Hey, everyone, so in the last video,
we went ahead and logged into our
lab environment, so again, we log
into our voodoo lab environment and
specifically research for the
Wireshark lab inside of the cyber
lab environment. Now, if you haven't
coming into this lab, then you want
to go ahead Palsies video, go back
to the previous video because
that'll walk you through it up until
the point where we're at right now.
So we've gone ahead and launched our
Wireshark to launch a
terminal window.
And then we're basically just going
to run a ping scan and see what kind
of information is being captured by
Wireshark.
So let's go ahead and do that now.
So we're going to open the terminal
window again. We can do that by
clicking the terminal icon here.
And I'm going to go ahead and just
right click on and actually say new
terminal that's going to make our
lives a little easier.
So go ahead, do the same thing.
So just right, click on the terminal
window and just say new terminal
and that'll give you a new option
there. Now,
once we do that, we're going to go
ahead and we're down here, step 22
now. We're going to go ahead and run
a command and we're going to let
the run for, you know, roughly 10 to
20 seconds. You can let it run
longer if you want to.
We basically just want to get a good
amount of traffic that we've
captured there. So once I run
the command, I'll pause the video
briefly while I run on my
end and then I'll pick things back
up once I've gotten to
the point where I feel like it's
captured enough packets, at least on
my end. Again, you can let this run
as long as you want. If you want to
let it run for like five minutes, by
all means, you're free to do so.
But if you just want to follow along
with what I'm doing, then 10 or 20
seconds or so, it's probably all
I'll do to capture the traffic.
All right. So let's go and type in
our Pinkman now.
So we're going to type in ping.
So all the case there and
then we're going to put a space and
then our IP address that we're
pinging. So we're actually going to
be pinging 10
zero, 10,
12. Now, again, of course, we're in
a lab environment here.
If we were using like an external
source. So, for example, if I was
trying to pick your Web server or
something like that, I may use
something, you know, maybe it's like
a 192 dot one six eight
zero one or something like that.
If I'm in total on your network and
I just want to sniff traffic, I'm a
pen tester and maybe have gotten
access or something like that.
Or if I know a particular internal
IP addresses like this one here,
I might be able to ping those and
sniff the traffic on those.
Keeping in mind that if I'm doing
this as a tester, that's
a good way for someone to notice
that I'm doing something if I start
pinging internal IP addresses.
So just kind of FYI on that,
again, it's just another tool in the
arsenal that we can use to
take a look at what's going on with
this particular network.
So once we tucked in the PIN command
there and we started our IP address,
just type the enter key on your
keyboard, you'll see it'll start
generating a generating excuse me,
the traffic there, as I mentioned
before. But to go ahead, pause video
now let it go for ten
or fifteen seconds or so, maybe
twenty seconds, and then I'll come
back on the video. We'll take a look
at the rest of our lab.
All right, so we're back
now and you'll see my scans still
right in the background and Pinkman
there, I've got over a hundred
or so packets roughly captured,
so I'm going to go ahead and stop
mine again if you want to let us run
longer. You're welcome to you can
just pause this video and let's run
as long as you want to.
But to stop it, if you want to go
ahead and stop it with me, just make
sure you're hooked into the command
prompt there and then just hold on.
Controlling your keyboard.
Impressive letter C as in cat
at the same time.
So control C and you'll see that
will stop the ping scan for
us.
All right. So if we go back to our
lab document here.
The next thing we're going to do is
basically interact with the server,
so specifically there's
a program that's listening on Port
444.
So we're going to use get to go
ahead and do that. So the same IP
address here is the same server
that we're touching here.
We just want to run a different
command against it.
So here at the command prompt, just
type in what you get now, you could
type clear if you want to go ahead
and clear the screen here if you
want to.
I'm not going to go ahead and do
that. I'll just go ahead and run
with the command here so we get
space. And then again, this the same
IP address. So the 10
dot zero dot 10,
12.
And they just entered a keyboard
there.
All right, so the next thing we're
going to do is actually use Netcare.
So once we do that, can we establish
a connection to the Port 440 for
what we want to do is just type in
some random words here.
I just chose Cat, Dog and Bird.
You're actually welcome to choose
whatever you want to.
Just after each one you type in your
press, the enter key and your
keyboard. And specifically the thing
you're going to be looking for is
in the background here.
You'll notice that some of the
packets will be highlighted.
Generally speaking, they're normally
that kind of a purplish or pinkish
color.
They may be a different color and
just kind of depends.
I notice his lab environment
sometimes changes on me, but
in most cases it's been purplish
type of color, like a violet color.
So keep an eye out for those.
Once you see those after you type
these things in and hit, enter these
words and in press enter
right. Click on the package,
select follow Tsipi stream
and then we want to just take a look
in here and question number one to
see if any of these words actually
show up in the TCP
stream that we're taking a look at.
So a lot of steps here, a lot
of things I just mentioned there.
But basically what we're doing is
we're going to type in this and and
assuming net cat command
here.
And then once we touch that and
we're going to type in these random
words. So, again, you can use
whatever you want to. I'm just going
to use cat, dog and bird
and I'll press, etc., each one.
And then I should be seeing some
different packets coming through or
some differentiating packets, I'll
say like that where the coloring is
different. I'm going to right.
Click on those select follow TCP
stream and then from there I just
want to see if any of the words I
typed in are actually shown up
in the packets that I'm capturing.
So let's go ahead. Just all that
done here for this one.
I'm actually going to go ahead and
type the we're clear just to clear
out my screen there. So it's a
little easier for everyone to see
and then we'll just type in and see
space ten, not zero.
Ten to twelve.
Again, we're using the same IP
address for the server.
We'll put a space in that 444 for
a port number
and then just press enter.
Now you'll see that like nothing
seems to be happening in the
terminal window there, just typing
like the word cat or whatever you've
chosen. Press enter, you know, dog
press, enter, bird press, enter,
whatever the case might be.
You'll notice what I mentioned there
in the background that the packets
are kind of purplish.
Go ahead. Right. Click on any of
those select follow TCP stream
and what you want to look for is
what I'm seeing right there.
So question number one here, at
least on my end, do I see the words
that I've typed in?
The answers? Yes, I see that
I've typed in cat, dog and Bird and
all those show up right there.
So you notice that we're actually
capturing whatever has been typed in
the terminal window.
So, for example, if we were sniffing
on someone else's machine,
potentially typing in a password or
username, and we could potentially
grab that information, which is one
of the reasons or one of the main
reasons we would use a tool like
Wireshark or even Tokito.
All right, so let's move on with our
lab here.
So now we're going to go ahead and
close the turkey stream here and
then we're going to stop Nicasio.
So just click the close button here.
We'll go back to our terminal window
and we're just going to stop Ngarkat
by just holding our control
and then pressing C as in cat like
we did before. So control see,
you'll see. That'll take us back to
our command. Prompt their.
All right, I'm going to go and pause
the video here, we'll pick things
back up and finish at the lab in the
next few.