Member Avatar for pahunrepublic

I am testing wireshark for learning purposes. I wanted to try out a tutorial that hacks a facebook account stealing cookie information. I couldn't manage to hack my facebook account because wireshark is sending me truncated packets that I can't get cookie info out of.
This topography of the network: my desktop PC is connected to the Internet to a hub (D-LINK router) via LAN (ethernet cable). I have a notebook connected to Internet via Wi-Fi to the same hub (D-LINK router). I access facebook on my notebook on WIN XP OS. I monitor the packets with wireshark on my desktop PC on Ubuntu 12.04 OS. I only get worthless truncated cookie information. Why is that?
My capture interfaces are:
- eth0
- Pseudo device that captures on all interfaces
- USb1
- USB 2
- lo

I tried to capture on all interfaces (except usb 1, 2) but the same thing. I can't get cookie information from my notebook. I only get NBNS, DNS, Browser, IGMP, SSDP protocol type of packets. I get some HTTP but not facebook cookie with 'datr' line.
It is just anoying. It seems so easy in the tutorial.
Anyone could help me with this?

  • 2 Contributors
  • 1 Reply
  • 264 Views
  • 3 Hours Discussion Span
  • Latest Post Latest Post by DeanMSands3

Dani AI

Generated

Short answer for : you’re not seeing the Facebook cookie because you aren’t capturing the right link‑layer (and/or the traffic is encrypted). Two separate issues are usually involved: switched/Wi‑Fi topology, and encryption/packet length settings.

Common, practical checks and fixes

  • Capture on the same device or medium. Run Wireshark on the notebook itself (simplest) or capture on the wireless interface of the desktop in monitor mode. Capturing on a wired port of a switched router will only show broadcasts and traffic to/from that port — that’s why you see NBNS/DNS/IGMP but not other clients’ unicast HTTP.
  • If the notebook is on Wi‑Fi, put the card into monitor mode (airmon‑ng or iwconfig) and capture the 802.11 radio frames on the AP channel; any/pseudo interfaces usually won’t give proper monitor‑mode radio headers.
  • If the WLAN uses WPA/WPA2 the payloads are encrypted. Wireshark can only decrypt them if you have the network passphrase and you captured the 4‑way handshake (and then configure decryption).
  • Facebook logins use HTTPS. Cookies set over TLS won’t show in a plain network capture unless you perform a proper HTTPS MITM (installing a trusted CA on the test client) — which is only appropriate in a lab on systems you control.

Quick commands you can try (on Ubuntu)

# list interfaces
sudo tcpdump -D

# capture full packets on a monitor interface created by airmon-ng
sudo airmon-ng start wlan0
sudo tcpdump -i mon0 -s 0 -w /tmp/wifi.pcap

# or capture full packets on wired
sudo tcpdump -i eth0 -s 0 -w /tmp/eth.pcap

In Wireshark’s Capture Options make sure “Limit each packet to [bytes]” is large (use 65535 or 0/no limit) and promiscuous mode is enabled.

Alternatives and cautions

  • Easiest: run the capture on the target machine (the notebook) and inspect HTTP(S) locally, or set up a lab with a hub or a switch port‑mirror.
  • Never intercept others’ traffic without explicit permission. Tutorials that show “stealing cookies” often assume an open hub and plain HTTP — that’s outdated for modern HTTPS/WPA networks.

As hinted, docs and discussions about “truncated cookies” point to these exact causes: wrong interface/mode, capture length, or encryption.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.