Collaborate Disseminate
I am concerned that my Linux laptop has been compromised with malware that is remotely and regularly monitoring my activity. I ran Wireshark for a day to see if I could find any symptoms of data being exfiltrated (e.g. keylogs, screenshots… Continue reading What are some symptoms of malware exfiltrating data in packet captures?
I wanted to learn what would be the best way(s) to detect an Evil Twin attack on a private network. I see a lot of literature about detecting the attack in a public setting, which seems to make the solutions more complicated. I wonder if i… Continue reading Using Wireshark to detect Evil Twin attack in a private wireless network
I have captured the following with Wireshark. It looks very much like a AP beacon flood attack. The display filter used in Wireshark:
wlan.fc.type_subtype==8
I captured 1100 beacon frames in 15 minutes.
How to verify for sure it actually … Continue reading Is this wifi hacking? [closed]
Looking at a situation where two machines use a secure communication protocol like this:
Machine (or a VM) A <——–> Machine (or a VM) B
and I want to use Wireshark to capture the traffic between the two machines that are on the s… Continue reading For a proper traffic analysis between 2 computers, does wireshark need to be on a third laptop or just one of the two?
Client Hello should be encrypted in HTTP/3 and QUIC, but in Wireshark I can still see SNI of the QUIC connection when using DoH.
The names should be encrypted inside the Handshake/CRYPTO packets.
is this expected? is ECH the only way tha… Continue reading SNI visible in HTTP/3, QUIC connection?
I’m trying the view the HTTPS traffic from my own web application using Wireshark on the same machine, but I’m unable to decrypt the packages. This is what I tried:
First I created a hello world ASP.NET application with https enabled.
Nex… Continue reading Capturing HTTPS traffic on the server with the certificate [duplicate]
I’m testing a new proxy and monitoring the connection using Wireshark, but I’m not seeing any certificate at all. my goal is to find out exactly what sensitive and identifiable data is leaving my router after using this proxy, emphasizing … Continue reading How can I view the TLS 1.2 and 1.3 certificates in Wireshark? [migrated]
I tried tools like decode as, file > Export object> Http,none of them gave me the answer how can I decode it.
A few weeks ago I changed my ISP provider and router at home. It is a small network (less than 10 devices). From a user perspective everything seems to work correctly, nothing notable.
However, today I ran a Wireshark capture from one of t… Continue reading ISP-provided router sending constant ARP requests
I’m curious just how possible this is. I want to test this on a game I play, you can set a teleport spot by your X and Y coordinates, you can only set it to the spot you’re at. If I capture the packets on WireShark I can see the X and Y … Continue reading Game Replay Attacks Using WireShark – Is This Possible [closed]