How to Securely Sniff Wi-Fi Packets with Sniffglue « Null Byte :: WonderHowTo

Sniffing packets over a network is an easy way for hackers to gather information on a target without needing to do much work. But doing so can be risky if sniffing packets on an untrusted network because a payload within the packets being captured could be executed on your system. To prevent that, Sniffglue sandboxes packet sniffing to provide an extra layer of security.Passive sniffing is stealthy and effective, making it the obvious first step for hackers and pentesters putting together information about a target network. But if you've ever runWiresharkas root before, you might have seen a warning against running it as root. That's because doing so can put your computer at risk, and running a program as root and then having it being hijacked by a zero-day vulnerability is a real risk when capturing random radio traffic.It's very unsecure running Wireshark this way as every possible Wireshark exploit will be running with the administrator account being able to compromise the whole system.—WiresharkThat means that if an exploit for Wireshark is found or known to some already, that exploit will be able to run as root on your computer if you run Wireshark as root. Because we deal with so many unknowns when receiving radio data, it's essential to take steps to minimize the damage that could occur.The proper way to avoid radio zero-days is to set up a user that can use the network adapter but can't execute as root. However, it can be confusing for someone setting things up their first time.Don't Miss:Detect & Classify Wi-Fi Jamming Packets with the NodeMCUFor anyone interested in packet sniffing with a program that has security features against these risks built-in, Sniffglue is it. It's a passive recon tool that lets you sniff traffic over a network without the risk of being detected. Unlike anARP-scanor other active scanning tools, Sniffglue passively listens for traffic without doing anything to generate the traffic itself, as doing so would reveal its presence.One of the keys to this is sandboxing, which Sniffglue builds in by default. The application itself is prevented from doing anything it doesn't need to do, avoiding an exploit from getting the same kind of traction. Written in Rust to be optimized for using all available CPU resources for processing packets, the additional attention to security makes Sniffglue worth trying out.What You'll NeedTo use Sniffglue, you'll need a computer withRustinstalled, since the program is written in the Rust language. I recommend using Kali Linux, Ubuntu, or another Debian or Arch Linux system. I tried running this on macOS and found it pretty difficult. Chances are, you already have Rust installed because it comes preinstalled on some systems. For instance, we already had it on a fresh Kali system.Before going further, installlibseccomp-devandlibpcap-dev, which is for the secure computing module and the pcap parsing, respectively.~$ sudo apt-get install libseccomp-dev libpcap-dev

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
  libseccomp2
The following packages will be upgraded:
  libseccomp-dev libseccomp2
2 upgraded, 0 newly installed, 0 to remove and 1760 not upgraded.
Need to get 0 B/116 kB of archives.
After this operation, 68.6 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Reading changelogs... Done
(Reading database ... 411760 files and directories currently installed.)
Preparing to unpack .../libseccomp-dev_2.4.2-2_amd64.deb ...
Unpacking libseccomp-dev:amd64 (2.4.2-2) over (2.4.1-2) ...
Preparing to unpack .../libseccomp2_2.4.2-2_amd64.deb ...
Unpacking libseccomp2:amd64 (2.4.2-2) over (2.4.1-2) ...
Setting up libseccomp2:amd64 (2.4.2-2) ...
Setting up libseccomp-dev:amd64 (2.4.2-2) ...
Processing triggers for man-db (2.8.5-2) ...
Processing triggers for libc-bin (2.28-8) ...

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be upgraded:
  libpcap-dev
1 upgraded, 0 newly installed, 0 to remove and 1759 not upgraded.
Need to get 0 B/29.0 kB of archives.
After this operation, 2,048 B of additional disk space will be used.
Reading changelogs... Done
(Reading database ... 411761 files and directories currently installed.)
Preparing to unpack .../libpcap-dev_1.9.1-2_amd64.deb ...
Unpacking libpcap-dev:amd64 (1.9.1-2) over (1.9.0-2) ...
Setting up libpcap-dev:amd64 (1.9.1-2) ...Step 1: Download & Install SniffglueDownloading and running the Sniffglue program is done using Cargo, the package manager for Rust, which is similar to Pip for Python for anyone familiar with that. Afterinstalling Rust, if you didn't already have it, Cargo should be installed by default.After updating your system, make sure you have Cargo installed by runningapt install cargo. A lot of different packages should compile. Then, run thecargo install sniffgluecommand to install Sniffglue via the Cargo package manager or to see if Snifglue is already installed, which is should be after installing Cargo.~$ apt update

Hit:1 http://archive.linux.duke.edu/kalilinux/kali kali-rolling InRelease
Reading package lists... Done
Building dependency tree
Reading state information... Done
1759 packages can be upgraded. Run 'apt list --upgradable' to see them.

~$ apt install cargo

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
  libgit2-27
Use 'apt autoremove' to remove it.
The following additional packages will be installed:
  libc-bin libc-dev-bin libc-l10n libc6 libc6-dbg libc6-dev libc6-i386
  libgit2-28 locales locales-all
Suggested packages:
  cargo-doc glibc-doc
...
Setting up cargo (0.37.0-3+b1) ...
Setting up libc6-i386 (2.29-3) ...
Setting up libc-dev-bin (2.29-3) ...
Setting up libc6-dev:amd64 (2.29-3) ...
Processing triggers for man-db (2.8.5-2) ...
Processing triggers for libc-bin (2.29-3) ...

~$ cargo install sniffglue

    Updating crates.io index
error: binary `sniffglue` already exists in destination as part of `sniffglue v0.9.0`
Add --force to overwriteStep 2: Run Cargo BinaryNow, we can either spend the time adding Sniffglue to our path or just navigate to the directory Cargo installs Sniffglue into to run it directly. Let's go directly to where the binary is (cd ~/.cargo/bin) and run it withsudo ./sniffglue -h. We should see the output for the help file, signaling that Sniffglue is installed and ready to run.~$ cd ~/.cargo/bin
~/.cargo/bin$ sudo ./sniffglue -h

sniffglue 0.9.0
kpcyrd <git@rxv.cc>
Secure multithreaded packet sniffer

USAGE:
    sniffglue [FLAGS] [OPTIONS] [device]

FLAGS:
    -d, --detailed    Detailed output
    -h, --help        Prints help information
    -j, --json        Json output (unstable)
    -p, --promisc     Set device to promisc
    -r, --read        Open device as pcap file
    -V, --version     Prints version information
    -v, --verbose     Show more packets (maximum: 4)

OPTIONS:
    -n, --cpus <cpus>    Number of cores

ARGS:
    <device>    Device for sniffingStep 3: Sniff on a Network InterfaceNow, let's sniff on a network interface. First, we'll find the name of our network cards by runningip a | grep MULTICAST.~/.cargo/bin$ ip a | grep MULTICAST

2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
3: wlp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000Then, run Sniffglue on the interface you want to start sniffing packets on.~/.cargo/bin$ sudo ./sniffglue enp2s0

Listening on device: "enp2s0"

50:7b:9d:7a:c8:8a -> 40:70:09:85:d1:a7, udp 192.168.0.37:57251 -> 209.18.47.62:53 dns req, (A, "null-byte.wonderhowto.com")

50:7b:9d:7a:c8:8a -> 40:70:09:85:d1:a7, udp 192.168.0.37:50381 -> 209.18.47.62:53 dns req, (AAAA, "null-byte.wonderhowto.com")

40:70:09:85:d1:a7 -> 50:7b:9d:7a:c8:8a, udp 209.18.47.62:53 -> 192.168.0.37:57251 dns resp, ("null-byte.wonderhowto.com", A(104.193.19.59))

40:70:09:85:d1:a7 -> 50:7b:9d:7a:c8:8a, udp 209.18.47.62:53 -> 192.168.0.37:50381 dns resp,Here, we are sniffing our Ethernet card, enp2s0, and we can see DNS requests to Null Byte. If we were plugged into a LAN tap or Hak5 Packet Squirrel, we could easily read any unencrypted traffic passing through a cable we have access to.Step 4: Sniff Wi-Fi in Promiscuous ModeNext, we'll turn our attention to our wireless card. First, we can get the name of our card by runningip aagain and filtering the output.~/.cargo/bin$ ip a | grep MULTICAST

2: enp2s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
3: wlp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000Then, on our system, we'll run Sniffglue with the-dargument to show more detail from each request, and the-pargument to put our card into promiscuous mode. In the example below, I navigated to "badsite.com" after starting to sniff the wireless traffic on card wlp1s0.~/.cargo/bin$ sudo ./sniffglue wlp1s0 -d -p

Listening on device: "wlp1s0"
eth: EthernetFrame { source_mac: MacAddress([48, 82, 203, 107, 118, 95]), dest_mac: MacAddress([64, 112, 9, 133, 209, 167]), ethertype: IPv4 }
    ipv4: IPv4Header { version: 4, ihl: 20, tos: 0, length: 73, id: 44379, flags: 2, fragment_offset: 0, ttl: 64, protocol: UDP, chksum: 52279, source_addr: 192.168.0.24, dest_addr: 209.18.47.62 }
        udp: UdpHeader { source_port: 43195, dest_port: 53, length: 53, checksum: 13395 }
            dns: Request(Request { questions: [(A, "googleads.g.doubleclick.net")] })
eth: EthernetFrame { source_mac: MacAddress([64, 112, 9, 133, 209, 167]), dest_mac: MacAddress([48, 82, 203, 107, 118, 95]), ethertype: IPv4 }
    ipv4: IPv4Header { version: 4, ihl: 20, tos: 0, length: 114, id: 51085, flags: 2, fragment_offset: 0, ttl: 57, protocol: UDP, chksum: 47324, source_addr: 209.18.47.62, dest_addr: 192.168.0.24 }
        udp: UdpHeader { source_port: 53, dest_port: 43195, length: 94, checksum: 33904 }
            dns: Response(Response { answers: [("googleads.g.doubleclick.net", CNAME("pagead46.l.doubleclick.net")), ("pagead46.l.doubleclick.net", A(172.217.14.66))] })
eth: EthernetFrame { source_mac: MacAddress([48, 82, 203, 107, 118, 95]), dest_mac: MacAddress([64, 112, 9, 133, 209, 167]), ethertype: IPv4 }
    ipv4: IPv4Header { version: 4, ihl: 20, tos: 0, length: 60, id: 45283, flags: 2, fragment_offset: 0, ttl: 64, protocol: UDP, chksum: 51388, source_addr: 192.168.0.24, dest_addr: 209.18.47.62 }
        udp: UdpHeader { source_port: 33734, dest_port: 53, length: 40, checksum: 35194 }
            dns: Request(Request { questions: [(AAAA, "www.google.com")] })
eth: EthernetFrame { source_mac: MacAddress([64, 112, 9, 133, 209, 167]), dest_mac: MacAddress([48, 82, 203, 107, 118, 95]), ethertype: IPv4 }
    ipv4: IPv4Header { version: 4, ihl: 20, tos: 0, length: 88, id: 41776, flags: 2, fragment_offset: 0, ttl: 57, protocol: UDP, chksum: 56659, source_addr: 209.18.47.62, dest_addr: 192.168.0.24 }
        udp: UdpHeader { source_port: 53, dest_port: 33734, length: 68, checksum: 49539 }
            dns: Response(Response { answers: [("www.google.com", AAAA(2607:f8b0:4007:80c::2004))] })
eth: EthernetFrame { source_mac: MacAddress([48, 82, 203, 107, 118, 95]), dest_mac: MacAddress([64, 112, 9, 133, 209, 167]), ethertype: IPv4 }
    ipv4: IPv4Header { version: 4, ihl: 20, tos: 0, length: 569, id: 20264, flags: 2, fragment_offset: 0, ttl: 64, protocol: TCP, chksum: 30553, source_addr: 192.168.0.24, dest_addr: 172.217.4.164 }
        tcp: TcpHeader { source_port: 46596, dest_port: 443, sequence_no: 766031290, ack_no: 3289351807, data_offset: 8, reserved: 0, flag_urg: false, flag_ack: true, flag_psh: true, flag_rst: false, flag_syn: false, flag_fin: false, window: 229, checksum: 42372, urgent_pointer: 0, options: None }
            tls: ClientHello { hostname: Some("www.google.com") }
eth: EthernetFrame { source_mac: MacAddress([48, 82, 203, 107, 118, 95]), dest_mac: MacAddress([64, 112, 9, 133, 209, 167]), ethertype: IPv4 }
    ipv4: IPv4Header { version: 4, ihl: 20, tos: 0, length: 57, id: 45378, flags: 2, fragment_offset: 0, ttl: 64, protocol: UDP, chksum: 51296, source_addr: 192.168.0.24, dest_addr: 209.18.47.62 }
        udp: UdpHeader { source_port: 48260, dest_port: 53, length: 37, checksum: 40572 }
            dns: Request(Request { questions: [(A, "badsite.com")] })
eth: EthernetFrame { source_mac: MacAddress([64, 112, 9, 133, 209, 167]), dest_mac: MacAddress([48, 82, 203, 107, 118, 95]), ethertype: IPv4 }
    ipv4: IPv4Header { version: 4, ihl: 20, tos: 0, length: 89, id: 8256, flags: 2, fragment_offset: 0, ttl: 57, protocol: UDP, chksum: 24643, source_addr: 209.18.47.62, dest_addr: 192.168.0.24 }
        udp: UdpHeader { source_port: 53, dest_port: 48260, length: 69, checksum: 26142 }
            dns: Response(Response { answers: [("badsite.com", A(104.200.23.95)), ("badsite.com", A(104.200.22.130))] })
eth: EthernetFrame { source_mac: MacAddress([48, 82, 203, 107, 118, 95]), dest_mac: MacAddress([64, 112, 9, 133, 209, 167]), ethertype: IPv4 }
    ipv4: IPv4Header { version: 4, ihl: 20, tos: 0, length: 57, id: 45384, flags: 2, fragment_offset: 0, ttl: 64, protocol: UDP, chksum: 51290, source_addr: 192.168.0.24, dest_addr: 209.18.47.62 }
        udp: UdpHeader { source_port: 57772, dest_port: 53, length: 37, checksum: 61497 }
            dns: Request(Request { questions: [(AAAA, "badsite.com")] })
eth: EthernetFrame { source_mac: MacAddress([64, 112, 9, 133, 209, 167]), dest_mac: MacAddress([48, 82, 203, 107, 118, 95]), ethertype: IPv4 }
    ipv4: IPv4Header { version: 4, ihl: 20, tos: 0, length: 125, id: 46568, flags: 2, fragment_offset: 0, ttl: 57, protocol: UDP, chksum: 51830, source_addr: 209.18.47.62, dest_addr: 192.168.0.24 }
        udp: UdpHeader { source_port: 53, dest_port: 57772, length: 105, checksum: 44123 }
            dns: Response(Response { answers: [] })
eth: EthernetFrame { source_mac: MacAddress([48, 82, 203, 107, 118, 95]), dest_mac: MacAddress([64, 112, 9, 133, 209, 167]), ethertype: IPv4 }
    ipv4: IPv4Header { version: 4, ihl: 20, tos: 0, length: 371, id: 25136, flags: 2, fragment_offset: 0, ttl: 64, protocol: TCP, chksum: 38509, source_addr: 192.168.0.24, dest_addr: 104.200.23.95 }
        tcp: TcpHeader { source_port: 43706, dest_port: 80, sequence_no: 3479674440, ack_no: 2159468974, data_offset: 8, reserved: 0, flag_urg: false, flag_ack: true, flag_psh: true, flag_rst: false, flag_syn: false, flag_fin: false, window: 229, checksum: 33053, urgent_pointer: 0, options: None }
            http: "GET http://badsite.com/ HTTP/1.1" Request { method: "GET", uri: "/", version: "1.1", host: Some("badsite.com"), agent: Some("Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0"), referer: None, auth: None, cookies: None }
eth: EthernetFrame { source_mac: MacAddress([64, 112, 9, 133, 209, 167]), dest_mac: MacAddress([48, 82, 203, 107, 118, 95]), ethertype: IPv4 }
    ipv4: IPv4Header { version: 4, ihl: 20, tos: 0, length: 1040, id: 62478, flags: 2, fragment_offset: 0, ttl: 53, protocol: TCP, chksum: 3314, source_addr: 104.200.23.95, dest_addr: 192.168.0.24 }
        tcp: TcpHeader { source_port: 80, dest_port: 43706, sequence_no: 2159468974, ack_no: 3479674759, data_offset: 8, reserved: 0, flag_urg: false, flag_ack: true, flag_psh: false, flag_rst: false, flag_syn: false, flag_fin: true, window: 235, checksum: 55524, urgent_pointer: 0, options: None }
            remaining: "HTTP/1.1 302 Found\r\nServer: openresty/1.13.6.1\r\nDate: Mon, 24 Jun 2019 11:52:24 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\nLocation: http://www6.badsite.com/?s_token=1561377144.1272041333&kw=Best+Personal+Credit+Cards&term=Best%20Personal%20Credit%20Cards&term=Fast%20Online%20College%20Degrees&term=Job%20Posting%20Boards&term=Movie%20Media%20Server&backfill=0&tdfs=1\r\nX-Mtm-Path: 0\r\nVary: Accept-Language\r\nContent-Language: en\r\nSet-Cookie: mtm_delivered=WyJiYWRzaXRlLmNvbSIsImh0dHA6Ly93d3c2LmJhZHNpdGUuY29tLz9zX3Rva2VuPTE1NjEzNzcxNDQuMTI3MjA0MTMzMyZrdz1CZXN0K1BlcnNvbmFsK0NyZWRpdCtDYXJkcyZ0ZXJtPUJlc3QgUGVyc29uYWwgQ3JlZGl0IENhcmRzJnRlcm09RmFzdCBPbmxpbmUgQ29sbGVnZSBEZWdyZWVzJnRlcm09Sm9iIFBvc3RpbmcgQm9hcmRzJnRlcm09TW92aWUgTWVkaWEgU2VydmVyJmJhY2tmaWxsPTAmdGRmcz0xIiwxLCIyMDE5LTA2LTI0IDExOjUyOjI0IiwiMTU2MTM3NzE0NC4xMjcyMDQxMzMzIiw3NCxudWxsLG51bGxd:1hfNWK:v7-Oji2CCHg8ECfi3-6CthImT5w; expires=Mon, 24-Jun-2019 12:52:24 GMT; Max-Age=3600; Path=/\r\n\r\n"In just a few seconds, I sniffed traffic telling me the operating system of the computer making the request, the website requested, and even the entire website sent-in response encoded in HTML. I can even see the default search engine being used to make the request.Sniffglue Snoops on Network Traffic with Less RiskThanks to the sandboxing features of Sniffglue, you can learn about network activity without worrying about an exploit running as root on your system. That makes it a valuable tool for passive reconnaissance that can be run over SSH and only highlights useful information. Because Snifflglue leaves no trace of running on the network, unlike more active scanners, you can feel free to run this on any network without fear of being detected.I hope you enjoyed this guide to securely sniffing packets! If you have any questions about this tutorial on packet sniffing or you have a comment, ask below or feel free to reach me on Twitter@KodyKinzie.Don't Miss:Create Packets from Scratch with Scapy for Scanning & DoSingWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image via Kody/Null ByteRelatedMac for Hackers:How to Set Up a MacOS System for Wi-Fi Packet CapturingHow To:Detect Script-Kiddie Wi-Fi Jamming with WiresharkHow to Hack Wi-Fi:Cracking WEP Passwords with Aircrack-NgHow To:Keep Firesheep from hacking into your Facebook accountHow To:Inconspicuously Sniff Wi-Fi Data Packets Using an ESP8266How To:Hunt Down Wi-Fi Devices with a Directional AntennaHow to Hack Wi-Fi:Choosing a Wireless Adapter for HackingHow To:Use Ettercap to Intercept Passwords with ARP SpoofingHow To:Crack Wi-Fi Passwords—For Beginners!How To:Spy on Network Relationships with Airgraph-NgHow To:Build an FTP Password Sniffer with Scapy and PythonHow To:Intercept Images from a Security Camera Using WiresharkHow to Hack Wi-Fi:Disabling Security Cameras on Any Wireless Network with Aireplay-NgHow To:Pick an Antenna for Wi-Fi HackingHow To:Detect & Classify Wi-Fi Jamming Packets with the NodeMCUHow To:Spy on Traffic from a Smartphone with WiresharkHow To:Scan, Fake & Attack Wi-Fi Networks with the ESP8266-Based WiFi DeautherHow To:Detect When a Device Is Nearby with the ESP8266 Friend DetectorHow To:Identify Antivirus Software Installed on a Target's Windows 10 PCGuide:Wi-Fi Cards and ChipsetsHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow To:Track Wi-Fi Devices & Connect to Them Using ProbequestHow To:Enable Monitor Mode & Packet Injection on the Raspberry PiHow To:Hack Wi-Fi Networks with BettercapHow To:Check if Your Wireless Network Adapter Supports Monitor Mode & Packet InjectionHow To:Build a DNS Packet Sniffer with Scapy and PythonHow To:Use Kismet to Watch Wi-Fi User Activity Through WallsHow To:Use MDK3 for Advanced Wi-Fi JammingHow to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:Get Free Wi-Fi from Hotels & MoreHow To:Use Wireshark to Steal Your Own Local PasswordsHow To:How Hackers Steal Your Internet & How to Defend Against ItNews:PSP2 (Next Generation Portable) or NGP