9GeYv8V7InL8g0L2l7CvBFcWXL3qFZYtRyUtMeQGB/s1600/wireshark3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="wireshark" border="0" height="166" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlNqLLewCC9VvdULwXI25Gr4Lpl-xu7y32cQwLB7tSzm8grHOwt1UlViqnPJ1p82O2sPnNnUIMaHtrWJhA29xirpsbdE4byZCF22e9GeYv8V7InL8g0L2l7CvBFcWXL3qFZYtRyUtMeQGB/s400/wireshark3.jpg" title="wireshark-3" width="400" /></a></div><div style="line-height: 0.19in; margin-bottom: 0in; text-align: left;"><br /></div></blockquote></blockquote><div style="line-height: 0.19in; margin-bottom: 0in; text-align: left;"><div align="LEFT"><b><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="font-weight: normal;">4. After some times then attacker stop capturing the packet on the network by click the button (see picture) to stop Wireshark Network Analyzer from capturing the packet.</span></span></span></span></b><br /></div></div><blockquote style="border: none; margin: 0 0 0 40px; padding: 0px;"><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7qOEnH5WGabTU2veAxsfxb5YLgB1tV90S6xi2PxoDUqeokh2rmUYTfE2eD3l_dJ_SvtRV2lSZKn83UvXGIDz9vkDGnJGL8gurkF0UvU_VoaWFpGQN32fbRsNAMFbXcFoX-U-P0_6ojuqX/s1600/wireshark4.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="wireshark" border="0" height="127" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7qOEnH5WGabTU2veAxsfxb5YLgB1tV90S6xi2PxoDUqeokh2rmUYTfE2eD3l_dJ_SvtRV2lSZKn83UvXGIDz9vkDGnJGL8gurkF0UvU_VoaWFpGQN32fbRsNAMFbXcFoX-U-P0_6ojuqX/s320/wireshark4.jpg" title="wireshark-4" width="320" /></a></div><blockquote style="border: none; margin: 0 0 0 40px; padding: 0px;"><span style="font-size: small;"><span style="font-family: Trebuchet MS;"><br /></span></span></blockquote></blockquote><div align="LEFT"><b><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="font-weight: normal;">5. If you learn about web programming, you should know that data from FORM can be sent with two method POST or GET (for details about this POST and GET definitions you can google for it).<br />The attacker know that authentication process should be use POST method for data transmission, then v4L use the filter feature in Wireshark to just only filter the HTTP POST method.</span></span></span></span></b><br /></div><div style="line-height: 0.19in; margin-bottom: 0in; text-align: left;"></div></li></ol><div class="separator" style="clear: both; font-family: 'Trebuchet MS'; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhijtHJUprQTjtbWP-6KBgE0oy6xq9YEhtZBidJkhoYod4cajSwGk7sBgBGNgRelxl96sed2UsdfVVLL-4g28sYJg9bh7N_Ip_x5vvU0kyJh5lGSDu2rbg-7R9I5uMvo2koTxUR6htKaiqd/s1600/wireshark5.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="wireshark" border="0" height="352" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhijtHJUprQTjtbWP-6KBgE0oy6xq9YEhtZBidJkhoYod4cajSwGk7sBgBGNgRelxl96sed2UsdfVVLL-4g28sYJg9bh7N_Ip_x5vvU0kyJh5lGSDu2rbg-7R9I5uMvo2koTxUR6htKaiqd/s640/wireshark5.jpg" title="wireshar-5" width="640" /></a></div><div style="font-family: 'Trebuchet MS'; line-height: 0.19in; margin-bottom: 0in; text-align: left;"><span style="font-size: small;"><span style="font-family: Trebuchet MS;">                                 http:.request.method == "POST"<br />                                  <br />    </span></span><b style="line-height: 0.19in;"><span style="color: black;">      <span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="font-weight: normal;">then press ENTER or click Apply.</span></span></span></span></b><br /><br /><ol> <ol start="6"><li><div align="LEFT" style="line-height: 0.19in; margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">If you only see the filter result, maybe you can be a little confused with the data contents over there. We can expand the data, but it's too many information that can make us hard to read one by one the data over there. For the simple thing we can use the ”Follow TCP Stream“ feature. Choose the data, right click and choose Follow TCP Stream.</span></span></span></div></li></ol></ol><div align="LEFT"><br /></div></div><div class="separator" style="clear: both; font-family: 'Trebuchet MS'; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjTY6hXoBuRGifbKKfyWFC4jnbiKuGfTjZqPBo3e4OAzxDU1KipS6QhFkADGgsHMfhowDwoQN7p6_CkpeedkV3kXRJuK-4gpLRG0hJ7eqU21jfZCxNdFRlZd031MsSmh9sxtb2MX7u-jllk/s1600/wireshark6.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="wireshark" border="0" height="275" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjTY6hXoBuRGifbKKfyWFC4jnbiKuGfTjZqPBo3e4OAzxDU1KipS6QhFkADGgsHMfhowDwoQN7p6_CkpeedkV3kXRJuK-4gpLRG0hJ7eqU21jfZCxNdFRlZd031MsSmh9sxtb2MX7u-jllk/s640/wireshark6.jpg" title="wireshark-6" width="640" /></a></div><div style="font-family: 'Trebuchet MS'; line-height: 0.19in; margin-bottom: 0in; text-align: left;">                         <br /><b style="line-height: 0.19in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="font-weight: normal;">Here's the result after we make it more readable by human.</span></span></span></span></b><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9Jl7PyZsb71HNZkmJtKCPhCauoAL1mhH8sbj-iNlGHu5XXjilGqbdaMnEzz9C9IH01TAru5te34JcHQLhrJMT7Lny6yh4WUHWVrUrf5lz03mTswStl23_NpMrc_jIOaehfwR7yrltqwtJ/s1600/wireshark7.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="wireshark" border="0" height="304" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9Jl7PyZsb71HNZkmJtKCPhCauoAL1mhH8sbj-iNlGHu5XXjilGqbdaMnEzz9C9IH01TAru5te34JcHQLhrJMT7Lny6yh4WUHWVrUrf5lz03mTswStl23_NpMrc_jIOaehfwR7yrltqwtJ/s400/wireshark7.jpg" title="wireshark-7" width="400" /></a></div></div><ol start="7"><li> <div align="LEFT"><b><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="font-weight: normal;"> oops the username and password was visible there. .</span></span></span></span></b></div><ol></ol></li></ol><ol style="font-family: 'Trebuchet MS';"></ol></ol></div>

How to Sniff HTTP POST Password via Network Using Wireshark Network Analyzer?

How to Sniff HTTP POST Password via Network Using Wireshark Network Analyzer? Nowadays most website around the world more than 50% o...

+ Read more »