24. Traffic Sniffing and Analysis
24.5 Why HTTP Leaks and HTTPS Protects; ARP Spoofing
Vartcha lab madhe tumhi swatah baghitla: HTTP var password plain text madhe jato. Koni madhe sniffing karat asel tar to saras vachto. HTTPS (TLS) sagla content encrypt karto – Wireshark la fakt Application Data (gibberish) disto, password nahi.
HTTP login -> Wireshark shows: username=admin&password=secret123 (readable)
HTTPS login -> Wireshark shows: Encrypted Application Data (unreadable)
Hech karan aapan Chapter 13 madhe Certbot ne HTTPS lavla – tumcha reels app cha login air madhe ughda jau naye mhanun.
ARP spoofing (man-in-the-middle), in concept. On a switch, an attacker sends fake ARP replies so that your traffic goes through their machine first, letting them sniff it. Tools like arpspoof/ettercap do this. Lab only, and only to understand the defence.
# concept only, on your own lab:
sudo sysctl -w net.ipv4.ip_forward=1 # forward traffic so victims still work
sudo arpspoof -i eth0 -t 192.168.56.20 192.168.56.1 # tell target the gateway is us
How defenders detect and prevent it:
| Defence | What it does |
|---|---|
| HTTPS everywhere / TLS | Even if traffic is captured, it is encrypted |
| Dynamic ARP Inspection, port security (switch) | Block forged ARP replies |
| Static ARP entries for critical hosts | Cannot be spoofed |
arpwatch / IDS |
Alerts when a MAC-to-IP mapping suddenly changes |
| VPN | Encrypts traffic end to end on untrusted networks |
Why this matters for security
This chapter is the strongest argument for HTTPS, VPNs and never sending secrets over plain HTTP. On public Wi-Fi especially, anything unencrypted can be read by someone nearby.
Ravindra Bagale's Tip
Students public Wi-Fi (cafe, station) var banking kartat HTTP site var – ha thet dhoka aahe. Nehmi HTTPS (lock chinh) bagha, ani shakya asel tar VPN vapra. Hach dhada tumhi tumchya students la aavarjun dya – to tyanchya rojchya jivanat upyogi aahe.
Lab
Repeat the DVWA login in Wireshark, but this time over an HTTPS site (any site with https://). Compare: on HTTP you saw the password; on HTTPS you see only Application Data. Write one line explaining why, and one line on how ARP spoofing would be detected by arpwatch.