24. Traffic Sniffing and Analysis
24.5 Why HTTP Leaks and HTTPS Protects; ARP Spoofing
Vartcha lab madhe tumhi swatah baghitla: HTTP var password plain text madhe jato. Koni madhe sniffing karat asel tar to saras vachto. HTTPS (TLS) sagla content encrypt karto – Wireshark la fakt Application Data (gibberish) disto, password nahi.
HTTP login -> Wireshark shows: username=admin&password=secret123 (readable)
HTTPS login -> Wireshark shows: Encrypted Application Data (unreadable)
Hech karan aapan Chapter 13 madhe Certbot ne HTTPS lavla – tumcha reels app cha login air madhe ughda jau naye mhanun.
ARP spoofing (man-in-the-middle), in concept. On a switch, an attacker sends fake ARP replies so that your traffic goes through their machine first, letting them sniff it. Tools like arpspoof/ettercap do this. Lab only, and only to understand the defence.
# concept only, on your own lab:
sudo sysctl -w net.ipv4.ip_forward=1 # forward traffic so victims still work
sudo arpspoof -i eth0 -t 192.168.56.20 192.168.56.1 # tell target the gateway is us
How defenders detect and prevent it:
| Defence | What it does |
|---|---|
| HTTPS everywhere / TLS | Even if traffic is captured, it is encrypted |
| Dynamic ARP Inspection, port security (switch) | Block forged ARP replies |
| Static ARP entries for critical hosts | Cannot be spoofed |
arpwatch / IDS |
Alerts when a MAC-to-IP mapping suddenly changes |
| VPN | Encrypts traffic end to end on untrusted networks |
Why this matters for security
This chapter is the strongest argument for HTTPS, VPNs and never sending secrets over plain HTTP. On public Wi-Fi especially, anything unencrypted can be read by someone nearby.
Ravindra Bagale's Tip
Students do banking on HTTP sites over public Wi-Fi (cafe, station) – that is a direct risk. Always look for HTTPS (the lock icon), and use a VPN if possible. Make sure you pass this lesson on to your own students too – it is useful in their everyday life.
Ravindra Bagale's Tip – मराठी
Students public Wi-Fi (cafe, station) वर HTTP site वर banking करतात – हा थेट धोका आहे. नेहमी HTTPS (lock चिन्ह) बघा, आणि शक्य असेल तर VPN वापरा. हाच धडा तुम्ही तुमच्या students ना आवर्जून द्या – तो त्यांच्या रोजच्या जीवनात उपयोगी आहे.
Ravindra Bagale's Tip – हिंदी
Students public Wi-Fi (cafe, station) पर HTTP site पर banking करते हैं – यह सीधा खतरा है. हमेशा HTTPS (lock का निशान) देखो, और हो सके तो VPN इस्तेमाल करो. यही सबक आप अपने students को ज़रूर दो – यह उनकी रोज़ की ज़िंदगी में काम आता है.
Lab
Repeat the DVWA login in Wireshark, but this time over an HTTPS site (any site with https://). Compare: on HTTP you saw the password; on HTTPS you see only Application Data. Write one line explaining why, and one line on how ARP spoofing would be detected by arpwatch.