RE: WiFi sniffing need to be connected?

["Cor Rosielle" <cor () outpost24 com>]

Using WiFi you don't need a "connection" to an access point. You can simply
listen and record all radio traffic. Make sure your wireless adapter is in
monitor mode first:

  sudo ifconfig wlan0 down
  sudo iwconfig wlan0 mode monitor
  sudo ifconfig wlan0 up

Now start a sniffer and capture traffic for later analysis. It will include
a lot of packets you don't need. Just filter packets with TCP headers to get
the useful stuff. If the wireless traffic was not encrypted, you have all
data in plain text immediately. Because you did not connect to the access
point, no one can ever know you captured the traffic. Unless of course you
start bragging about it.

Cor


> -----Original Message-----
> From: listbounce () securityfocus com
> [mailto:listbounce () securityfocus com] On Behalf Of Nikhil Wagholikar
> Sent: zondag 4 juli 2010 16:24
> To: pen-test () securityfocus com
> Subject: Re: WiFi sniffing need to be connected?
>
> Hi Vinicius,
>
> In-order to sniff on a network, you obviously need to be connected to
> that network. Promisious mode concept comes after you are connected to
> the network. Also, you need to keep in mind, that sniffing on a
> switched network is not as straight forward as on Hub network. You
> need to do something extra like ARP cache poisioning in-order to sniff
> on switched network, else you'll land up sniffing your own data on
> given network.
>
> All the best!
>
> ---
> Nikhil Wagholikar
>
> On 2 July 2010 08:14, Vinicius Menezes <cotomax () yahoo com> wrote:
> > Hello guys,
> >
> > I´m trying to snif msn/mail messages throw wifi.
> >
> > It´s necessary be connected to one specific station or just set
> promiscus mode to get all traffic?
> > Thanks
> >
> >
> >
> >
> >
> > ---------------------------------------------------------------------
> ---
> > This list is sponsored by: Information Assurance Certification Review
> Board
> > Prove to peers and potential employers without a doubt that you can
> actually do a proper penetration test. IACRB CPT and CEPT certs require
> a full practical examination in order to become certified.
> > http://www.iacertification.org
> > ---------------------------------------------------------------------
> ---
> >
>
> -----------------------------------------------------------------------
> -
> This list is sponsored by: Information Assurance Certification Review
> Board
>
> Prove to peers and potential employers without a doubt that you can
> actually do a proper penetration test. IACRB CPT and CEPT certs require
> a full practical examination in order to become certified.
>
> http://www.iacertification.org
> -----------------------------------------------------------------------
> -



------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------