Hi, and welcome back to Section 11 sniffing traffic. In this video,
you'll learn how to perform analysis using wire shark.
I hope you're excited. So let's typhon in.
When performing analysis, it's recommended to use wire. However,
we need to capture the and save it simply because it's easier to
perform post analysis from a captured file
to get wire on a window system or a Lenox system or your
Mac system simply to Google search your wire and
next click on the wire. Once you click the link,
you'll sent or redirected to this website.
Simply click on get started and here we can see
download version for wire, there's a Windows installer,
there's a portable app solution. There's even the Mac version,
and then there's a Mac Intel version.
If you are using a Windows space system or a Mac system,
you can simply download these installers and execute it on your device.
However, if you are using cardox,
it's pre-install as you have seen in the previous video.
Once you have installed wire use samples,
wire samples, so hit enter.
Once you see the URL,
which says wiki org sample captures,
simply click it.
It'll you to a list of sample captures that are provided by wire
for loo analysis.
Here we have different categories and we can download all of these and
learn how to analyze bucket. However,
there are three particular samples that we are going use. Simply press
on your keyboard to get a feature first
Telenet. Once you find Telenet, click it.
And here we are under the Telenet category, and there two files.
There's ANet file. Simply click this file,
download it,
and see your we'll use file to analyze how unsecure
protocols transmit sensitive data over network. Next,
we'll take a look at reconstructing a voiceover IP
conversation for this capture simply for,
and here we have two captures.
Simply select this one which says, plus
this is simply a complete telephone conversation that occurs over a
local area network, but the transmitting protocols are unsecure,
so we can use wire to reconstruct the actual conversation.
And lastly,
we'll download another file which we'll be using to extract
downloaded data.
So put simply if anyone has downloaded a file using an unsecure protocol,
we can extract it from the buckets. For this file,
simply search for jpeg like zoom,
and here we have T with
file. This file is actually a file, so you'll need to extract it,
actually get the actual file or the file.
So once you have these three files, let us open wire.
Once you have open wire to load the pocket capture into wire,
simply click on file and then click on open. Once you click on open,
then navigate to where you have saved the file.
Once you have navigated to the download directory,
simply select the file and open it. Firstly, let's take a look at the file.
Simply select tele and click on open. Once you click on,
you'll see all the packets are loaded on the wire.
On the column we have the number. This indicates the number.
Next, we have the time.
This is the absolute time from the point where has started capturing the
traffic. We have source which indicates a list of IP address,
destination IP addresses, protocols,
the and summary information. Once we select your packet,
notice in the details plane, which is down here, the information changes.
So for instance, if we select the first like zoom,
we can double click on the first actually on a separate window like
zoom. So therefore on frame one,
we can see that it is using TCP transmission control protocol
from the OSI layer or the TCP p protocol suite.
The transport layer contains two sub protocols,
TCP and UDP tcps connection oriented.
While the UDP is user data and protocol, it is connectionless,
so therefore we can see it is using tcp. We have a source port number,
any destination port number.
The destination port number simply indicates a service on the recipients
and for instance,
we can see it is using port 23 as a destination port,
and therefore Telnet uses port 23 by default.
If we expand the transport layer ahead of details,
we can get a lot more information. We have the source port number,
the destination port number. We have the sequencer number.
We have what our acknowledgements are set. We can see the window size,
which indicates the amount of data that will be transmitted between a sender
and a, we have the flags if we expand flags.
We can see there are different types of flags that can be set.
However, this is a
simply because that it's a TB message and it
is set for a sin flag.
Next we can see the network layer header or layer three header,
which is using internet protocol version four,
we have the source IP address and the destination IP address.
We can see the version of IP, which is version four.
We can see the header size, the differentiated services field,
which indicates whether the message is using quality or not.
We can see the TTL value, which is the time to live.
We can see the protocol that is used at a transport layer.
We can see the header check,
which is used for checking the integrity of the message.
We can see the source i p and the destination IP address. Furthermore,
we have the layer two header, which is called Ether two on wire.
If we header, we can see the destination address,
the source address and type.
The type indicates a protocol from the network layer. And lastly,
we have the actual,
the simply indicates any sort of encoding and
signal and method for this message to on a physical layer of the network,
let's say we click on talent, which is pocket number four.
When we click on talent,
notice that we have a new field appearing or a new header.
This header is called talent.
This header simply contains a application layer details. If we expand,
we can see any sort of data that is inserted by talent add application
layer. Currently,
there's a lot of talent messages and there's a lot of TCP messages.
As atrician tester, we need to remember that talent is an unsecure protocol.
Therefore it'll be trans messages in Cleantech. To put simply,
there's a likely chance that we might be able to capture the username and
password between the source and destination.
Let's take a look at one once more. One is sending a send.
Message number two is A, and number three is an,
the message starts with a sender who's attempting to create or establish a
connection with the Destin. The sender is two,
while the Destin one since is an unsecure protocol,
let's attempt to reconstruct all the talent messages and take a look at
what is being sent over the network.
So you can right click and simply select Follow TCP stream. And currently,
wire shark has reconstructed all the messages and assu us exactly
what has happened.
Messages in blue indicates all the data that sent from the
to client.
All the messages is sent from
92 0 1.
All the messages that are highlighted in red is sent from the client to the
destination. Therefore, all the messages in red are from
currently we can communication
prompt for a username, well a log the client, which is two,
provided the username must speak. Then to prompt for a password,
the client, which is two provided user. Then we can see the log.
We can see exactly what the client did up until the point client has
exit or telenet session. So as you can see, we,
we can reconstruct the messages using wire and identify
sensitive data such as user password and even determine what a user is
doing while transmitting data.
Next, let's take a look at the voice of IP packet. So once more,
simply click on file and let's click on,
and this time we'll select the magic plus shortfall
capture file. Simply click on open,
ensure you play your filters like so and hit
within this, there's a lot of messages being transmitted between
RS
sent across the network. If you scroll down just a little bit,
we can see this stands for session Initiation,
protocol SIP and rtp,
which is Reliable Transfer Protocol.
Both of these protocols are used for voice over IP conversations.
The thing about SIP is that SIP is unsecure by default,
so therefore we can assume that most likely there's actually
a voice conversation or a telephone conversation could over a
computer network. To see the voice conversation,
we can simply click on telephony like so,
and then simply select voice over IP calls.
Once we select voice over IP calls,
we can see wire Shark has reconstructed the message.
We can see the start and end time,
who was initiating the call and any other details such as the number of
packets on duration of the call. To play the call stream,
simply select Play Stream. This would open another window,
which is a RTP player on this RTP player.
Simply click on the play button. Unfortunately,
if I click a play button on my end, you'll not hear the audio,
but when you do on your side,
you'll hear the audio for both sides for the and the receiver.
Lastly, let's take a look at extracting a file from a pocket capture.
Once more, click on file,
click on and then select H TDP
with JP Zoom.
Before we extract the files, let's click on statistics
and let's click on conversations.
The conversations window will show you various tab.
The first stop shows you all the enet addresses.
This indicates all the market addresses for sender and the destination,
the number of packets,
the number of bites that are sent between one system to another system.
If you click on IP four,
you can see a list of IP addresses that were found within this
capture. We can see the conversations between these devices too,
or these ips. The number of packets sent in terms of bys,
the size of data I sent as well,
we can even click on TCP to determine the port numbers that they use
can click on UDP to determine the UDP port numbers,
to extract files or to see the files uploaded or download it during a
capture,
we can simply click on file export objects and click on HTD
P. The first column shows you the pocket number.
The second column shows you the host, either the name or the IP address.
The third column shows you the type of content, whether it's a JPEG image,
whether it's a file, or whether it's some other type of data.
The next column shows you a file size,
and the last column shows you the actual message. For instance,
we can simply select this here, and once you select this wire,
shark will also show you in the background the actual packet itself
within the HTD P object list,
we can simply select a packet and we can click on preview.
Once you click on preview, it'll ask us, Hey, which application do you want use?
To view this file?
We can simply click on photos and just once and here we can see
a photo of some dolphins.
To extract this singular file,
we can click on save and save this file on our desktop
for post analysis. Additionally,
if you want to extract all the files from this bucket capture,
you can click on save All.
This will simply create a zip or perhaps extract all the files and place
it within a particular directory or your computer.
Now that you have the fundamentals of how to use wire,
you can start observings and look for any sort of sensitive data
as a penetration tester. In this video,
you have learned how to identify details.
You have learned how to identify user credentials from unsecure protocols,
transmitting traffic over network, and lastly,
you have learned how to extract files from an entire capture.
Next, you be starting section 12. I hope this video has inform.
Ill see in the next one.