0

Suppose there is a site which has a form and it send data through POST method over http (NOT HTTPS)?

I can access this website directly and also the victim's computer directly. How can i sniff what data was sent while posting form on that site by the victim's ip?

OS to be used: ubuntu 9.04

2
  • 1
    Is this something we really should be helping with? It at least sounds malicious. Oct 9, 2009 at 13:46
  • Sorry for not being clear. I said that I can access the website and victim's computer directly actually means that the VICTIM is my subnet and the also i can ping the website. To be precise, my ip address is 10.100.98.73. Victim's ip address is 10.100.98.98(let us suppose). And the website has address 10.100.56.55:8090. Now, can u help. I tried using Wireshark but how do i see post traffic. Oct 10, 2009 at 10:08

5 Answers 5

7

Wireshark should help you. It is cross platform and allows you to sniff any packet that goes through the wire

3

The Firebug Extension for Firefox has a very convenient network traffic sniffer built in as well, it will show you all the info about your POST the response as well as what JavaScript functions were running and how long they took to run, all useful stuff when trying to figure out exactly what a website is doing behind the scenes. More information here.

2
  • Please add the Link :) Its missing
    – ukanth
    Oct 8, 2009 at 13:00
  • 1
    Won't work in this situation, where the "victim" should not be aware of the sniffing.
    – Arjan
    Oct 8, 2009 at 13:18
2

Capture the traffic and follow the TCP stream in Wireshark.

1

If the victim computer has WireShark installed, then probably you should run "tshark" in a script, save packets in a file and copy/mail the file to wherever you want. You can then open the file using wireshark and follow tcp stream of whichever connection interests you (HTTP POST ?). This is assuming you have control over the victim computer, WireShark is installed, and you want to capture packets without letting the victim know.

If WireShark is not installed then you can try arp-poisoning (for default gateway) the victim machine and divert all its traffic to you machine (assuming it is connected in the same broadcast domain). Your machine will need to "ip forward" all the traffic coming from victim machine to default gateway.

1

For a direct browser solution in Firefox (since WireShark has already been mentioned,) take a look at HTTPFox add-on. You can start it then hide it.

alt text

3
  • This only shows the traffic from one's own browser, not from the victim's browser. Aha, but that's why wrote "You can start it then hide it".
    – Arjan
    Oct 8, 2009 at 13:48
  • Read the question - "I can access this website directly and also the victim's computer directly."
    – user1931
    Oct 8, 2009 at 15:19
  • True, but I assume the victim should not be aware of the peeking into the traffic. Still, I understand that you propose to hide it on the victim's computer -- just wanted others to understand that too. Here I am, making things much more complicated than they were. :-) (Yup, sorry about that.)
    – Arjan
    Oct 8, 2009 at 22:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .