Is this murder on windows?
In contrast to Unix like systems, Windows implement its user mode network functions without direct
system calls.
So the networking stack is exposed through the driver and establishing a connection uses the file open,
read and write system cars to configure network socket for use, even if windows support there facilities.
Similar to stress, this implementation makes it more difficult to monitor network traffic at the same
level as the other platforms.
Windows, starting with Vista and later has supported an image generation framework that locks applications
to a monitor network activity where I think our own implementation of this will be quite complex.
But fortunately, someone has already written a tool to do it for you.
This is the maker of Microsoft's process monitor tool.
Let's don't this tool here.
Just, uh, search in Google, as you know.
Searching Google, uh, as Microsoft Process monitor tool.
Actually, yes.
Images of purchasing one or two.
These internals, a process monitor.
And click on the Microsoft Fed official website.
Here and in the donut sections.
Click on Download.
OK.
And extract from zip file.
So as you can see here.
Um.
And two main interface here.
Um, so selecting the filter here, as you can see here, filter.
Process three include process three, high like filter here.
Um, was.
So this causes so selecting the filter that displays only events related to network connections from
a monitoring process.
It does include the hosting world as well as the protocol and port being used, although the capture
doesn't provide any data associated with the connections.
It does offer a valuable insight into network communications applications establishing.
Horses Monitor can also capture the state of the current culling stack, which helps you to determine
where in an application network connections are being made.
Actually, this will become important in the next, um, lectures of our course when we start reverse
engineering binaries to work out the network protocol.
Here we have clumsier, as you can see here, time process name, porcini operation patch result and
detail.
So actually increase the size of it.
Um, screen.
No screen screen here, King screen resolution.
Let's make it clear the.
Scalable here.
Oops!
It's it's even worse now.
So.
As you can see here, we have columns here and there which this column time here, um, shows the name
of the actually first we have to pronounce his name.
Let's start with process name.
This process name shows the name of the person that it published the connection and.
This column, years of operation here, uh, shows the operation, which in the case is connected to
a remote server here, as you can see here, uh, these three open key core key, uh, you know, rigid
file lock file like that.
And.
We have Pat here as well as you can see here, uh, this Pat, uh, actually indicates the source and
destination addresses.
And this is a detail here, as you can see here, it's increased a little bit.
So this is the, uh, this detail column provides more in-depth information about the of, uh, event,
although this solution isn't as helpful as monitoring system calls on other platforms.
It is still useful in windows, and you just want to determine the network protocols a particular application
is using.
You can capture data using this technique, but once you determine the protocols in use, you can add
that information to your analysis before a more active network traffic capture.
And now advantages and disadvantages of passive capture.
So the greatest advantage of using passive capture is that it doesn't disrupt the client and server
applications communication, so it will not change the destination or source address of traffic.
And it doesn't require any modifications or reconfiguration of the applications.
Passive caption might also be the only technology you can use when you don't have direct control over
the client or the server.
You can usually find a way to listen to the network traffic and capture it with a limited amount of
effort.
After you are collected your data, you can determine which active capture techniques to use and the
best way to attack the protocol you want to analyze.
One measure of passive network traffic capture is that capture techniques like packet sniffing around
such a low level that it can difficult to interact to interpret what an application received to such
Wireshark is certainly help.
But if you are analyzing a custom protocol, it might not be possible to easily take apart the protocol
without interacting with it directly.
Passive capture also doesn't always make it easy to modify the traffic and application produites.
So modifying trapping isn't always necessary, but it's useful when you encounter encrypted protocols
and want to disable compression or need to change the traffic for exploitation.
When analyzing, trapping and injecting new packages doesn't yield results.
Switch tactics and try using active capture techniques.
And we have active in the culture as well.
So actually, I want to illustrate this here, uh.
Let's change it to four years.
So now, uh, we will, uh, firstly client application.
Here and, yes, Target and we need.
Brooks, see?
Man.
Men in the middle man.
The.
I mean, the proxy.
See?
So this is the attacker's proxy here.
And it's.
Here and we have actually.
We have another proxy here.
We just need several application server.
Location.
For example.
This.
This is the service, sir.
And let's change this.
Yeah.
Here he is.
So the capture of the active capture differs from passive in that you will try to influence the flow
of the traffic, usually by using men in the middle, um, attack on the network, on the network communication
as shown in this figure.
They do device capturing traffic usually sits between the client and a client and server application,
uh, acting as a bridge here.
So this approach has several advantages, including the ability to modify traffic and disable features
like encryption compression, which can make it easier to analyze and exploit and network protocol advantages.
Actually, not the advantages and disadvantages of this approach is that it's usually more difficult
because you need to reroute applications traffic through your active culture system.
Active capture can also have unintended, undesirable effects.
For example, if you change the network address of the server or client to the proxy, this can cause
confusion, resulting in the application sending traffic to the wrong place.
Despite these, user's active capture is probably the most valuable technique for analyzing and exploiting
application network protocols.
We have network proxies here as well.
So, uh, what?
Um, net of proxies does is, uh, we will learn in next lecture.