Sniffing stealmylogin.com

asked 2019-05-09 11:08:26 +0000

ERGeorgiev
1 ●1 ●1 ●1

updated 2019-05-09 11:19:20 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

Hello!

I have been trying to sniff packets to stealmylogin.com and get the user/pass I entered in the forms after submit, but Wireshark is simply not getting them.

I used tracert to get stealmylogin.com ip address and then filtered in Wireshark with ip.addr, but to no avail, no packets available. The only packets I got to that website were some DNS protocol queries from the tracert, but nothing from firefox nor google when submitting the forms.

What am I doing wrong?

My method:

Start capturing packets in Wireshark on all available interfaces
Go to http://www.stealmylogin.com/demo.html and enter some username and password.
Submit and proceed within the website.
Stop capture in wireshark.
Try to filter by http.request.method == "POST"
No POST requests (only keep-alive ones with no info on them with OCSP protocol)

Note that I am using a proxy to access the net.

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2019-05-10 07:12:20 +0000

Packet_vlad

1055 ●5 ●75 ●32 http://packettrain.net

updated 2019-05-10 07:15:22 +0000

Try to use host stealmylogin.com as capture filter. It'll resolve the name and filter by corresponding IP.
BUT the site you're talking about is a bit more complex. You'll not spot any clear-text POST request as the second part (credentials transfer) uses different name (example.com) and is TLS-encrypted.

They clearly say the next:

If you look at the source code of the demo page, you'll see that we injected a malicious JavaScript file stealmylogin.js into the page, just as an attacker might. This malicious code steals the login info just before its being securely submitted to the service.

And this is exactly what's happening. After you go by http://www.stealmylogin.com/demo.html additional GET request is issued for the script named stealmylogin.js which is transferred gzipped.

The script captures your credentials, opens popup form with them. After you press the button an encrypted TLS session to example.com starts where your credentials are transferred further (using POST, but this POST is encrypted).

So you'll not be able to see any packets using http.request.method == "POST" just because there is no plain HTTP POST used for that and your data is transferred to different website.