Wireshark is the world’s foremost network protocol analyzer. It lets
you see what’s happening on your network at a microscopic level. It is
the de facto (and often de jure) standard across many industries and
educational institutions.
This tutorial can be an angel and also devil in the same time, it
depends to you who use this tutorial for which purpose…me as a writer of
this tutorial just hope that all of you can use it in the right way ,
because I believe that no one from you want your password sniffed by
someone out there so don’t do that to others too
Disclaimer – Our tutorials are designed
to aid aspiring pen testers/security enthusiasts in learning new skills,
we only recommend that you test this tutorial on a system that belongs
to YOU. We do not accept responsibility for anyone who thinks it’s a
good idea to try to use this to attempt to hack systems that do not
belong to you
Requirements :
1. Wireshark Network Analyzer (wireshark.org)
2. Network Card (Wi-Fi Card, LAN Card, etc) fyi : for wi-fi it should support promiscious mode
Step 1: Start Wireshark and capture traffic
In Kali Linux you can start Wireshark by going to
Application > Kali Linux > Top 10 Security Tools > Wireshark
In Wireshark go to Capture > Interface and tick the interface that
applies to you. In my case, I am using a Wireless USB card, so I’ve
selected wlan0.
Ideally you could just press Start button here and Wireshark will
start capturing traffic. In case you missed this, you can always capture
traffic by going back to
Capture > Interface > Start
Step 2: Filter captured traffic for POST data
At this point Wireshark is listening to all network traffic and
capturing them. I opened a browser and signed in a website using my
username and password. When the authentication process was complete and I
was logged in, I went back and stopped the capture in Wireshark.
when wee type in your username, password and press the Login button,
it generates a a POST method (in short – you’re sending data to the
remote server).
To filter all traffic and locate POST data, type in the following in the filter section
http.request.method == “POST”
See screenshot below. It is showing 1 POST event.
Step 3: Analyze POST data for username and password
Now right click on that line and select
Follow TCP Steam
This will open a new Window that contains something like this:
So in this case,
username: sampleuser
password: e4b7c855be6e3d4307b8d6ba4cd4ab91
But hold on, e4b7c855be6e3d4307b8d6ba4cd4ab91 can’t be a real password. It must be a hash value.
to crack this password its simple just open new terminal window and type this :
and its looks like this:
- username: sampleuser
- password: e4b7c855be6e3d4307b8d6ba4cd4ab91:simplepassword