Does Wireshark store credentials, allow printed titles

RBak
1 ●1 ●1

I'm working on filling out a STIG security checklist for Wireshark and WinPCap and I have 2 questions.

Does either piece of software store unencrypted passwords locally (such as for remote captures)?
Are there any hidden options to allow a header/footer or title to be added to printed material from either one?

I assume no for #2, but #1 was one I couldn't say for sure given my investigations on the web so far.

Thanks for your help,

Bob

1 Answer

Sort by » oldest newest most voted

13730 ●684 ●115

I would say yes, e.g., there are UATs (User Access Tables) where key material is stored in order to decrypt data streams; Wireshark can use SSL key dump files to use in decryption; remote capture setup information may contain key information.
There are no (hidden or otherwise) options to add header/footer (e.g., classification) to printed material.

PS: Do not forget to include NPcap into your evaluation, the capture engine slated as the replacement for WinPcap.

Please start posting anonymously - your entry will be published after you log in or create a new account.

Asked: 2018-10-11 16:15:48 +0000

Seen: 274 times

Last updated: Oct 11 '18