6:39
How To Get Any Password With Wireshark!
GR1FF1N
Overview
This video demonstrates how to use Wireshark, a network protocol analyzer, to capture login credentials transmitted over unencrypted networks. It covers downloading and installing Wireshark, identifying network adapters, starting and stopping packet capture, and filtering traffic to find specific protocols like FTP. The presenter emphasizes that this technique is for educational purposes only and using captured credentials illegally is prohibited. The core concept relies on intercepting data sent over insecure protocols where sensitive information is not protected.
How was this?
Save this permanently with flashcards, quizzes, and AI chat
Chapters
- Wireshark is a tool for capturing and analyzing network traffic.
- Download Wireshark from its official website, avoiding sponsored links.
- Select the correct installer based on your operating system (Windows, macOS).
- Launch Wireshark and identify your primary network adapter (often the first one listed).
Understanding how to set up and start Wireshark is fundamental to capturing any network data, forming the basis for all subsequent analysis.
Selecting the 'Windows x64 installer' for a Windows machine or the appropriate version for macOS based on the processor type.
- The 'start capturing packets' button initiates the collection of network data.
- The red 'stop' button halts the packet capture process.
- Stopping capture is crucial to manage the data volume and prevent overwhelming the system.
Knowing how to control the capture process prevents the collection of excessive, irrelevant data, making the analysis phase more manageable and efficient.
Clicking the blue fin icon to start capturing traffic and then clicking the red square button to stop it.
- Network traffic contains a lot of 'noise' or irrelevant data.
- Filters are essential for isolating specific types of traffic, such as FTP.
- You can filter by protocol (e.g., 'ftp') or by IP address.
- Applying a filter significantly reduces the amount of data to review.
Effective filtering is critical for making sense of the vast amount of data Wireshark collects, allowing you to quickly find the information you're looking for.
Typing 'ftp' into the filter bar and pressing Enter twice to see only FTP traffic.
- After filtering, you can examine individual packets.
- The 'Follow TCP Stream' feature reconstructs a complete conversation between two devices.
- This stream view can reveal unencrypted login attempts, including usernames and passwords.
- The analysis shows the sequence of requests and responses, like login prompts and authentication failures.
Understanding how to follow a data stream allows you to see the context of captured packets, making it easier to identify and interpret sensitive information like credentials.
Right-clicking on an FTP packet and selecting 'Follow > TCP Stream' to see the full login attempt, including the entered username ('kali') and password ('pass').
- Capturing credentials typically requires two computers: one attacker and one victim.
- The victim's device must be using an unsecure protocol (e.g., HTTP, FTP, Telnet).
- The attacker runs Wireshark on their machine to capture traffic from the victim.
- This method is effective in environments like coffee shops where networks might be shared and unencrypted.
This highlights the specific network conditions and setup required for Wireshark to successfully capture unencrypted credentials, emphasizing the vulnerability of insecure protocols.
A user attempting to log into an FTP server using an anonymous username and password, with their traffic being captured by Wireshark on another device on the same network.
- Using Wireshark to capture credentials is for educational purposes only.
- Illegally using captured credentials to log into services is strictly prohibited and against the law.
- Even passive capture without explicit permission can have legal consequences.
- Always ensure you have proper authorization before attempting any network analysis.
It is crucial to understand the legal and ethical boundaries of using network analysis tools to prevent misuse and ensure responsible learning.
The explicit warning that even if you capture credentials passively, using them to log in without permission is illegal.
Key takeaways
- Wireshark is a powerful tool for network analysis that captures and displays packet data.
- Effective use of Wireshark involves starting/stopping captures and applying filters to manage data.
- The 'Follow TCP Stream' feature is vital for reconstructing conversations and identifying sensitive information.
- Wireshark can capture credentials only when they are transmitted over unencrypted (insecure) protocols.
- Understanding network protocols like FTP and HTTP is key to knowing what traffic to look for.
- Network security relies on using encrypted protocols (like HTTPS, SFTP) to protect data in transit.
- The use of network analysis tools must adhere to strict legal and ethical guidelines.
Key terms
WiresharkPacket CaptureNetwork AdapterNetwork TrafficFilteringProtocolFTPTCP StreamUnencrypted ProtocolCredentials
Test your understanding
- What is the primary function of Wireshark in network analysis?
- How does filtering traffic in Wireshark help in finding specific data like passwords?
- Why is it important to stop packet capture after collecting the necessary data?
- What conditions must be met for Wireshark to capture login credentials effectively?
- What are the legal implications of using captured credentials without authorization?