Mustajar Ahmad Shah Wiretapping
Mustajar Ahmad Shah
Wiretapping
Out Line• Introduction• What is sniffer• Sniffing Threats• How a sniffer Work• Type of Sniffing• Protocol vulnerable to sniffing• Tools to Sniff Network Traffic• How to setup a Sniffing Attack• How to protect your self from Sniffing• Tools to detect sniffer on a network
Wire tapping is process of monitoring the Telephone and Internet conversation by third party.
What is Wiretapping
Type of Wiretapping
Active Wiretapping
It only Monitors and Records the traffic
Passive Wiretapping
It Monitors ,Records and also Alter the Traffic
A Sniffer is a packet-capturing or frame-capturing tool.
It basically captures and displays the data as it is being transmitted from host to host on the network.
What is a Sniffer
Sniffing Threats
A Sniffer turns the NIC of a system into Promiscuous(pro-mis-cu-os) mode so that it listen all the data transmitted on its segment.
Sniffer can constantly Read all the information entering to the computer through NIC by Decoding the Information encapsulated in Data Packet.
How a Sniffer Works
There are Two types of Sniffing Attack
Type of Sniffing
Active Sniffing
Passive Sniffing
Passive Sniffing
“Passive Sniffing “mean sniffing trough a Hub.
Passive Sniffing Involves sending no packets, and Monitoring the Packets sent by others.
But Hub Usage is Outdated today.
Active Sniffing
When Sniffing is performed on a Switched network, is known as “Active Sniffing”.
Active Sniffing Relies on Injecting Packets (ARP) into the Network, that Cause traffic.
Telnet and
RloginHTTP SMTP NNTP POP FTP IMAP
Keystrokes including User Name & Passwords
Data sent in clear text
Password and data sent in clear text
Password and data sent in clear text
Protocol Vulnerable to Sniffing
SPAN Port
SPAN Port is Port which is configure to Receive a Copy of Every Packet that passes
through a Switch
Sniffing Tools
Sniffing Tools
WireShark
TCP Dump
Cain & Able
Capsa
WireShark
Cain and Abel
Capsa
How to Attack
How to Attack
Sniffing Password
Step # 1: Run Wireshark
Step # 2: Select you NIC
Step # 3: Start Capturing
Step # 4: my target login to a HTTP site
Step # 5: Stop Capturing & find Word “Password”
in your capture.
Step # 6: Here I got the MD5 hash of password
Step # 7:Decrypt MD5 Hash to get Password
How to Defend against Sniffing
Restrict the physical access to the network media to ensure that a packet sniffer cannot be installed
Use Encryption to protect confidential information
Permanently Add MAC address of the Gateway to ARP cache
Use static IP Address and Static ARP tables to prevent attacker from adding the spoofed ARP entries for machines in the network
Turn off network identification broadcasts and if possible restrict the network to authorized users in order to protect network form being with sniffing tools
Use UPv6 instead of IPv4 protocol
Use encrypted session such as SSJ instead of Telnet, Secure Copy (SCP) instead of FTP, SSL for E-mail connection, etc. to protect wireless network users against sniffing attack.
How to Defend against Sniffing
How to Detect Sniffing ?
Use Network ToolsSuch as HP
Performance insight to monitor the
network for strange Packets
Use IDS
Detect Promiscuous
Mode
Tools to Detect Promiscuous Mode
PromQry UI By Microsoft
PromiScan
Thank You