How much data can packet sniffer steal?

Question

I know a packet sniffer is really powerful. It can sniff out password and images and so on. Can it sniff URL too? Meaning, if I put my authentication in URL instead of a cookie, will sniffer be able to obtain the authenticated session ID from the URL? What about hidden value in form based authentication? Are they all open to sniffer attacks?

Bascially there is no security in public network (non-https non-ssh)? Not sure how https can be safe as well. I mean, the first handshake attempt will already be sniffed before connection is established. Not sure how safe that would be.

Thank you.

Answer 1

Are they all open to sniffer attacks?

Yes.

Not sure how https can be safe as well.

You aren't reading enough, then.

Start here: http://en.wikipedia.org/wiki/Transport_Layer_Security#How_it_works

Then here: http://en.wikipedia.org/wiki/Transport_Layer_Security#Further_reading

Answer 2

A packet sniffer will see the full URL, as it's part of the HTTP GET request - likewise, it'll see hidden FORM items as these are sent across the wire as well (they're 'hidden' inasmuch as they're not visible on the page).

HTTPS is much safer than plain-text information exchange - even if the packets are acquired, there's no way of decrypting them without knowing specifics (private key) stored on the client machine, and these are transient so you wouldn't have much luck finding them.

Answer 3

This question is typical / normal. Encryption seems like a magic wand, but only when it is done right.

Unencrypted text: Every single bit of it is exposed. The cookie, the URL request, the browser you are using, forms, values and prompts, every image, the OS you are using, how many pieces of network equipment are between your computer and the web server, even what time you clicked on the link, down to the millisecond.

Encryption with SSL (https://...) encrypts that information in such a way that the key to the encryption never actually gets sent over the network. The handshake is kind of magic. A mathematical magic, but no less magical unless you have a goodly amount of study in fields like number theory.

I hope this helps. Cryptography is a hard concept to grasp, but critical to todays networks.

Answer 4

Any of the information in a packet is available to the packet sniffer. Of course encrypted data is in the packet itself but is at the same time not useful. Https establishes its connection using public key encryption then passes a shared key across the connection. Using public key encryption solves 2 problems: One being its very high cpu intensive to deal with public key encryption/decryption and Two allows a shared key to be passed not in the clear.