Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Suppose there is a site which has a form and it send data through POST method over http (NOT HTTPS)?

I can access this website directly and also the victim's computer directly. How can i sniff what data was sent while posting form on that site by the victim's ip?

OS to be used: ubuntu 9.04

share|improve this question
1  
Is this something we really should be helping with? It at least sounds malicious. –  David Thornley Oct 9 '09 at 13:46
    
Sorry for not being clear. I said that I can access the website and victim's computer directly actually means that the VICTIM is my subnet and the also i can ping the website. To be precise, my ip address is 10.100.98.73. Victim's ip address is 10.100.98.98(let us suppose). And the website has address 10.100.56.55:8090. Now, can u help. I tried using Wireshark but how do i see post traffic. –  shadyabhi Oct 10 '09 at 10:08
add comment

5 Answers

up vote 7 down vote accepted

Wireshark should help you. It is cross platform and allows you to sniff any packet that goes through the wire

share|improve this answer
add comment

Capture the traffic and follow the TCP stream in Wireshark.

share|improve this answer
add comment

If the victim computer has WireShark installed, then probably you should run "tshark" in a script, save packets in a file and copy/mail the file to wherever you want. You can then open the file using wireshark and follow tcp stream of whichever connection interests you (HTTP POST ?). This is assuming you have control over the victim computer, WireShark is installed, and you want to capture packets without letting the victim know.

If WireShark is not installed then you can try arp-poisoning (for default gateway) the victim machine and divert all its traffic to you machine (assuming it is connected in the same broadcast domain). Your machine will need to "ip forward" all the traffic coming from victim machine to default gateway.

share|improve this answer
add comment

For a direct browser solution in Firefox (since WireShark has already been mentioned,) take a look at HTTPFox add-on. You can start it then hide it.

alt text

share|improve this answer
    
This only shows the traffic from one's own browser, not from the victim's browser. Aha, but that's why wrote "You can start it then hide it". –  Arjan Oct 8 '09 at 13:48
    
Read the question - "I can access this website directly and also the victim's computer directly." –  John T Oct 8 '09 at 15:19
    
True, but I assume the victim should not be aware of the peeking into the traffic. Still, I understand that you propose to hide it on the victim's computer -- just wanted others to understand that too. Here I am, making things much more complicated than they were. :-) (Yup, sorry about that.) –  Arjan Oct 8 '09 at 22:43
add comment

The Firebug Extension for Firefox has a very convenient network traffic sniffer built in as well, it will show you all the info about your POST the response as well as what JavaScript functions were running and how long they took to run, all useful stuff when trying to figure out exactly what a website is doing behind the scenes. More information here.

share|improve this answer
    
Please add the Link :) Its missing –  ukanth Oct 8 '09 at 13:00
1  
Won't work in this situation, where the "victim" should not be aware of the sniffing. –  Arjan Oct 8 '09 at 13:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.