Hello, guys, and welcome to the first video of Chapter three
in this chapter, we are going to focus on how you can steal credentials, files
and other things from a network stream, as well as how perform session hijacking
using Wireshark in the first video of this chapter.
We will see how easy it is to steal somebody's credentials while trying to
access one of their accounts while utilizing hypertext transfer protocol.
So let us move right away to Kali Linux
and see how this is done practically for the purpose of this video.
I have set up a window system the vulnerable
Webapp that we will be trying to access via kali linux and see how we can capture.
The conditions that I will be entering for
this Website, if it works, is the Website go ahead and fire on Wireshark.
Choose the network interface that we would like to capture the traffic stop
capturing, and then we open Web browser and we try to access
the then vulnerable Webapp that I have set up in my Windows system.
So let just go ahead and try to access it.
And you just see, we are presented with the log in page.
Wireshark.
It's capturing so much under our conditions.
OK, so we have logged in to the page.
And now we can stop
capturing the packet in Wireshark in order to filter out the
huge amount of traffic that you captured in this file and focus on the things that
you would like to see and investigate if you can see if you
captured the credentials that have just entered.
So you can go ahead and apply display filter.
In this case, it would be frame contain
admin, and this will present us with the results that in the Network traffic
and this filter will show us the HTTP packets that contain the text admin
that we provided in the display filter section.
So let us hit enter and see.
So as you can see now,
we are presented with only four lines of from all this traffic that we captured so
we can go into one by one and explore a little bit.
If we captured
in one of these lines that we see here, the admin, the user name and the Password
credentials, so just go in there first one and see if we are like in if we
find it in the first try, you can just right.
Click follow TCP stream and then you can go ahead and check.
If these are so you can see that we have user name, which is admin in this case,
and the Password that I edit, which is the word Password.
So you see, we were lucky in the first try we found out
what username and what password I used for entering this Website.
And you can see how easy it is to just
capture the admin and the user name and the password from any HTTP Website.
You can also use another display filter that we show you for your results.
You can focus on finding the username and
password from this network traffic that you captured.
So you can just go ahead and type.
HTTP.
Request.
Methos equals equals POST with capital letters.
So just hit enter and you can see that
in this case we are presented with few results than the first display filter that
we applied, you can see that the POST login.php, line also appeared.
On this this results.
So if you can just go ahead and do the
same, follow right, click follow TCP stream and there you have it again,
the user name and the Password presented in Plaintext.
So that was it for this video.
Now you can go ahead and click on the next video where you're going to learn how to
extract images from PCAP file using Wireshark.