Packet Sniffing

intermediateSupporting Technique

Using specialized tools like Wireshark to capture and analyze network packets containing user authentication data and session information.

Detailed Overview

Packet sniffing is the foundation of many session hijacking attacks. Tools like Wireshark, tcpdump, and ettercap allow attackers to capture raw network packets. These packets are then analyzed to extract cookies, session tokens, and other sensitive data. The technique works particularly well on shared networks where broadcast traffic is visible to all connected devices.

Prevention Strategies

01Encrypt all sensitive data transmission with TLS/SSL
02Use network segmentation and VLANs
03Implement port security on network switches
04Deploy intrusion detection systems (IDS)
05Monitor for promiscuous mode network adapters

Tools

Common software used to explore or defend against this technique.

Wireshark
tcpdump
ettercap
tshark

BYO — Build your code

Programmatic approaches that recreate what tools do — for learning, detection, and hardening on systems you are authorized to test.

Summarize flows with tshark CLI

bash

Shell wrapper that exports conversation stats from a capture for review.

#!/usr/bin/env bash
# Lab capture analysis only
PCAP="$1"
tshark -r "$PCAP" -q -z conv,tcp
tshark -r "$PCAP" -Y "http.cookie" -T fields -e http.cookie

Count protocols with Scapy

python

Quick inventory of protocols in a pcap to understand what's visible on the wire.

from collections import Counter
from scapy.all import rdpcap

counts: Counter[str] = Counter()
for pkt in rdpcap("lab.pcap"):
    counts[pkt.lastlayer().name] += 1

for name, n in counts.most_common(10):
    print(f"{name}: {n}")