How to capture data and passwords of unsecured wireless networks with SniffPass and SmartSniff
A few months ago, I released a new version of both SmartSniff and SniffPass with support for using them with Microsoft Network Monitor 3.x
In the release details, I also specified that 'Wifi Monitor Mode' button was added for using 'Monitor Mode' under Windows Vista/7/2008, but without giving extensive explanation about how to use this feature. So in this blog post, I'll add more details about this 'Wifi Monitor Mode' and how to use it on SmartSniff and SniffPass.
When a wireless network card enters into a 'Monitor Mode', it listens to specific channel that you choose and captures all the packets that are sent by wireless networks on your area in the specific channel that you selected. If the wireless network that sent the packet is unsecured, SmartSniff and SniffPass will be able to show you the packets data.
Before I start to explain you how to use this mode, here's the system requirements for using 'Monitor Mode':
- Unfortunately, this mode is only supported on Windows Vista, Windows 7, and Windows Server 2008. Windows XP is not supported.
- Both the network card and the device driver must support this mode. I currently don't have a list network cards that support this mode under Windows. However, if you manage to get your card into monitor mode, it'll be nice if you post your card model as comment to this Blog post.
Also, be aware that according to Microsoft, some Wifi drivers may cause a system crash when entering into monitor mode.
Finally, here's the instructions for using 'Wifi Monitor Mode' with SmartSniff and SniffPass:
- First, download and install the latest version of Microsoft Network Monitor 3.x if it's not already installed on your system.
- Run SmartSniff if you want to capture general TCP data or SniffPass if you only want to capture passwords. Be aware that SniffPass can only capture passwords that are not encrypted. Most Web sites and services of large companies use SSL to encrypt the passwords, and thus SniffPass cannot capture them.
- Go to the 'Capture Options' window (F9), choose 'Network Monitor Driver 3.x' as a capture method, and then click the 'Wifi Monitor Mode' button.
- In the opened 'Wifi Scanning Options' window, choose the right wireless card (in most cases you should have only one) and then check the 'Switch to Monitor Mode' option.
- You can now select to scan a single channel or to switch between multiple channels every x milliseconds. After you selected the desired channels, click the Apply button.
Wifi Scanning Options
- The most important thing: Leave this window opened !
When you close this window, the network card will exit from monitor mode and it'll return back to its normal state. - In 'Capture Options' window of SmartSniff/SniffPass - select the right wireless card and then press the 'Ok' .
- Finally, press F5 to start the capture. If you have any active unsecured networks in your area, you'll be able to see the captured data.
- After you finish, close the 'Wifi Scanning Options' window, so your wireless card will return back to normal.
The information in this article is provided for educational purposes only and for making people aware of the risks of using unsecured wireless networks. it's not intended to be used for any illegal activity.
November 9th, 2010 at 6:25 am
Hi,
works with an Intel Wireless WiFi Link 4965AGN!
Would be nice if the channel of the captured conversations could be shown ?
Thank you for all these GREAT tools, kind regards - StyrianOak
January 25th, 2011 at 7:12 am
thanks for your all software Nirsoft.
March 9th, 2011 at 11:12 pm
Dell Wireless 1395 WLAN Mini-Card does NOT work.
March 11th, 2011 at 9:06 pm
I have a TP-Link TL-WN951N which I believe has a Atheros chip(not sure) I followed the instructions and meet the system requirements but when I go to capture options and try to select Network Monitor Driver 3.x the option is grayed out does this mean no support?
March 22nd, 2011 at 11:47 pm
A Dell Wireless 1505 Draft 802.11n WLAN Mini-Card Works
March 24th, 2011 at 3:16 pm
Forge, I'm having the same problem. That option is grayed out... Can anyone help us?
April 5th, 2011 at 6:22 am
Works great with a TP-Link TL-WN651G PCI Card and Windows 7
Your utilities are the best! Thanks
April 18th, 2011 at 10:59 pm
Im using an Atheros AR9285 built in to my asus laptop and it doesnt seem to capture anything, however im low on unsecure networks nearby so going to test elsewhere and check for sure
I get the occasional UDP protocol from some local address which is clearly not within my own network so could be getting something from an outside network source, will investigate more
I heard a certain type of netgear usb wireless g devices work, looking for something that works good and is usb with wireless n, g and b myself anyone got any solid suggestions for a cheap usb wireless device that does b, g and n and can work with this stuff
Seen the software work flawlessly with local device my own computer activity it monitors and gets passwords and other stuff really good
Thanks
May 14th, 2011 at 6:25 pm
I'm very glad to use this feature!
Now I'm trying to do some projects with the api. However, I cannot find out how to switch to monitor mode with codes. Would you please help me?
Thanks~
June 2nd, 2011 at 3:41 pm
Realtek RTL8187W with Windows 7 ultimate 32 bits O.K. Thanks
July 15th, 2011 at 4:31 pm
works fine with Broadcom 4321AG 802.11a/b/g/draft-n Wi-Fi Adapter on Vista 32bit SP2
802.11a band does not expose all available channels but 802.11n mode does reveal more "a" band channels but still not all of the band 5GHz band allocation unlike 802.11g which exposes from 1 to 14.
Keep up the great work (the entire fleet of tools not just smartsniff)
August 18th, 2011 at 6:39 pm
It's greyed out here too. what does it mean, and can I fix it? please respond....
November 10th, 2011 at 5:39 am
Dell Wireless 1397 WLAN Mini-Card-- not the 1395 that other guy had-- works.
December 16th, 2011 at 12:40 am
Folks if the Network Monitor Driver 3.x the option is grayed out you need these two files. The files are Microsoft Network Monitor Driver 3.x and WinPCap. After installing them you will have the Network Monitor Driver 3.x the option. I had the same problem as you guys, option grayed out. These fixed it and it works great now.
http://www.microsoft.com/download/en/details.aspx?id=4865
http://www.winpcap.org/
February 18th, 2012 at 7:32 pm
does not work on a realtek 8187 usb or engenious 802.11n usb through win 7 ultimate 64
March 5th, 2012 at 5:27 pm
If it is greyed out then you need to make sure they are both the same bit size architecture. For example microsoft monitor driver is 64-bit then smartsniff needs to be 64-bit
March 29th, 2012 at 2:39 am
Got a Dell 1397 WLAN here, but Network Monitor Drive option is grayed out. Installed both the Network Monitor driver and the WinPCap, still grayed out.
April 20th, 2012 at 6:34 pm
First thanks for all your little great tools and that you give most of the for free. I developed some small open source modules for drupal so i share the concept
Works nicely with my wlan card. Much appreciated
ragards
andy
May 4th, 2012 at 2:56 am
the instruction is pretty simple but it will be nice if someone can make video tutorial for this..
May 7th, 2012 at 10:30 pm
Works with Intel(R) PRO/Wireless 3945ABG Network Connection with Win 7.
Thanks....
May 27th, 2012 at 7:16 am
Works with rlt8187, i.e. alfa 036h and Airlive WL-1700usb cards under windows 7. To bad not working with xp. I cannot find driver for these cards with which can be spoofed mac adress i I'm stuck with windows xp.
May 30th, 2012 at 7:41 pm
Interesting tool, I have been able to use it quite easily with my built-in LAN card on my MSI board. Love this stuff.
June 16th, 2012 at 5:45 pm
I have Network Monitor 3.4 but SmartSniff does not allow me to check the radio button under capture options, any ideas?
June 16th, 2012 at 5:58 pm
Fixed the above problem, however, whenever i click apply i disconnect from my wi-fi. Thoughts?
July 6th, 2012 at 1:09 pm
Kamerad - I have the Network Monitor 3.4 problem too
can't check the button. How did you fixed this?
thanks.
July 7th, 2012 at 1:04 am
Same issue that a few others are reporting. I DO have Network Monitor 3.4 installed, and from netmon I'm able to capture wireless frames in monitor mode successfully. But in SmartSniff, the Network Monitor 3.x option is grayed out in the Capture Options dialog.
(FWIW, I'm also using an Alfa USB wireless adapter that is explicitly supposed to work in monitor mode.)
July 7th, 2012 at 2:40 am
For the people who say that the Network Monitor 3.x option is grayed out:
If your operating system is 64-bit, you must use the x64 version of SmartSniff.
The 32-bit build of SmartSniff cannot load the Network Monitor 3.x driver under 64-bit operating system.
September 4th, 2012 at 6:13 pm
Help!, After going to capture options, clicking on Network Monitor Driver 3 x, and clicking on Wifi Monitor Mode, I get the message "The Handle Is Invalid". What should I Do???????