Hello guys, and welcome to another video in this chapter.
In this video, we are going to learn
how to decrypt previously captured Wi-fi traffic with Wireshark.
When you use a Wi-fi network that uses WPA
to Encryption, the security of your station is based on two things.
The first is the Password that's used to
generate a much longer number, phk or pcrk.
The second is the actual handshake itself,
which has to happen to establish a connection.
If an Attacker has an PSK
to the Wi-fi network and neither observes you joined the network or gives you
off for a moment, they can decrypt your Wi-fi traffic to see what you're doing.
The content of HTTP Website won't be able
to be seen, but any plane HTTP websites you visit, but any plane HTTP websites you
visit or any insecure HTTP requests apps on your phone make hiding in plain view.
This may not seem like a big deal, but in only 60 seconds it's easy to learn a lot
about the type of device we are monitoring and what exactly is running on it.
Also, DNS requests to resolve the domains that apps need to talk to in order to work
are easy to see identifying which apps and services are active.
So as discussed in the previous video, you will need a wireless network adapter card
capable of wireless monitor mode in order to do this.
Next, you will need an IOS or android
device connected to the Wi-fi network that you are currently monitoring.
You can also practice this on an open
Wi-fi network to see what you're supposed to see.
Sometimes Decryption may not work for the first time.
You will also keep in mind that you will also need to
know the password and network name of the Wi-fi network you want to monitor.
This will allow you to calculate the
pre shared key allowing us to decrypt the traffic in real time.
So let's just jump right into it and see how it is done in Wireshark.
So once you open Wireshark and capture the
desired Wi-fi traffic or in this case, as I did, I opened the previously captured.
Wi-Fi traffic by a device trying to log
into the Wi-fi network so you can see that?
This is without Decryption, we can only see.
Mac addresses of the data transfer
participants, some types of package, the payload is decrypted and you can see
not destination IP addresses, everything is encrypted.
So we can decrypt this, a conversation that we see in front of us in order
to do so, we will need to add the Wi-fi password in Wireshark.
So in order to do that, you have to go.
To edit preferences.
And under protocols in the window.
You will have to go all the way down and search for.
I eight zero dot 11.
So remember that you need
these to be enabled and able Decryption and you have to add the keys.
So in the new popup window.
You can see that you can select the key type and also you can type the key.
So for this session, we're going to add the.
The Wi-fi Password, as we said, and then
and after selecting from the drop down menu.
You can go ahead in the key section area,
you will type the Password and in this case, the Password.
Is induction press enter and then.
OK, so this is complete.
So once this is complete.
You can see that Wireshark attempted to decrypt the packets.
So now you can see that we are able to identify a source IPS and
destination IPS destination IPS through out all the
Wi-fi traffic capture that we have in front of us.
So just like that makes Wi-fi networks a very risky thing to trust.
This kind of monitoring may seem invasive,
but you should keep in mind that your Internet Service Provider also keeps a log
of this information and has the right to sell the information.
If you want to prevent this kind of snooping.
You should get a VPN that allows you to
hide even local traffic behind strong and Encryption in a place where you might be
doing something sensitive over a data connection.
You should also consider using cellular data.
You should also consider using cellular
data whenever possible to prevent this kind of attack.
I hope you enjoyed this video, too, using Wireshark to spy on Wi-fi traffic.
And now you can go ahead and click on the next video.
Are you going to learn to sniff the
activity over user interfaces and how to do analysis a query.