Hey, everyone, welcome back to the
course. So in the last video, we
went ahead and read a couple of
commands with our TCP dum tool.
In this video, we're going to run a
couple of filters using Wireshark.
So let's go ahead and launch
Wireshark, the way we do that is
we come on the left side menu here
and you can click on this little
blue colored shark fin icon
to launch it.
I found that sometimes is similar to
the terminal window where you have
to click it a few times.
So the easiest route, in my opinion,
is just actually right.
Clicking on it and then just
clicking on where it says Wireshark.
That should launch it right away
free, as you see in the background
there.
All right, let's go back to that
document. So once we've launched
Wireshark, we're going to go to file
and then open at the very top left
and that's going to open a new
little Pop-Up window for us.
And then what we're going to do is
basically navigate to a file that we
want to look at.
So at the very top left here, just
click on file and then open.
And then next, we're going to select
desktop on the left side here,
we're going to double click on the
captures folder.
So the top option there that it
should highlight by default.
And then we want to find that the
lab two point two point
three dash three point
excuse me, copycat file.
So you see, I've got it listed here.
That's step six.
So we want to click on that
particular file right there and then
we're just going to go ahead and
open it.
So just click click the open button
there. Now, you see, everything is
kind of smashed up
at the top here.
We're going to go ahead and expand
this out like we have done in the
previous lab.
So if you recall, you just cover
your mouse over top.
This area here, you'll see it turns
a mouse cursor into an up and down
arrow. Just go ahead and left, click
and then drag it all the way down or
so and you can go further
up if you want to. It kind of
depends on how far you want to take
it. I normally just do mine kind of
near the bottom there and we should
be good to go.
Now, let's go back to our lab
document, so now that we're able
to actually see the information
inside of Wireshark here, let's go
ahead and actually put our first
filter in.
So we're going to type in this one
here. We're going to type in IP
period, destination host containers.
And then this is the starting part
of the IP address, as well as EBP
or Port 80.
So let's go and type that in now.
So here in this top layer filter
box, we're going to type in IP
period, DST
all over case
underscore host.
Space then contains
all lower case space
quotation marks, one seven
to dot
one six and then any
quotation marks.
Space, the the
word and so and deep
space and then HTP
again, all those are lowercase.
Once you enter that and go ahead,
click the apply button on the right
side there and you'll see that's
going to filter it out and just give
us the HTP request.
If we go back to our lab document
here, so question number one, I
should just answer that for you.
Has a protocol column changed with
the filter and the answer there was,
of course, yes, it's changed from
everything else to just http.
And question number two, do any of
the IP addresses look familiar to
you?
All right, so we notice that we've
got that one to 16
to 20 to 24 again, so we've seen
that in the previous lap.
All right, so let's go back to the
lab here, step number nine,
we're going to go ahead and export
an e-mail object.
So way we're going to do this is
basically to get to the top level
select file and export objects
and then ACTV.
So file expert
objects, so down near the bottom
here and then htp the top option.
You'll see it'll give us some
information there.
Let's go back to our lab document.
We're going to be collecting on a
pack of 50 there.
So step number 12 here.
We're going to click on packett 50
and we're basically just going to
save it as so
click on pack of 50 at the top there
and then say two hours and
we're going to name this HTP,
underscore object, underscore
one.
And then we're just going to say
this to our desktop.
So we'll click on desktop there and
just say it there.
All right, then, just click the same
button there. Now we're back at the
screen here, so we go back to our
lab document.
You'll see that we're going to first
things first, we're going to minimize
Wireshark, so we're going to close
this window here.
We're just going to say
excited that since we've already
went ahead and saved it and then
we're just going to minimize
Wireshark here
and cut that middle.
Button kind of looks like a little
minus sign there, and
now we're back at our main
desktop screen here, we want to look
at this HTP object file.
So the one we just created and save.
We want to go ahead and take a look
at that file. So just go ahead and
click on that.
It's going to open it up and you'll
be able to kind of read through,
especially if it's giving us some
information about this particular
Web page.
Go ahead, Max, out of that once
you're done reading through it.
I'm not going to spend a whole lot
of time on that one.
And then we'll we're going do is
we're going to go ahead and
open up the Wireshark window against
again, we've minimized it all we
have to do to open it. Just click
back on that little thing and it
should pop open the window for us.
All right, so we're back here at our
lab document, we've already closed
the file here and at 16, we're just
going to clear out that filter we
had created there.
So step 17 here.
We're going to clear out the filter
filter just by clicking that clear
button right there. You'll see it
filters back out again.
And now we see TCP and UDP traffic
as well as well as ICMP.
All right, so now we're going to
filter just by typing in FTP
or file transfer protocol, we're
going to type that in. So let's go
ahead and put that in the filter box
and we're just going to select appli
option.
All right. So just basically
truncates down to filter
it to the just the FTP.
All right. So we're going to do now
is we're going to go ahead and.
Right. Click on a specific packet.
So packet number twenty eight here
will pick on that one.
Right click. And then we're going to
go to the follow TCP stream like
we've done in the past.
All right, so.
Question here, what information
do you see, so. Question number
three here, what information do you
see in this particular
bit of data that we're
taking a look at?
So for me, I see that there was
somebody logging in, right, I see,
you know, anonymous, which is
generally not a username that a
normal person would be using, that's
normally a sign or indicator
that something is amiss.
Hopefully you can catch that.
But we do see that there was
some kind of logging here and this
is a username and password that was
used.
So go ahead and close that out.
And actually, before we close it
out, let me let me take that back
before we close it out. We actually
want to save the copy this.
So if you'll see,
if you take a look at the lab
document here, you'll see I have it
in step 20 one that we actually do
want to save a copy of this as our
traffic from FTP.
So the way we do that is just
clicking the save as button
and then we're just going to name
this file where we call it FTP,
underscore traffic
and then TFC for text.
We're just going to say that to the
desktop like we did before and
then just click the save, but.
All right, so now we can go ahead
and.
Abdulkarim.
So the next thing we're going to do
here to end our lab is just
basically filtering with telnet, so
we're just going to go ahead back up
here, click on Clear and then we'll
type in Telnet all over case.
And then go ahead and apply it.
All right, so now we're going to go
down and we're going to look for
packett, eight hundred and eighty,
so it shouldn't take you too far to
go down. You'll see right here.
I've got mine there.
Might take a few seconds or so just
to scroll down to it.
We're going to go ahead. Right click
once we found that and then select
the TCP stream.
So right click followed his stream
and then we see some information in
there. So let's take a look at that.
Do we see any password information?
All right, so I see something and
maybe maybe a nefarious
user might also be a legit user
doing something, but in any event,
I do see a password there.
And so I'm able to potentially use
it for something that.
All right, so our last up here,
we're just going to basically save
this Telmo file and
then we're going to take a look at
any traffic that's not related to
TCP. So the
way we do that down there is we're
going to do basically an exclamation
point in front of E.S.P.
So let's go ahead and just
information as our telnet.
And same thing here, we're going to
save it to the desktop and then
we're just going to call it Telnet.
Underscore traffic
dot text.
And we'll hear him say that to the
desktop, as I mentioned, just click
on Save, you'll see
that one there and we can go ahead
and close this out.
All right, so we're going to go
ahead and clear the filter,
as I mentioned before, and we'll do
this last little one here, the
exclamation point in TCP to
find stuff that's not TCP.
So just click the clear button there
and then just type in an exclamation
point on TCP and then just go ahead
and apply the filter.
All right. So you'll see a bunch of
different protocols there.
So basically the question is just
what protocols do you see since make
sure you got those in there.
We see OPF, we see
AAFP, cetera, cetera.
So this video, we just went ahead
and covered the last portion
of our lab of using Wireshark,
and in the next video, I want to go
ahead and move into our final lab
where we don't jump into a little
bit of more of TCP dump.