Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose there is a site which has a form and it send data through POST method over http (NOT HTTPS)?

I can access this website directly and also the victim's computer directly. How can i sniff what data was sent while posting form on that site by the victim's ip?

OS to be used: ubuntu 9.04

share|improve this question
Is this something we really should be helping with? It at least sounds malicious. – David Thornley Oct 9 '09 at 13:46
Sorry for not being clear. I said that I can access the website and victim's computer directly actually means that the VICTIM is my subnet and the also i can ping the website. To be precise, my ip address is Victim's ip address is us suppose). And the website has address Now, can u help. I tried using Wireshark but how do i see post traffic. – Abhijeet Rastogi Oct 10 '09 at 10:08
up vote 7 down vote accepted

Wireshark should help you. It is cross platform and allows you to sniff any packet that goes through the wire

share|improve this answer

The Firebug Extension for Firefox has a very convenient network traffic sniffer built in as well, it will show you all the info about your POST the response as well as what JavaScript functions were running and how long they took to run, all useful stuff when trying to figure out exactly what a website is doing behind the scenes. More information here.

share|improve this answer
Please add the Link :) Its missing – ukanth Oct 8 '09 at 13:00
Won't work in this situation, where the "victim" should not be aware of the sniffing. – Arjan Oct 8 '09 at 13:18

Capture the traffic and follow the TCP stream in Wireshark.

share|improve this answer

If the victim computer has WireShark installed, then probably you should run "tshark" in a script, save packets in a file and copy/mail the file to wherever you want. You can then open the file using wireshark and follow tcp stream of whichever connection interests you (HTTP POST ?). This is assuming you have control over the victim computer, WireShark is installed, and you want to capture packets without letting the victim know.

If WireShark is not installed then you can try arp-poisoning (for default gateway) the victim machine and divert all its traffic to you machine (assuming it is connected in the same broadcast domain). Your machine will need to "ip forward" all the traffic coming from victim machine to default gateway.

share|improve this answer

For a direct browser solution in Firefox (since WireShark has already been mentioned,) take a look at HTTPFox add-on. You can start it then hide it.

alt text

share|improve this answer
This only shows the traffic from one's own browser, not from the victim's browser. Aha, but that's why wrote "You can start it then hide it". – Arjan Oct 8 '09 at 13:48
Read the question - "I can access this website directly and also the victim's computer directly." – John T Oct 8 '09 at 15:19
True, but I assume the victim should not be aware of the peeking into the traffic. Still, I understand that you propose to hide it on the victim's computer -- just wanted others to understand that too. Here I am, making things much more complicated than they were. :-) (Yup, sorry about that.) – Arjan Oct 8 '09 at 22:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .