Hello, guys, and welcome to the first video of Chapter two
in this chapter, we are going to focus on analyzing unusual traffic delays in
packets or lost packets and in general, how to investigate all sorts of network
traffic packets and LAN, of course, how to decrypt traffic such as Wi-fi traffic.
So for the first video of this chapter, we
are going to focus on HTTP and learn how to analyze it.
And of course, we are going to go through
some practical examples of how to detect HTTP errors.
It is used by the World Wide Web and it
defines how messages are formatted and thus made it by Browser.
HTTP also defines what action should be taken when a Browser
HTTP command and for transmitting HTTP command to get data from the Server.
For example, when you enter a URL in any browser of your choice, it actually sends
an HTTP command to Server and Server replies with an appropriate command.
So now let's get to know about the methods
which are seen quite often these methods of HTTP that we.
Mostly see is get.
Get request, asks data from a Web browser.
This is a main method used for document retrieval.
We will see one practical example of this method real soon.
And the other method is post this post
method is used when it's required to send some data to the Server.
So let's try something practical to understand how HTTP works.
For the purpose of this video, we are
going to use dvwa, venerable Webapp that I have set up in my window system, and we
are going to access it through our Kali linux machine.
As you can see, I have uploaded a picture here in the file
upload section of this website and we are going to use it to
download this picture while we are capturing the traffic so we
can go ahead and analyze this HTTP traffic that we are going to capture.
So before we continue here, let just first
go to Wireshark, select a network interface and start capturing.
So now let's go to our Browser.
And.
Try to save this picture.
In our computer now, we can stop capturing the traffic and we can go
through this whole procedure and analyze its method of HTTP used.
So before we go into HTTP, we should note
that HTTP uses port 80 and TCP as transport layer protocol.
So now let's see what happens in the
network when we put that URL and press enter and we are trying to save something.
So let's start and find the initial interaction.
OK, so you can see here.
That the interaction started with ack sending a SYN packet.
And then the Server responded with a syn ack.
And finally, as you can see,
our machine responded with an ack in order for the connection to be established.
Right now, this is the TCP three way handshake.
And then the
and then we have the HTTP get command that we initiated while we
were trying to download this tape Backup file.
As you can see, the success of packets while we are downloading JPEG.
And then at the end there is this HTTP, OK, in order to assure us that the
whole download of the file has been completed.
Software TCP Threeway handshake, like we explained earlier, HTTP get the request is
sent to the server and we are going to go through some important fields in that
packet and we can explain and analyze what each one means.
So let's go to the get a request and then.
So.
To the HTTP protocol, so let us maximize
this a little bit so you can see this packet.
Is a get request followed by the link that we have used to download the JPEG file.
You can see also the version of HTTP here.
In the next step, we have the host, this is the Webapp Server name, where
the client in the case in this case ask setting the HTTP get request.
In the next line, you have the user agent.
This is our Browser type.
So in the next lines, we have the accept
language, which is as it's being defined, the standard
accepted language that we used, then we
have a accepted encoding from client side.
The the connection keep alive is the connection could tell , whether the
network connection stays open after the current transaction finishes.
And at last, it's the referer, which is the full URL that we try to access.
And at last you can see, the full request.
For this JPEG file that we tried to download.
So after this initiation from our site,
the HTTP GET command, in order to download this JPEG file, these are sequences of TCP
packets going back and forth from the server to the client while we
while we are downloading the file until the file is downloaded and we
received an HTTP, OK, that the jpeg image has been downloaded.
So this a dive a little bit deeper into this HTTP one point one 200.
OK, so you can see that
in the first line we can see the HTTP one point one two hundred, OK.
The status source sent by the Server.
And the response to that is the status code by the Server
and OK is the response face sent by the Server.
Next, we have the date that this action has been completed.
In this case, the Downloader Desert IP Agreement.
In the next in line is the Server, in which this file that we downloaded has
been posted there, and we download it from the last modification
date that signifies the date that the file was last time modified.
And then in the next line we have the e-TAG.
So the ETAG indicates the content is not changed to assist dashing and
improve performance, or if the content has changed, it tends to use help prevent
simultaneous updates of a resource from overwriting each other in the next line.
In the next line, we have accepted ranges
Byte Byte is the unit used in the Server for content content length.
This is the total length of the Firewall.
That we have downloaded in Byte.
In general, people alive parameters again of the next line.
The connection keep alive as we.
Mentioned earlier, also, it was in our
HTTP get method, the content type is the type of.
The file that we downloaded, you can see in the next few lines, the request URL.
And that is it for analyzing the HTTP 200, OK, like it.
So now we know what happens when we
request any file that is present in Web Server HTTP is a simple application
protocol that we use every day in our life.
It's not secure.
So HTTPS has been implemented.
ts stands for SQL in the HTTPs.
So you can see lately that most of the web Server names, if not
mention all started with HTTPs and then the Website.
This means that all communication between you and the Server are encrypted nowadays.
So now we are going to look for HTTP error responses.
As you can see, I have opened I pick up that.
I know it contains errors so we can explore them.
Usually the HTTP errors you can find
in the network capture file are 300 errors, which are redirects
300 and above like three 301 and 302 and so on, which are redirects
four hundred and above errors like four hundred one from the two
four hundred four our client errors and five hundred and above are Server errors.
So Wireshark has some HTTP statistics that can show us
of all of those response codes in one location so you can go to statistics.
HTTP, and you may want to go and press packet counter.
So as you can see, Wireshark generated from this file that we
have open all the requests and if you expand, as I already have it expand here.
So as you can see, we have here
we had in total 91 HTTP packets and we had two client errors in this pick
up file and 43 success successfully transferred packets.
So let's see now how you can apply display filters to find
these kind of errors way more, faster and convenient for you.
So you may want to go to
the display filter section and type HTTP dot response dot code.
So now in this case,
you can use, as you can see from notification,
like if you are searching for exactly 300 errors like redirects, you can
use the equal equal sign and then type 300 and press enter.
And in that case, you're looking for specifically 300 errors.
Only you can do that with 301 press enter.
As you can see, we don't have redirects
in this pick up file, as we saw from the statistics and the packet counter before.
Now you can use the greater sign in this display display filter so you can use HTTP
dot response dot code greater and equal to 300.
So in this case, the results from applying
this filter is that it's going to show us all the errors above three hundred.
So that means 300
to 400, 500, all the errors that exist in this Network captured file.
So if we hit that, we're going to see all of the errors.
If we are going to focus only on 300
errors, which are the redirect we may want to go and press and
HTTP dot response dot code we would like that to be.
Below four hundred or you can type that below equals three hundred ninety nine.
So in this case, if you press enter,
the results will be all the three hundred errors.
You can apply the same for 400 if you want to see only four hundred errors.
And also you can apply the same filter
that I have here and you can substitute three hundred with
four hundred and three hundred ninety nine with four hundred ninety nine to prevent
five hundred errors from appearing in your results.
So let's go ahead and apply for.
This filter for four hundred errors, so we would like to increase to 400 and
these to four hundred ninety nine, we hit enter and in fact, you can see that there
is some client errors appear in our results.
So let's go and try our final one to see if there is any five hundred errors.
As you can see, there are none because we
use the command with greater equals two or 300 that are presented to us all.
That will present us all the results from 300 and above.
So, as you can see, there is no Server
errors in this network traffic captured file.
So that was it for today and now you can go ahead and click on the next video and
learn how to check out Sneaky Non-standard Port Use.