Hi and welcome back in this video, I'm going to show you how you can sniff usernames, passwords and
web pages using Wireshark.
Also known as a network sniffer, monitors Ne4 is a tool that can help you locate network problems by
allowing you to capture and view the packets on your network.
Wireshark is available for free at Wireshark website, and you can download for Windows, Linux and
other platforms.
But for this tutorial, I will use Wireshark from my Windows machine.
If you want to start Wireshark on Kali Linux, just open a terminal and type Wireshark and wait a few
seconds.
The protocols that will be analyzing are FTP and TCP.
F2P stands for File Transfer Protocol and FTP for Hypertext Transfer Protocol.
So let's get started.
Wireshark is really easy to use, actually.
All you have to do, first of all, is tell it which interfaces you want to capture.
So I will go up here and click capture options and interfaces.
And then I have to pick the correct interface, which I want to use.
So I'm going to select and press start, and now I will start capturing traffic on that interface.
Now, let's see.
I want to connect one FTP server on the internet.
So I will open up a file zilla connection to my way post and click Click Connect.
Now it's connecting to my web host online, using my username and password, which is a FTP password.
88.
So I will stop the CAPTCHA and close my connection.
And let's take a look at what we have.
So here is the CAPTCHA package.
As you can see, it's a ton of information, but FTP is the protocol I'm interested in and you can see
right here user first web and then the password, which is FTP Password 88.
If you follow the TCP IP stream, you can see the username and password.
Now I'm going to show you how to obtain the username and password from an FTP site.
So once again, click CAPTCHA interfaces and click Start.
Then you want to go to the site.
You are trying to steal the login information and type in the username and password.
I will put in test user and password.
Just let me in.
Now I will switch back to Wireshark and stop the CAPTCHA.
You also need to change the filter to HTP, request method equal, equal and in caps post.
This is just going to make the packet easier to find when you locate the packet again.
Use Left Click and select Follow TCP IP Stream.
As you can see, here is the user login and the password.
So since packet sniffing is so simple, it is important to know how to protect against the if you have
to put any important information made sure the site uses a HTTPS, which is a secure protocol.
So that's it for now.
Thanks for watching, and I'll see you next time.