How to Spy on Traffic from a Smartphone with Wireshark « Null Byte :: WonderHowTo

So you want to know what that person who is always on their phone is up to? If you're on the same Wi-Fi network, it's as simple as openingWiresharkand configuring a few settings. We'll use the tool to decrypt WPA2 network traffic so we can spy on which applications a phone is running in real time.While using an encrypted network is better than using an open one, the advantage disappears if the attacker is on the same network. If someone else knows the password to the Wi-Fi network you are using, it's easy to see what you're doing at that moment using Wireshark. It can allow an attacker to create a list of every app running on the device being targeted and zero in on apps that might be vulnerable.Decrypting Encrypted PacketsWhen you use a Wi-Fi network that uses WPA2 encryption, the security of your session is based on two things. The first is the password that's used to generate a much longer number, a PSK or pre-shared key. The second is the actual handshake itself, which has to happen to establish a connection. If an attacker has the PSK to the Wi-Fi network and either observes you join the network or kicks you off for a moment, they can decrypt your Wi-Fi traffic to see what you're doing.Don't Miss:Detect Script-Kiddie Wi-Fi Jamming with WiresharkThe content of HTTPS websites won't be able to be seen, but any plain HTTP websites you visit or any insecure HTTP requests apps on your phone makes are in plain view. This may not seem like a big deal, but in only 60 seconds, it's easy to learn a lot about the type of device we're monitoring and what exactly is running on it. Also, DNS requests to resolve the domains that apps need to talk to in order to work are easy to see, identifying which apps and services are active.How It WorksTo pull off this attack, a few conditions need to be met. First, we need the password, we need to be in proximity to the victim so we can record traffic, and we need to be able to kick the targeted device off the network or wait for them to reconnect. We'll open Wireshark and access the menu to decrypt Wi-Fi packets, add the PSK to enable decryption, and wait for EAPOL packets from the targeted device connecting to the network.To get a feeling for what the targeted device is up to, we'll be using capture filters to highlight DNS and HTTP packets we're looking for. To see a complete list of every domain the device has resolved, we can also look at a summary of resolved domains after the capture is complete. We can use this information to easily pick apart which services are running, even if they're only running in the background and the app hasn't been running in quite some time.Don't Miss:Intercept Images from a Security Camera Using WiresharkWhat You'll NeedTo do this, you'll need awireless network adapter cardcapable of wireless monitor mode. You can check out our guides onselecting one that's Kali-compatibleand supports monitor mode.More Info:Buy the Best Wireless Network Adapter for Wi-Fi Hacking in 2019Next, you'll need an iOS or Android smartphone connected to the Wi-Fi network you're monitoring. You can practice this on an open Wi-Fi network to see what you're supposed to see, as sometimes decryption may not work the first time. You'll also need to know the password and network name of the Wi-Fi network you want to monitor. This will allow you to calculate the pre-shared key, allowing us to decrypt the traffic in realtime.Step 1: Download Wireshark & Connect to the Wi-Fi NetworkDownload and installWireshark if it's not already installed, and connect to the Wi-Fi network your target is on. If you plan to use a PSK rather than a network key, you should calculate itusing the Wireshark toolbefore doing so, because you may not be able to access the internet during the capture, depending on your card.Once you have Wireshark downloaded, open it, then take a look at your network interfaces. Before we start capturing, we'll need to set a few things up to make sure the card is capturing in the correct mode.Step 2: Set Up Wireshark for CapturingUnder the Wireshark menu option, click on the gear-shaped "Capture options" menu.That will open theCapture Interfaceswindow, as seen below.Step 3: Begin the Network Capture & Scan for EAPOL PacketsIf you're not connected to the network your target is on, then you won't be able to see any packets because you might be on some other random channel. Wireshark can't actually change the channel that the wireless network adapter is on, so if you're not getting anything, that could be why.Step 4: Decrypt Traffic with the Network PSKNow that we have handshakes, we can decrypt the conversation from this point onwards. To do so, we'll need to add the network password or PSK. Go to the "Wireshark" drop-down menu and select the "Preferences" option. Once selected, click on "Protocols."Under Protocols, select "IEEE 802.11," and then click "Enable decryption." To add the network key, click "Edit" next to "Decryption keys" to open the window to add passwords and PSKs.Select "wpa-psk" from the menu, and then paste in your key. HitTab, then save by clicking "OK."Once this is complete, click "OK" on thePreferencesmenu, and Wireshark should rescan all the captured packets and attempt to decrypt them. This may not work for a variety of reasons. I was able to get it to work most of the time by ensuring I had a good handshake (EAPOL) and switching back and forth between using a network password and a PSK. If it works, we can move on to the step of analyzing the traffic to pick out apps in use.Step 5: Scan for DNS & HTTP PacketsNow that we have stripped away the protection around the traffic, Wireshark can decrypt them and tell us what the devices on this Wi-Fi network that we have handshakes for are doing in real time.1. DNS RequestsTo see interesting packets, we'll start with DNS requests. DNS requests are how apps make sure the IP addresses they are supposed to connect to haven't changed. They'll be directed to domain names that usually have the name of the app in them, making it trivial to see which app is running on the iPhone or Android phone and making the requests.Don't Miss:Use Driftnet to See What Kind of Images Your Neighbor Looks AtTo see these requests, we'll be using two capture filters,dnsandhttp, which will show us the most obvious fingerprints that an app leaves over Wi-Fi. First, typednsinto the capture filter bar and hitEnter. If this doesn't work, try switching between a PSK and password a few times. It sucks, but sometimes it will start working.If your target is feeling lonely, you might see the response below. Tinder calls the Tindersparks.com domain, as well as a lot of other services. This request is one of the most obvious.While using Signal is a good idea, using it with a VPN is a better idea. The reason? Even opening Signal creates the exchange below, clearly identifying that the user is communicating with an encrypted messenger.Trying to find that song that's playing with Shazam leaves the following fingerprint.Opening the app to call an Uber creates the requests you see below.Below, we see the effect of opening Venmo, and app for transferring money. It seems like a good time to redirect this request elsewhere.2. HTTP PacketsNext up, we can see there are several insecure web requests by using thehttpcapture filter. These capture filters contain information like the useragent, which will tell us the type of device that is connecting. We can examine this by clicking on the packets and expanding the "Hypertext Transfer Protocol" tab.In this example, we can see insecure HTTP requests to a chat server. What the heck is this? Merely examining the packet and resolving the domain gives us the answer right away. It's WeChat! This phone has WeChat installed, and further, the communications coming out of it are not entirely encrypted.If we want to see everything that was resolved, we can click on the "Statistics" menu tab and select "Resolved Addresses" to see all the domains that were resolved throughout the capture. This should be a laundry list of services the device is connecting to via the apps running on it.This breakdown makes it even easier to see what the target was up to.Wireshark Makes Wi-Fi Networks a Risky Thing to TrustThis kind of monitoring may seem invasive, but you should keep in mind that your internet service provider also keeps a log of this information and has the right to sell the information. If you want to prevent this kind of snooping, you should get a VPN likeMullvadorPIAthat allows you to hide even local traffic behind strong encryption. In a place where you might be doing something sensitive over a data connection, you should also consider using cellular data whenever possible to prevent this kind of attack.I hope you enjoyed this guide to using Wireshark to spy on Wi-Fi traffic! If you have any questions about this tutorial on Wi-Fi decryption, leave a comment below, and feel free to reach me on Twitter@KodyKinzie.Don't Miss:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Kody/Null ByteRelatedHacking macOS:How to Sniff Passwords on a Mac in Real Time, Part 2 (Packet Analysis)How To:Intercept Images from a Security Camera Using WiresharkHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)How To:Securely Sniff Wi-Fi Packets with SniffglueHack Like a Pro:How to Spy on Anyone, Part 3 (Catching a Terrorist)Mac for Hackers:How to Set Up a MacOS System for Wi-Fi Packet CapturingHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)How To:Intercept Security Camera Footage Using the New Hak5 Plunder BugHow To:Hunt Down Wi-Fi Devices with a Directional AntennaHow To:Stealthfully Sniff Wi-Fi Activity Without Connecting to a Target RouterNetworking Foundations:Exploring UDP via Wireshark(Part 1)How To:Analyze Wi-Fi Data Captures with Jupyter NotebookHack Like a Pro:How to Create Your Own  PRISM-Like Spy ToolAdvice from a Real Hacker:How to Know if You've Been HackedNews:Say Goodbye to Texting & Driving, Thanks to This New App from SamsungHow To:Identify Antivirus Software Installed on a Target's Windows 10 PCHow To:Use Wireshark to Steal Your Own Local PasswordsNews:8 Wireshark Filters Every Wiretapper Uses to Spy on Web Conversations and Surfing HabitsHow To:Get Free Wi-Fi from Hotels & MoreHow To:Spy on Your "Buddy's" Network Traffic: An Intro to Wireshark and the OSI ModelNews:Network Admin? You Might Become a Criminal SoonHow To:Spy on the Web Traffic for Any Computers on Your Network: An Intro to ARP PoisoningHow To:Play Spy!News:House Approves Amendment To Limit Pentagon Drones Spying On AmericansHack Like a Pro:Creating Your Own Prism Program