How To Hack Wifi Using Wireshark On Mac

  

Jul 31, 2018  Sponsored Post: Use PASS WIFI to hack wireless networks! PASS WIFI application helps you hack into wireless networks and obtain passwords. It depends on the WiFi encryption type. If it's WPA/WPA2, start here. If it's WEP, start here. Basically, all you need is the MAC address when it comes to cracking WiFi passwords, but once you have control over the router, then knowing the IP is simple and important.

  • If you want to hack somebody's wifi, Wireshark software can do this. It sniffs the wifi packet, which is the main process in truly breaking into somebody's wireless connection.Obviously, it is unlawful, so be confirm that you are only trying it to experiment a network's safety, or for your personal learning motives.
  • Sep 21, 2016  I didn't have a chance to use it. Then fast forward I got Kali, then I randomly discovered it had WS. Well I'm in a coffeeshop now ready to continue my course Python and Ethical Hacking and was thinking about running wireshark. Keep in mind I didn't even find this article using the search terms Kali or Wireshark. That's how coincidental it is.

Wireshark Hacking tutorial : Wireshark is a complete package filled with network analysis tools. Wireshark is not only a packet sniffer but also a packet analyzer, password hacker, and a firewall. It can also detect any denial of service attack on your network and can identify possible hacker. Wireshark is also used sometimes as a tool to detect if anyone is spying on you.

Install wireshark on mac

In this Wireshark Hacking tutorial, we will discuss how Wireshark can be used in multiple ways. As already discussed, Wireshark can be used to capture and detect passwords as well as to secure your network from outside intruders. So lets start with our Wireshark tutorial.

Installing Wireshark:

Wireshark is available for free of cost. You can download Wireshark from its official website by clicking here. Fir Linux or Ubuntu users, you can find Wireshark packages on the above link of its homepage. After Downloading Wireshark, install it in your system and launch the application.

Wireshark Hacking tutorial:

Step 1: Capturing Packets:

First of all, we will learn to capture packets from Wireshark. After downloading and installing Wireshark, launch the application. Click the name of an Interface on then Interface list as shown below. Interface list contains your network adapters. If you are connected to a WiFi then select a Wireless Lan Adapter.

After selecting an Interface name, you can see the packets starting to show on your screen. These packets are being captured by Wireshark in real-time. You can stop packet capturing by clicking on the Stop button( A big Red Square button on the top left corner).

These packets are being captured from your network device. That means that these packets belongs to you and are coming or going out of your system. To capture the packets of other users connected on your Wireless network, enable promiscuous mode on your capture options.

Note: You can also see different color coding on your capture packets. These packets are color coded by default. For example: green is TCP traffic, dark blue is DNS traffic, light blue is UDP traffic, and black is TCP packets with problems. You can also add your custom color code by editing coloring mode in menu.

You can save these captured packets for later use. To save a packet, click on File and go to Export Packet Dissections. To open a Packet file, go to the main page and click on open.

Step 2: Filtering Packets:

Filtering is used to identify a specific packet. For example, you can filter a traffic received by your browser or from an application. You can also filter packets going through protocols such as DNS, HTTP or TCP.

You can also right-click on a packet and select follow TCP stream. This will automatically add a filter of that packet and Wireshark will show all the packets related to it.

Step 3: Inspecting Packets

Inspecting a packet helps you to analyze its details. This will let you know the origin of the packet and other details. To do so, click on a packet to select it and its details will be shown.

Right-click on any packet that looks important and select filter. This will show you all the related packets that have been captured.

This is just a basic Wireshark Hacking tutorial in which we discussed about capturing, filtering and analyzing packets. With Wireshark, you can secure your network, hack a network and even implement different network protocols.

Also Read: Hack Wifi Using Wireshark

This isn’t hacking. This is just information gathering

Computers communicate using networks. These networks could be on a local area network LAN or exposed to the internet. Network Sniffers are programs that capture low-level package data that is transmitted over a network. An attacker can analyze this information to discover valuable information such as user ids and passwords.

In this article, we will introduce you to common network sniffing techniques and tools used to sniff networks. We will also look at countermeasures that you can put in place to protect sensitive information been transmitted over a network.

Topics covered in this tutorial

Wifi

What is network sniffing?

Computers communicate by broadcasting messages on a network using IP addresses. Once a message has been sent on a network, the recipient computer with the matching IP address responds with its MAC address.

Network sniffing is the process of intercepting data packets sent over a network.This can be done by the specialized software program or hardware equipment. Sniffing can be used to;

  • Capture sensitive data such as login credentials
  • Eavesdrop on chat messages
  • Capture files have been transmitted over a network

The following are protocols that are vulnerable to sniffing

  • Telnet
  • Rlogin
  • HTTP
  • SMTP
  • NNTP
  • POP
  • FTP
  • IMAP

Using Wireshark To Find Hackers

The above protocols are vulnerable if login details are sent in plain text

Passive and Active Sniffing

Before we look at passive and active sniffing, let’s look at two major devices used to network computers; hubs and switches.

Install Wireshark On Mac

Wireshark

A hub works by sending broadcast messages to all output ports on it except the one that has sent the broadcast. The recipient computer responds to the broadcast message if the IP address matches. This means when using a hub, all the computers on a network can see the broadcast message. It operates at the physical layer (layer 1) of the OSI Model.

The diagram below illustrates how the hub works.

Using Wireshark Wifi

A switch works differently; it maps IP/MAC addresses to physical ports on it. Broadcast messages are sent to the physical ports that match the IP/MAC address configurations for the recipient computer. This means broadcast messages are only seen by the recipient computer. Switches operate at the data link layer (layer 2) and network layer (layer 3).

The diagram below illustrates how the switch works.

Passive sniffing is intercepting packages transmitted over a network that uses a hub. It is called passive sniffing because it is difficult to detect. It is also easy to perform as the hub sends broadcast messages to all the computers on the network.

Active sniffing is intercepting packages transmitted over a network that uses a switch. There are two main methods used to sniff switch linked networks, ARP Poisoning, and MAC flooding.

Hacking Activity: Sniff network traffic

In this practical scenario, we are going to use Wireshark to sniff data packets as they are transmitted over HTTP protocol. For this example, we will sniff the network using Wireshark, then login to a web application that does not use secure communication. We will login to a web application on http://www.techpanda.org/

The login address is This email address is being protected from spambots. You need JavaScript enabled to view it., and the password is Password2010.

Note: we will login to the web app for demonstration purposes only. The technique can also sniff data packets from other computers that are on the same network as the one that you are using to sniff. The sniffing is not only limited to techpanda.org, but also sniffs all HTTP and other protocols data packets.

Sniffing the network using Wireshark

The illustration below shows you the steps that you will carry out to complete this exercise without confusion

Download Wireshark from this link http://www.wireshark.org/download.html

  • Open Wireshark
  • You will get the following screen
  • Select the network interface you want to sniff. Note for this demonstration, we are using a wireless network connection. If you are on a local area network, then you should select the local area network interface.
  • Click on start button as shown above
  • Open your web browser and type in http://www.techpanda.org/
  • The login email is This email address is being protected from spambots. You need JavaScript enabled to view it. and the password is Password2010
  • Click on submit button
  • A successful logon should give you the following dashboard
  • Go back to Wireshark and stop the live capture

Wireshark Hack Wifi

  • Filter for HTTP protocol results only using the filter textbox
  • Locate the Info column and look for entries with the HTTP verb POST and click on it
  • Just below the log entries, there is a panel with a summary of captured data. Look for the summary that says Line-based text data: application/x-www-form-urlencoded
  • You should be able to view the plaintext values of all the POST variables submitted to the server via HTTP protocol.

What is a MAC Flooding?

MAC flooding is a network sniffing technique that floods the switch MAC table with fake MAC addresses. This leads to overloading the switch memory and makes it act as a hub. Once the switch has been compromised, it sends the broadcast messages to all computers on a network. This makes it possible to sniff data packets as they sent on the network.

Counter Measures against MAC flooding

  • Some switches have the port security feature. This feature can be used to limit the number of MAC addresses on the ports. It can also be used to maintain a secure MAC address table in addition to the one provided by the switch.
  • Authentication, Authorization and Accounting servers can be used to filter discovered MAC addresses.

Sniffing Counter Measures

  • Restriction to network physical media highly reduces the chances of a network sniffer been installed
  • Encrypting messages as they are transmitted over the network greatly reduces their value as they are difficult to decrypt.
  • Changing the network to a Secure Shell (SSH)network also reduces the chances of the network been sniffed.

Summary

How To Work Wireshark

  • Network sniffing is intercepting packages as they are transmitted over the network
  • Passive sniffing is done on a network that uses a hub. It is difficult to detect.
  • Active sniffing is done on a network that uses a switch. It is easy to detect.
  • MAC flooding works by flooding the MAC table address list with fake MAC addresses. This makes the switch to operate like a HUB
  • Security measures as outlined above can help protect the network against sniffing.