Editing Sniffing & Spoofing (section)

== Sniffing ==

Sniffing inspects network traffic in real-time, extracting headers, payloads, and session metadata. It uncovers credentials, tokens, and protocol weaknesses, and establishes situational awareness before or during exploitation.

=== Common Techniques ===

Capturing raw packets with promiscuous or monitor mode interfaces
Filtering traffic by IP, port, or protocol to isolate valuable data
Reassembling TCP streams to read clear-text credentials
Following unencrypted protocols (HTTP, Telnet, SMTP, FTP) for rapid intel
Leveraging port mirroring, SPAN, or hub-based topologies for full-duplex capture
Decrypting TLS when private keys or session secrets are available
Extracting files, images, and VoIP calls directly from packet flows
=== Tools ===

* [[Wireshark]] (GUI packet analyzer with deep protocol dissection)
* [[tcpdump]] (lightweight CLI sniffer for scripted captures)
* [[tshark]] (Wireshark’s CLI engine for remote or headless use)
* [[Bettercap]] (modular MITM framework with live packet capture)
* [[Zeek]] (formerly Bro; network security monitor that logs and scripts traffic events)
* [[Scapy]] (Python library for custom packet crafting and sniffing)
* [[pcapplus]]-based scripts (custom automation around libpcap)