Hello everyone in this lesson. We will learn
how to find the DNS and icmp tunneling
patterns and how to analyze the suspicious
packets in Wireshark.
So let's begin.
First of all, let's talk briefly about how
the DNS protocol Works DNS means
domain name system as you
know, and it is a protocol that is used to
map domains names to IP addresses. The
primary purpose of DNS is to translate
Humanity domain names such
as a wire shark dot org into
IP addresses that computers can understand such
as 10.0.2.1 and
firstly in this
conversation DNS conversation. The
first step is a client
such as a reproduction think of
a web processor or email client sends DNS
query to a DNS
server in order to resolve a domain name
to an IP address.
The credit includes the domain name and the type
of record Being crooked requested such as
a letter upward case for IP
version for address and
for a letters for
IP version 6 address we
can see in the record type and
MX for mail servers.
You can see these record types
empty Second Step
the DNS server receives the query
and processes it by looking up the request
domain name in its local database or
forwarding the query to
another DNS server. The DNS server uses
a hierarchical system of nameservers
to resolve the domain name.
And in The Next Step the root name servers
are the first point of contact and now
the address of the top level domain
TLD name servers such as.com dot
org or that edu and
those TLD name servers
will know the others of the next level for
example domains nameserver and so on
and then once the DNS server
has resulted domain name to an IP address.
It sends a DNS response to
the client with the result IP others.
And declined receives the response
and uses the IP address to establish
a connection to the destination. And additionally
DNS protocol is built
on top of the user datagram protocol on
top of the UDP
protocol on Part 53.
It is a connection list and stateless protocol.
Meaning that each query is
independent and that there is no persistence
between the requests and responses. Now,
let's examine that example the
NS traffic in Wireshark. I have opened
the PK file.
And we will investigate over this PK
file or network traffic. So now
we are scrolling down and
Let's take a look at this pact. We
see a DNS
query in here. You can see maybe
we see it. DNS query is sent
for the wireshark.org.
On this IP address, there is a
DNS.
And the destination Port is
53 as you can see and
let's take a look at packet details.
on this packet
so
I'm scrolling here up a little bit.
And you need to know that the DNS
protocol works on UDP Port 503.
as in here
on this packet the destination Port
53 because DNS protocol is
running on this port and
so here we see that the Target Port
and because the query we send
is a DNS query and therefore it
goes to Port 53. Let's expand the
DNS field the domain
name system we have now.
and
the first thing we see is the transaction
ID.
We can reach the conversation by filtering the
transaction ID.
In any network traffic so
since the response packet
comes right after the query in
this traffic.
We can easily examine it but let's reach
the conversation directly by filtering
with transaction ID to do
this. Let's click on the transaction ID
information and
hold it and leave it to the display filter
field.
Like in this way.
And I am dropping in the display filter
field.
So as you can see.
The filtering is applied directly.
And now we are seeing the conversation only.
so
since
It is a query package on
this packet. Let's move on to investigate the
query packet in here. We
see the queries field because
this packet a DNS query packet and
let's expand this field.
and expand this to
equally was made for in here.
Why shark.org as
you can see?
And type A indicates that
this query is an
IP version query.
So IP version 4 information was
requested for wireshark.org.
There were four a letters in the
type value then it would mean requesting
IP version 6 information, but here
we can see the type value is as
a the one a
letter. So it means
that the query is for IP version
for information. So keep
in mind that and now let's click
on the response package.
The unlike the query packet we see
the answers field in here.
so in the answers field
Let's expand and there it
is. You can see wireshark.org information
and as you
can see the resolution from the domain address.
to the IP information
Now we can see the IP address of the domain name
wireshark.org.
So now the client can access the relevant
domain using this IP address.
And let's remove the filter.
and when we look at next packet
after the response packet
and let's click on the next packet.
When we look at the dispute packet, we see
that it sends a pink messages a
pink message to the IP that
we have obtained by
the DNS query previously. So
keep in mind that when we type
also fireshark.org and enter
on the our web browser.
the same process takes place in the background
like in this
traffic
So now that we have seen a basic and
normal example of DNS communication.
Let's see examples of suspicious and
potential cyber attacks.
and we are
we are gonna to write to understand the
difference between them in a normal
DNS terrific and attack terrific suspicious
terrific.
So for this we open a we will open a PK
file containing Network packets captured at
the time of DNS tunnelink attack. So
let me open this 5
attack traffic file
and
we will investigate the speaker file.
First of all, if you are working on a very
large pickup NG file, you should
do DNS filtering to see on DNS
traffic.
Don't forget it. You can do this in two ways
you either type DNS?
as filters
or you can write you can
type.
This filter you repeat that.
port
Is equal to DNS Port 503?
And your channel, so use this filter.
instead of only DNS
this is the first thing you should do, but I don't
need to do this because my all
packets are already DNS
packets and there is
no other
type packet
So much.
so now secondly
they will use you should look for any packet that
have unusual characteristics such as
specially long domain names.
As you can see in here.
What a such a long domain names
you can see.
and
in addition to unusual characteristics
like in this field in these records,
you can see some
especially long domain names and
high numbers of sub
domains.
Maybe you can see in here.
in this example
and lastly repeated queries for
the same domain you may see
in the suspicious packets. So
these can be signs of DNS tunneling
and for example, almost all
of the packets here are made up
of long domain names and
Unusual character sets you can see
in here. There are two many unreal character
sets and multiple sub
domains. You can see
like this like
the other ones
and
this is a typical example of DNS tunnel
link attack.
So and you should look at the timing of
the DNS requests and responses.
You should investigate those also the
timing and if
there is a frequent data
transfer in a specific time frame,
especially it could be a sign of
a tunnel and you can also apply these filters
in order to find dnskat patterns.
you can also some filters in
order to find DNS get patterns and
suspicious DNS queries like this you can
use
DNS contains
DNS
cat
So this is the first one of the filter Expressions
you can use this one
in order to find dnskat patterns.
And the other one is DNS.
You are why?
means query
dot name
Dot
length
Greater than for example
15.
And you can use also this filter to
find the DNS channeling
patterns.
So these are the filters that you can use to find
some suspicious patterns
like in this PK file.
and you can also investigate the
queries in the
packet details pain and
for example in this query there is a sum there's
some characters said
suspicious character set
and to look closer
this query
you can use
show packet bytes.
pain and in here
you can see some hex or base
64 structure
and you can
take this character groups and
you can
you can encode sorry. You can
decode these characters using some
hex converter tools.
So, okay. That's all now.
We can close the pain and we
can close the pick file.
Now we will talk about icmp tunneling
attacks.
Icmp tunneling attacks are often anomalies that
arise after malware activity. So
the militia sectors exploit
these part to exfiltrate data
and create a c to
connection since icmp packets
can include an additional data payload. It
might be a data is playing text or
a file contain some scripts or
even an image with hidden patterns while icmp
protocols give
a great chance to transmit additional data.
They also have this some this
this advantages most business
networks either prohibit custom
packets or need administrator access
to send custom icmp packets
a huge amount
of icmp traffic or unusual packet
sizes.
Are signs of icmp tunneling so
however, because attackers can
built unique packets that match
the standard icmp packet
size, which is 64 bytes
discovering these tunneling operations
becomes difficult. So here
we will review and icmp
tunneling I have done before in
a lab environment I made
and icmp tunnel
link instrumentation in
the my local network. And
while this tunneling was
happening. I captured Network traffic with
Wireshark using Wireshark. Let's
investigate the pickup file that I
have opened and continuing
the icmp
channel link terrific.
Filter we will use to detect icmp tunnel
link should be like this.
icmp and data Dot
Which was a 64 bytes
as the packet pipes
is the packet size because this is
the maximum maximum expected size
of a standard pythmp packet.
For example, let's first take a look
at the data length sizes in
the pink packets. You can see these are
the pink packets and there are
so many pink packets we have
and let's take a look icmp field
in the packet details field
and as you can see
the data link size in
normal pink packets
is 48 bytes. So when
the icmp header size is added
to to the
data bytes to the data size the
maximum packet length value
must be 56 or 60 for
bytes.
these are the
possible maximum values
a pink packet can be
56 bytes or 64 bytes.
So now let's apply our filter
and see these packs.
Take a look at how the packet length
size greater than the normal
packet size and let's go to
pack a details and take a closer look for these
huge packets.
So I click on the first
packet that has
the length.
Greater than 1,000 bytes. And
when we look at the packet details,
you can see icmp field in
here and we are expanding the
icmp field and scrolling down
and the data as
you can see as a very
huge size data
size is 1,300 bytes.
And this is really so
unusual size for
a ice for icmp picked.
And this is not normal, so we
should investigate in a
more detailed.
and when we look at the show packed bytes
as you can see
Oh, look at this.
We can see the payload data in
our icmp packet and
here there is a plain Text
data.
And it says this is a payload for
icmp tunnel.
So in here there is a payload
within the icmp packet
pink packet. When we look at
first, we we can think this
is a normal icmp pink
packet, but when we look at the look at
in details in the data field and white
Spain by
In the bright Spain we can see the data payload
data in here and
there is a some plain Text data.
so, okay, we can close this and
look at this. There is a another and greater
packet icmp pink packet
as well. And then we look at
to the data field also.
Let's look at the show packet bytes again.
And as you can see in this
time, we can see an image
file.
So that is unexpected.
And this is a payload payload data
a suspicious and unexpected payload
data.
When we look at the packet bytes pane
you can see.
if you look at the packet price
pane first, you can see only
a sign like this gajif so
we can have an information
there is a there is an image file, but
if we can see the image itself in
here.
Just we can see the bytes information. But
if you look at look
at the show packed by Spain, you
can see the original image.
And there's a radio image that we
that is hidden in the acmp pink
packet.
So that's all and
can see the icmp tunnel link patterns in
this way.
And you can use these filtering expressions.
In order to find some icmp tunnel
link patterns.
So that's all for now. See you on the
next video.