Packet Sniffing with Pirni Pro
Ever wanted a portable packet sniffer for easy, quick access on the go? Well, you're in luck! Pirni Pro is the iPhone's first GUI Packet Sniffer. What it does is simple. It connects to the local router and intercepts all outgoing traffic from the users on that network where it is recorded, then forwarded back to the router.
Now, This may seem intimidating but let me assure you it is very easy to get the hang of.
How to download
The app is hosted by BigBoss and Cydia store for $1.99. There are alternative sources (xSellize.com and h7v.org) that offer the app for free, but it's always good to support the developer.
Sniffer
The GUI makes this app very easy to use without sacrificing power. The home page should look something like this
[img=450x600]http://i1103.photobucket.com/albums/g463/roflkitties/IMG_0412.png[/img]
Now allow me to explain these functions.
1) Source IP: By default, 192.168.1.1 This is the default address for connecting to your router. Meaning, it will grab the packets of the router your currently connected to.
2) Destination IP: This is the IP you will grab packets from. By default, it is 255.255.255.255, meaning it will grab packets from all devices on that network. For more specific results, enter the IP of the device here.
3) BPF Filter: A BPF (or Berkly Packet Filter) is applied to filter out useless packets. In most cases, this should be left as default.
4) Save to File: To toggle whether or not to save the dump file. Should always leave “On” because the dump file can have information not gathered by Pirni.
5) Dump File: Location of dump file.
6) Regex Option: Possibly the most useful function this app has to offer. Chooses what the packet will grab and displays in the live feed (I.e. Emails, logins, credit card numbers, ect.) This will be explained in greater detail later on in the tutorial.
Live Feed
The app is pretty straight forward, just choose Start and it will begin the sniffing process and display results in the live feed:
[img=450x600]http://i1103.photobucket.com/albums/g463/roflkitties/IMG_0415.png[/img]
Settings
This is where you configure your Regex options. It comes with 3, basic codes but those won’t get you very far. The “+” button at the top corner of the screen is where we will add our new Regex:
[img=450x600]http://i1103.photobucket.com/albums/g463/roflkitties/IMG_0414.png[/img]
A simple Google search will find you more Regex than you’ll ever need, but here are some I fine useful:
Dump File
In many cases, the live feed will display less information than actually gathered. In these cases, we revert to the dump file. By default, it is located in “/var/tmp/log.pcap”. With this file you can later get information from it using other packet analyzers, such as wireshark. You can even get some information (such a website URLs and rarely logins) with a text editor and iFile.
Ever wanted a portable packet sniffer for easy, quick access on the go? Well, you're in luck! Pirni Pro is the iPhone's first GUI Packet Sniffer. What it does is simple. It connects to the local router and intercepts all outgoing traffic from the users on that network where it is recorded, then forwarded back to the router.
Now, This may seem intimidating but let me assure you it is very easy to get the hang of.
How to download
The app is hosted by BigBoss and Cydia store for $1.99. There are alternative sources (xSellize.com and h7v.org) that offer the app for free, but it's always good to support the developer.
Sniffer
The GUI makes this app very easy to use without sacrificing power. The home page should look something like this
[img=450x600]http://i1103.photobucket.com/albums/g463/roflkitties/IMG_0412.png[/img]
Now allow me to explain these functions.
1) Source IP: By default, 192.168.1.1 This is the default address for connecting to your router. Meaning, it will grab the packets of the router your currently connected to.
2) Destination IP: This is the IP you will grab packets from. By default, it is 255.255.255.255, meaning it will grab packets from all devices on that network. For more specific results, enter the IP of the device here.
3) BPF Filter: A BPF (or Berkly Packet Filter) is applied to filter out useless packets. In most cases, this should be left as default.
4) Save to File: To toggle whether or not to save the dump file. Should always leave “On” because the dump file can have information not gathered by Pirni.
5) Dump File: Location of dump file.
6) Regex Option: Possibly the most useful function this app has to offer. Chooses what the packet will grab and displays in the live feed (I.e. Emails, logins, credit card numbers, ect.) This will be explained in greater detail later on in the tutorial.
Live Feed
The app is pretty straight forward, just choose Start and it will begin the sniffing process and display results in the live feed:
[img=450x600]http://i1103.photobucket.com/albums/g463/roflkitties/IMG_0415.png[/img]
Settings
This is where you configure your Regex options. It comes with 3, basic codes but those won’t get you very far. The “+” button at the top corner of the screen is where we will add our new Regex:
[img=450x600]http://i1103.photobucket.com/albums/g463/roflkitties/IMG_0414.png[/img]
A simple Google search will find you more Regex than you’ll ever need, but here are some I fine useful:
Code
Title: Email Address
Regex: \b[A-Z0-9._%-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b
Description: Regex to grab email address’sCode
Title: General SQL Queries
Regex: (SELECT\s[\w\*\)\(\,\s]+\sFROM\s[\w]+)| (UPDATE\s[\w]+\sSET\s[\w\,\'\=]+)| (INSERT\sINTO\s[\d\w]+[\s\w\d\)\(\,]*\sVALUES\s\([\d\w\'\,\)]+)| (DELETE\sFROM\s[\d\w\'\=]+)
Description: This will match the following SQL Queries (SELECT, UPDATE, INSERT and DELETE)Code
Title: Website URLs
Regex: (http://|)(www\.)?([^\.]+)\.(\w{2}|(com|net|org|edu|int|mil|gov|arpa|biz|aero|name|coop|info|pro|museum))$
Description: This will find websites that users are viewingCode
Title: Phone Number Capture
Regex: ^(\(?\+?[0-9]*\)?)?[0-9_\- \(\)]*$
Description: This Regex can be used display any Phone Numbers that are CapturedDump File
In many cases, the live feed will display less information than actually gathered. In these cases, we revert to the dump file. By default, it is located in “/var/tmp/log.pcap”. With this file you can later get information from it using other packet analyzers, such as wireshark. You can even get some information (such a website URLs and rarely logins) with a text editor and iFile.
