How To Hack HTTP Passwords With Wireshark

Most of the websites on the Internet use HTTP protocol for comunication which runs on Port 80, The data send to the server is Un-encrpypted and goes in plain text. If you are using HTTPS (Port 443), The data will be send to the server encrypted. When ever you enter the data in a Form, Your browser either sends a POST Or Get Request to the webserver, In most cases you will see POST method used in forms. Now most of the websites on the internet use Http protocol for the authentication, which enables an attacker on the local area network to sniff every thing that goes through that form, That's the reason why you see websites like Paypal, Ebay, Gmail with https.


In this tutorial, I will show you how a hacker can hack passwords sent via http to the server with wireshark. Wireshark is a network analysis tool used to capture and analyze all the packets being send from your computer to the server.

Attack Scenario

Let's suppose that you went to starbucks to have a coffee with your friend, You have connected to the wifi hotspot, An attacker comes in and starts wireshark and captures your HTTP Post passwords and therefore compromising your security.

How To Hack HTTP Passwords With Wireshark

Before, you i show you how to hack http passwords, i would like to let you know that for a successful capture, your network card should be in Promiscuous mode, which will enable to capture all the traffic going through your network.

Step 1 - First of all download wireshark from the official website and install it on your computer.

Step 2 - Next open up wireshark click on analyze and click on interfaces at the top.


Step 3 - Next choose the appropriate interface and click on start. Wireshark would start sniffing the network.

Step 4 - Continue sniffing for around 10 minutes. Step 5 - After 10minutes stop the packet sniffing by going to the capture menu and clicking on Stop.

In the mean time, Log into any website (For Testing Purposes), having http Authentication.

Step 6 - Next set the filter to http.request.method == "POST", This will enable it to capture all the HTTP Post request going through your computer. Start analyzing the packets and locate the website in which you logged in having http authentication.

Step 7 - Next click on Follow TCP stream. You will see the username and password that you entered. In this particular senario i logged in my wordpress account, where i entered the username:admin and password:rafayhackingarticles, Since wordpress uses http for authentication, The data that was entered was successfully captured.

Countermeasures

The best countermeasure would be to use a VPN, so that all the traffic would be encrpyted.

You Might Also like:

• Hack A Facebook Password With ARP Posinoning

Read More

Ethical Hacking Vs Penetration Testing

Recently a reader posted a comment on our previous post "jSQL Injection - Java GUI for Database Injection.", where he asked about the difference between Ethical hacking And Penetration testing, As i said in the reply of that comment that it has been highly debatable topic among security researchers and hackers. According to some people "Hacking" cannot be Ethical in any way and lots of people do not like to associate the term "Ethical hacker" with them. According to some people both of them have same meaning and the term "hacker" is used to attract people for their courses and training programs.


However, the opinion of the people on the other side is that "Ethical hacking" should not be confused with Penetration testing and both of them are different terminologies and have different goals.

According to Ec-Council:

Penetration Testing: 
A goal-oriented project of which the goal is the trophy and includes gaining privileged access by pre-conditional means. 

Ethical Hacking: 
A penetration test of which the goal is to discover trophies throughout the network within the predetermined project time limit.

I found a more better explanations for both of these terms on likedln group discussion:

A penetration test is a formal set of procedures that measure an organizations security, are sanctioned by the organizations business and seek to improve the organizations security. 

Hacking is a very broad term. It's original meaning was simply to program or create devices as creative outleta and for pleasure. It has now acquired a darker meaning though among practioners, both meanings are used and context defines the sense of it. 

A hacking approach, to Pen testing can be useful because it would seek to find novel means of penetration before an attacker does. It still needs to be sanctioned and it should be done with a view to maintaining the clients operational reliability. In short, the person doing the hacking should have real professional mastery and control of what they are doing. 

According to Pen-test.com:

Penetration testing is a more narrowly focused phrase, it deals with the process of finding flaws in a target environment with the goal of penetration systems, taking control of them. Penetration testing, as the name implies, is focused on penetration the target organization’s defenses, compromising systems and getting access to information.

Ethical hacking is an expansive term encompassing all hacking techniques, and computer attack techniques to find security flaws with the permission of the target owner and the goal of improving the target’s security while penetration testing is more focused on the process of finding vulnerabilities in a target environment. In short, penetration testing is a subset of ethical hacking.



I hope the above clears the difference between Ethical hacking and Penetration Testing.

Read More