All right, Wireshark.
We introduced Wireshark.
Actually, we've talked about it in bits and pieces throughout the course.
We talked about Wireshark last module.
I mentioned in that module you'd be doing some labs on Wireshark.
Didn't have it in the previous module, but
you are going to do some filtration on the Wireshark Labs in this module.
You're going to go through the Wireshark
interface, the components of Wireshark, and then several examples of different
filters to filter for different types of attacks.
A couple of things.
Following the TCP stream in Wireshark,
allows you to filter out the payload of a TCP communication, and following the TCP
or UDP streams allow you to again strip out the conversation.
For example, it's been a while since we've done a demo here.
Now, again, we're leaving a lot of the demonstration to the labs, but I've got to
break up the lecture a little bit here and there.
Let me go ahead and fire up
a quick example. All
right, so I'm going to establish...
Let's do a netcat session.
All right, now you played with netcat in
the previous lab, so here's a little bit more on that.
All right, netcat listener, port 79, detached from console, execute CMU.
Exe, enter.
All right, then I'm going to fire up wire chart.
Let's start a packet capture and start capturing packets.
Now, again, a little bit on the Wireshark interface.
You've got the list, you've got the
details, and you've got the packet bytes pane.
Anything you highlight in the list gets highlighted in the details pane where you
can break it down and examine the packet contents.
Then you've got your hexadecimal information in the lower pane.
For example,
I'm going to establish a netcat connection on Port 79 to my victim machine.
I'm going to do a hostname, Who am I, net user ad Eric.
And we'll do a little proof of
escalation. ust
to generate a little activity.
Again, we do a lot of this in the labs,
but I forgot to throw a quick demo out here.
When my wire shark is capturing, it's all rolling by in a scrolling window.
Everything I just did is buried in that haystack, but we're going to have to
filter a little bit to look for the proverbial needle in the haystack.
For example, I can filter by protocol, I can filter by anything in Wireshark.
It's just a matter of knowing the syntax
or right clicking on the criteria and the packet contents.
I'm going to start off with ip.
Addr equals equals 10.0.0.212, which is my local IP address.
Well, that doesn't tell me much since
everything is inbound or outbound of my local ip.
I could further filter down and say, for
example, I've got a suspicious host, 10.0.0.13. Now we're getting somewhere.
Then I can further filter from there.
The filters, again, you can string these
things up till the cows come home, really detailed, very specific, and you can
link them together by parentheses and Boolean operators.
All right, ampersand, tcp.
Port, good Lord, port equals equals 79.
All right, filter dialog box turns green when the syntax is correct.
I'm going to enter, and that's the
communication between my system and that remote system on Port 79, i.
E. My trojan.
All right, so that's filtering.
Following the TCP stream is follow TCP stream.
Well, looky there.
That's pretty cool.
That filters out the entire dialog.
There's my command prompt.
There's my initial intrusion, getting the
host name, figuring out I'm an administrator.
That means I can add user account, so I added Eric.
I put Eric in the local administrators group.
Now I've got a remote admin account.
I ran an ipconfig to look at the IP configuration.
Then I ran through some commands, checking local things like map drives, net use, net
sessions, any connected sessions, net start running services.
That's some pretty basic footprinting that
you might do when you first compromise a system.
Get a look around, figure out what's there, and how you can maintain access and
ultimately cover tracks with clear log files and so forth.
So again, that's the stuff we do a little bit more offensively in CEH.
I forgot to throw a couple of examples in here in addition to your filtering labs
just to give you a feel for buying the TCP stream.
All right, so there's also Let me shut that down.
A variety of other packet capturing
utilities that can grab that same information.
We've already talked about TCP dump and other command line packet capturing tools.
Those PCAP formats can then just be loaded into Wireshark and you can filter
and manipulate as if you captured from Wireshark to begin with.
Good stuff.
A little bit of a break from the lecture.
Following the TCP stream in Wireshark, red
and blue colorized example of the dialog or capture the dialog.
The display filters are many.
You can filter by ports, by IP addresses, by pretty much anything.
You can use Boolean operators, TCP resets,
that contains specific hex values, different types of HTTP request.
You can filter by anything.
Monitoring and analyzing FTP traffic.
Now, again, you're going to be doing a lot of this in the lab, but you just use FTP
as the protocol and filter out what you're looking for.
By default, FTP uses port 21 for the
control port, port 20 for the data port, so you can filter by either one.
T elnet traffic.
Telnet traffic, we've talked about multiple times throughout the course.
Telnet traffic is horribly insecure, clear
text, usernames and passwords, and data can be easily manipulated.
So port 23 is used by telnet.
You can also use the telnet protocol ID.
You can also use port 23 use HTTP and then contains keywords, which
again, these screenshots, these are all activities you're going to do in the lab.
Monitor and analyze HTTP traffic for sensitive information, malicious traffic,
detecting applications using unnecessary restricted services.
And again, you can start off by filtering anything by protocol.
And there's a lot more where that came from.
Lots of wire chart filters.
Our TCP dump, again, is command line
utility for capturing packets on a network.
You're going to be playing with that in the lab.
You're going to take your TCP dump file,
you're going to actually open up in Wireshark.
Lots of other really cool packet analyzers out there.
Riverbed, Omnipede, Obs server, NetWitness, of course.
But at the end of the day, Wireshark and
Nmap are two of the most useful utilities you have in your network security toolkit.
They're both completely free and they're both fantastically powerful.
So for your scanning needs, pretty much all you need is Nmap and it's free.
For your wire sniffing, packet analysis, packet logging
needs, Wireshark is going to get most of everything done again for free.
Now, again, there are enterprise license
products that have nice bells and whistles.
But as far as return on your investment
bang for your buck, you can't beat all that for free, so good stuff.
Our TCP dump, of course, is also free.
All right, so that's a bit of an extension to our previous module, and that's going
to wrap us up for Module 17, network traffic monitoring.