Wiretapping

Mustajar Ahmad Shah

Wiretapping

Out Line• Introduction• What is sniffer• Sniffing Threats• How a sniffer Work• Type of Sniffing• Protocol vulnerable to sniffing• Tools to Sniff Network Traffic• How to setup a Sniffing Attack• How to protect your self from Sniffing• Tools to detect sniffer on a network

Wire tapping is process of monitoring the Telephone and Internet conversation by third party.

What is Wiretapping

Type of Wiretapping

Active Wiretapping

It only Monitors and Records the traffic

Passive Wiretapping

It Monitors ,Records and also Alter the Traffic

A Sniffer is a packet-capturing or frame-capturing tool.

It basically captures and displays the data as it is being transmitted from host to host on the network.

What is a Sniffer

Sniffing Threats

A Sniffer turns the NIC of a system into Promiscuous(pro-mis-cu-os) mode so that it listen all the data transmitted on its segment.

Sniffer can constantly Read all the information entering to the computer through NIC by Decoding the Information encapsulated in Data Packet.

How a Sniffer Works

There are Two types of Sniffing Attack

Type of Sniffing

Active Sniffing

Passive Sniffing

Passive Sniffing

“Passive Sniffing “mean sniffing trough a Hub.

Passive Sniffing Involves sending no packets, and Monitoring the Packets sent by others.

But Hub Usage is Outdated today.

Active Sniffing

When Sniffing is performed on a Switched network, is known as “Active Sniffing”.

Active Sniffing Relies on Injecting Packets (ARP) into the Network, that Cause traffic.

Telnet and

RloginHTTP SMTP NNTP POP FTP IMAP

Keystrokes including User Name & Passwords

Data sent in clear text

Password and data sent in clear text

Password and data sent in clear text

Protocol Vulnerable to Sniffing

SPAN Port

SPAN Port is Port which is configure to Receive a Copy of Every Packet that passes

through a Switch

Sniffing Tools

Sniffing Tools

WireShark

TCP Dump

Cain & Able

Capsa

WireShark

Cain and Abel

Capsa

How to Attack

How to Attack

Sniffing Password

Step # 1: Run Wireshark

Step # 2: Select you NIC

Step # 3: Start Capturing

Step # 4: my target login to a HTTP site

Step # 5: Stop Capturing & find Word “Password”

in your capture.

Step # 6: Here I got the MD5 hash of password

Step # 7:Decrypt MD5 Hash to get Password

How to Defend against Sniffing

Restrict the physical access to the network media to ensure that a packet sniffer cannot be installed

Use Encryption to protect confidential information

Permanently Add MAC address of the Gateway to ARP cache

Use static IP Address and Static ARP tables to prevent attacker from adding the spoofed ARP entries for machines in the network

Turn off network identification broadcasts and if possible restrict the network to authorized users in order to protect network form being with sniffing tools

Use UPv6 instead of IPv4 protocol

Use encrypted session such as SSJ instead of Telnet, Secure Copy (SCP) instead of FTP, SSL for E-mail connection, etc. to protect wireless network users against sniffing attack.

How to Defend against Sniffing

How to Detect Sniffing ?

Use Network ToolsSuch as HP

Performance insight to monitor the

network for strange Packets

Use IDS

Detect Promiscuous

Mode

Tools to Detect Promiscuous Mode

PromQry UI By Microsoft

PromiScan

Thank You