Wireshark 101: Wireshark with Social Networks; HakTip 131 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this hack tip is brought to you by the
all-new G flex 2 from LG life's good
welcome to hack tip the show will we
break down concepts tools and techniques
for hackers gurus and IT ninjas I'm
Shannon Morse and today we are figuring
out what sites are saving my passwords
in plain text using wireshark don't
don't done so let's start off with a
real-world example of just what happens
whenever I log into Twitter so this is
supposed to all go through SSL or HTTPS
encryption if this is so then I
shouldn't see any plaintext passwords
running around and Wireshark plaintext
is referred to a site whenever the site
is serving up your password for
everybody to see with no encryption
enabled whenever you log into their site
a website should never do this also they
should never store your password in
plain text but the general public has no
way of telling if they do so I always
recommend using a password manager for
most sites and using a different
randomly generated password for every
single website that's what managers are
awesome so when I log into Wireshark I
see all these TCP transactions I don't
see a bunch of HTTP ones like we showed
last week now I know that there are
these are gonna be from Twitter because
I did a quick whois lookup
of the IP address just because it was
easy I just stuck the iPad IP address in
the search bar of chrome and then I did
who is and then I just googled this
$1.99 and then ends and 3:9 IP address
and turns out yeah that's in San
Francisco and it belongs to Twitter
surprise now under the information
column over here we take a look
everything's in blue because I made it
blue because it's pretty so we have TCP
segment reassemble PDU a bunch that
start with four three three
acknowledgments so there's a bunch of
stuff going on over here so what does it
all mean
well I found a bunch of packets that
start with this 433 turns out 433 is
associated with SSL over HTTP okay so we
know that we found the login process for
logging into Twitter because the IP is
Twitter now next we can look for a
packet that says application data in the
information field so if I scroll down
here we go okay so here's a whole bunch
with application data in the info field
now if I scroll down to my middle
section here I'll go ahead and make that
a little bit bigger there's a section
down here called Secure Sockets Layer in
the middle window in a find max this
area out I should see a line of
encrypted data so on the very very
bottom down here we see encrypted
application data and then a whole bunch
of gobbledygook that doesn't make a lot
of sense now these packets are the
unreadable SSL version of your username
and your password and whatever else you
might be transmitting to Twitter boom I
found my encrypted password maybe but I
can't tell because it's encrypted
awesome Thank You Twitter for doing
things right now now I want to show you
some plaintext fine okay so I'm gonna go
ahead and open up a different file I
went ahead and just saved them all
because it was easier plaintext
passwords they're so scary boom so I
just happen to find a site called pop
culture calm au that serves up your
username and password and plaintext now
I need to mention here that I am for all
purposes attacking myself on my own
network I have been given full authority
to attack myself via Wireshark and this
is purely for demonstration purposes if
you plan to try this demo yourself do it
on a network that you are fully obliged
to do so on this site is in question is
not being attacked I am attacking myself
now first thing that you can notice
about sites like this is that they
default to http for example if you do it
on Internet explorer they don't default
to HTTPS hello HTTPS Everywhere awesome
browser add-on cool thing for Chrome now
when we log on we get a whole bunch of
HTT p-- ACK it's flowing from this
website now if I go ahead and click on
protocol one of the first things you
will see up here is these couple of HTTP
packets now one says customer account
login post that's kind of weird so if I
click on this one and then I scroll down
in this middle section because it says
customer account login posts that's kind
of interesting so I'll go ahead
scroll this up so it's a little bit
bigger if I scroll all the way down oh
look at that
hmm notice how you can see my username
and my password I am a dog is a cat
that's a terrible password Wow
seriously I was just sitting there doing
my cute little pink manicure last night
while I was surfing on Wireshark and I
was able to catch her my own login
details in plain text think about what
happens to folks that are just sitting
in a coffee shop login into plaintext
sites and all the stuff that they can
find out I mean what if somebody uses
the same username and password here that
they use on you know their tax documents
that they're trying to return this year
not good
somebody could steal your identity it's
not hard and this information is widely
available so dear web servers and
operators do me a favor and you know
just put some encryption on your site
just encrypt your stuff please just
default to HTTPS do something don't just
let people log in with plain text that's
such a bad idea
and don't store them in plain text
either now enough of my venting I wanted
to show you how that works and what it
looks like whenever you find these plain
text issues definitely let websites in
question know about the problem so that
they can fix it let me know what you
think of course you can send a comment
below or email us tips at hack 5 org and
be sure to check out our sister show
hack 5 for more great stuff just like
this I'll be there reminding you to
trust your tech molest
this hack tip is brought to you by the
all-new G flex 2 from LG life's good