Hello everyone in this lesson. We will analyze the host
information over the hcp and
net bios and curbers.
Firstly let's talk about the DHCP protocol
DCP protocol means Dynamic host
configuration protocol and it's a
protocol used to dynamically assign IP addresses to
devices on a network the hcp is
a client server protocol where the hcp
store will maintains a pool of available IP
addresses and assign them to thcp clients
upon request.
So when a device such as a computer is
connected to a network. It sends
a broadcast message requesting an IP
address and the DHCP server receives
this request and assigns unavailable IP address
to the device along with the subnet mask
default gateway and DNS server information.
As you know, this process is called phcp leasing.
The hcp release time is
the amount of time for which the
DHCP server resides an IP address line.
After the least time expires declined must
request a new IP address assignment.
Gcp also allows for the automatic renewal
of IP address leases before they expire.
So DHCP also includes a feature called the hcp
reservation which allows the administrator to
permanently assign a specific IP address to
a specific device based on its Mac
address.
This is useful for devices that need to be accessible at
a known IP address such as
servers or parenters.
In summary DHCP is a protocol used to
dynamically assign IP addresses to devices on
a network.
And it provides IP subnet mask
default gateway and DNS server
information to the client upon request and also
allows for DHCP reservation to
assign specific IP addresses to
specific devices.
Now, let's look at a known DHCP conversation
with an example Network traffic in Wireshark.
In this PK file, the first picket is a
broadcast packet.
As you can see the destination IP address
and the destination Mac address are broadcast addresses.
So the IP address of the source device sending the
broadcast is 0.0.0.0 because
it has joined the network and doesn't have
an IP address yet.
Sends a broadcast in order to get an IP address
and the device sending the broadcast as a
MAC address like this and include FC
and 42.
This is the MAC address of the device sending broadcast.
Now, let's expand the dynamic host
configuration protocol DHCP protocol field in
here. The first information that
we can see is this is a discover packet,
so
Then scrolling down and and we
can see again the IP address of the
device. It has no iPad. It has
no IP address now and the Really
agent IP address also is
the same.
and declined mechanics
as you know
And focus on the option 50 we see
that the IP address just requested is 0.0.0.
And so the requested IP address hasn't
been specified yet.
After this cover packet the device
that has the IP address and with 0.1 is
sending a response to
the this IP address.
And it is sending an over and over packet
as you can see in here.
and when we click on the offer packet
You can see the details in the packet details again.
This device can be our router in the network or
just a server with TCP function. It doesn't
matter and we see that DHCP server
sends an offer packet in response.
And when we look at the packet details
we see that a subnet mask in here.
You can see in here. The option one
is representing subnet mask
information.
And the subnet mask has been offered is ending
with 255.0.
And we also see that renewable time value in
here.
When we expand it.
We can see the renewable time value is
30 minutes.
And it is specified as 30 minutes
which corresponds to 1,800 seconds.
And the renewal time value specifies the
time in seconds from other assignment until the
client enters the renewing state.
And we can see in option 51 that
the IP address lease time.
So the IP address list time is one hour.
And DHCP packets can provide information about the
duration of thcp leases choose. The
amount of time that a device
is allowed to use a specific IP address
before it must request anyone.
So this information can be
used to identify devices that have long thcp lasers.
and in option 54
when we expanded we can see
that.
the IP address of the DHCP
server
So it ends with 0.1. So
in response to this offer, the client sends
a request packet as you
can see here. We see that the requested IP
address.
And with 0.10 now we
can see the requested IP address as well
and this information wasn't included in the
offer before.
We couldn't see the requested IP address
in here because it wasn't a request
a peckant but in the request packet,
we can see the request IP address. So this
IP address has been requested by
the client that has no IP
address yet. And in addition other parameters
requested in the request are subnet mask
and then router information and
the domain name server information are requested
by the client.
At this moment so and the
network time protocol service also has
been requested by the client in this
packet. And these parameters are the
information the client needs to
establish a successful connection successful network
connection. So then the sap
is server responds with an
egg packet with an egg message. And
if you have noticed from here on declines
IP address is now the
requested IP address the client requested this
IP address the in the packet
in the previous packet in here.
Now, it has this IP address that has
been requested by the client and it
has received the IP address
and link with 0.10 as
you can see now it has an IP
address as a result now, I will
You a filter expiration to analyze
unusual DHCP requests
in our Network.
Now I am typing the filter expression.
so in this filter
As you can see we see that the code of the
option parameter is equal to
3. So this code is
used to create request packets. Maybe we
can see in the request in a request packet,
Discord.
Let's look at in the packet details.
And as you can see the request packets
as the DHCP value a
DHCP value as three.
So this code is used to create and
request packet. So.
so if you want to filter out the request packets
in the DHCP protocol you can
use this parameter directly and you
know that you can hold this
information and direct
into the
display filter field and you can drop it
in here.
And we are choosing the selected one as you
can see the same filter has been applied
in here.
With the previous one.
And you can see the
request packet only with this filtering
expression.
So as a result DCP packets can provide
information about behavior of the hcp
clients and such as the number
of DHCP requests and the time
between requests.
So this information can be used to identify
clients that are misconfigured or that have
some network issues and you
can find the network issues with
investigating and discovering
some DHCP
packets on your network.
And let's talk about gcp attacks gcp
packets can be used to detect the SCP
starvation tax or DHCP. Superfic
attacks. TCP starvation attack is
a type of Daniel of service, you know,
those attack where an attacker
sense a large number of thcp requests
to exhaust the sap service IP
address pool.
And the ACP superfink attack?
Anticipating attack is a type
of men in the middle attack where an attacker sends fake
DHCP responses to clients in an
attempt to redirect their traffic to
a different network to detect
DHCP records forward. You can
filter for DHCP request packets that have a
high number of requests from the
same client or from multiple clients in a
short period of time.
So to detect the SCP is proving attack.
You can filter for DCP over packets
that come from unexpected TCP
servers.
Or that have unusual values for the DHCP options
to do this. You can use that
filter expression like this.
And when you apply this filter, you will see only
offer packets only the sap
offer packets and you can investigate
the DHCP offer packets
applying this filter expression. So you
can search for the some attack
patterns in the ACP terrific
and you can use that to find
some malicious activities on your network.
Okay. Now we are going to investigate the net bios
protocol.
So over this PK file in order
to see on the net bios traffic we can type this
filter.
N b and s is a
filtering expression in order to see only the
net buyers traffic and click on the enter.
As you can see now we only see the ambience
which means net bios
packets net buyers traffic.
So net bios, which means Network basic input
output system is a protocol
that provides services for applications on a
local area network to communicate with
each other.
Maybe you know net buyers provides
three main services and these services are
name servers and these services
are names service session service and
datagram service. So what
is the name service? Let's talk about
a little bit the name service allows devices
on a network to register their names and IP
addresses and to resolve the names of other device
on the network.
And this errors applications to identify and
connect to other devices by name rather
than by IP address in order
to get details. We can look at queries in packet
details.
So let's look at in a packet tail
details on a packet.
And let me show you net bios name
service information in here.
So in order to get details, we can look at the
queries in packet details
and when we look at the queries, we
see the name of the mission.
And its name is ECI domain.
So again expanding and
as you can see, the name
information is ECI domain
and this mission is a
domain controller.
So we can learn this information
from this queries information and
the type value and
the class value are also in here.
So and we can look
at another machine.
In detailed and in here this
machine has a name with work
group.
And this machine is a domain Master browser.
We can learn it from here.
Thanks to net bios. We can get detailed such as
like this we can get detailed
information about the machines in our local network
in this way.
And we can analyze the traffic between them. So
if there are errors or anomalies we
can discover them in discovering
and identifying
some problems on
our Network. So, of course
we can filter by name to see the traffic
of a particular client. So let's
say I want to see only this Mission traffic
on our Network and I want
to use the name information to filter
out you can do that
in two ways one way,
you know preparing as filter.
Like this you can use this method to
filter out and the other
one as you can guess we
have used before we can
we can take the name
information and drag into
the display filter and drop it.
So when we do that, you can
see the only traffic which
associated with the mission as
the name work group.
So now I can see the only
packets associated with this measure.
So that's all about the net buyers traffic.
Okay, let's jump to the kerberus now.
So gerberus is a network Authentication Protocol that
is designed to provide secure authentication for
clients and service on a computer network and
it was developed by the MIT in
the 1980s.
And it is widely used in windows-based networks,
as you know, and other environments that
require secure Authentication.
Covers is the default authentication Service
for Microsoft Windows domains.
And in an active directory domains,
maybe you know, so it is
widely used in windows-based networks and
it is used in Unix environments as well
and covers uses a combination
of secret K cryptography and
a centralized authentication server
to provide secure or the indication
the key component of the covers protocol
is the curves or the indication servers, which is
responsible for organicating clients and
servers on the network.
A Nicholas such as a computer or a
user wants to access a network resource. It
sends a request to the terrible authentication
server and the authentication server
checks the client's credential and if it
is valid generates a unique session
key for the client. So the session
key is then encrypted with the
clients secret key and encrypted session
key is sent back to the client and
decline then uses the session key
to encrypt a request for the network
resource.
And sent the encrypted request to
the server that hosts the resource
and the server which also has
a copy of the session key decrypts the
request and grants access to the
resource. And one of the key benefits of servers
is that it doesn't send
plain text password over the network. So another
benefit is that it uses ticket
which are encrypted and have limited
lifetime in this way. Even
if the ticket is intercepted or leaked
it will be users after the
lifetime.
Since keys are used in
this way in communication with turbulence. It
is necessary to decode the traffic.
So to decode curbs traffic we must
have the keys used in the traffic.
And if we have a key type file
that contains key values in this
way, our job is easy.
And if you have a key type file in that
situation you can use it to record the
traffic.
And when we look at the current traffic
at the first glance, you can
use a filtering expiration like
this.
When you type this filtering expiration
as covers, you will
see the only purpose traffic on your PK
file click on the enter as
you can see now we have the only curbs
traffic and associated
with it some traffic
associated with the covers traffic.
For example, there's an HTTP packet after
performing servers authentication
process in a Converse traffic
in a Converse conversation first. The
user sends a packet
to the curve cover server.
Our user has an IP address and
Suite 12 and 12 and the
curb is server has an IP address and with
3.1.
So this is our turbo server and this
is our client or you can think of
an user in our Network and user
is sending a request packet.
To inform the Kerber server
about its client name.
Client client name information has been
sent by the client.
So we can see in a curbs field in
the covers field. The cname information
is administrator.
So this is the client name information of
the client and we
can think of as a sea
information and the
client sent the username
as administrator to
the curb your server in this pack
in the first pack.
So
after the client send its
client name as administrator the
cover server will respond with
a response packet.
To the client and in this packet,
we can see a ticket.
We can we are called as
TGs this ticket
and the server is going to respond
to back with a ticket at TGs like
this, but we can we can't see the ticket.
As a plain text because
the we haven't decrypt
our traffic yet. We should
use the keyfile to decrypt
this traffic and in order
to see the ticket information in
a plane text. So there
is a ticket
in the response packet
and now
Here the client are talking
to the covers interface
in the Kerber server. So
there are two interfaces in the
turbo server. We can think of
that there are two interfaces
in our server and one
of them is called turbos interface. And
the first two packets is associated
with the talking to
the first interface covers
interface. And then
in the step three
client again set is
sanding a packet a request
packet and in this
packet we can see
A request meaning that
the server that I want
to talk to.
Is this a client say this?
I want to I want to talk.
With a server in our Network.
And let's say
and an nftp server.
I want to talk and FTP server, or I want
to talk to the printer.
and in this packet with this packet,
the client says that
hey curb yourself. I want to talk a
server in our Network.
And I want to request request making make
a rocket request about this.
in this request you can see the server name
the
Server name that the user want to talk
to.
so
In here, we can see the s name
server name String.
HTTP so we can understand
that the client want to talk to
the HTTP server and
this server name sittering. Is this
deny dc.com
so
we can't we can't see some detailed information
in here.
Because as I told
you before we haven't decrypt
our traffic yet traffic yet and in
this packet in the third packet.
As I said server informed about
the server that it wants
to talk and this conversation
between the user and
the interface of TGC.
So sorry the interface
of the TGs.
There is a there's an another interface
on the cover server
and it's called as TGs.
so
and to respond
And the curb your server?
sending anti-curable server is sending
a response to this request about
talking to a
server from the client and
In this response, you can see another ticket
data.
So this ticket
Is for talking with
the server?
the talking with the servers by client
So the declined will use this ticket
in order to talk to the
server that it wants.
And if you have a key type file, you can use it to
decrypt the curb traffic by
going to
edit menu and preferences
and covers protocol. We will go to the service
protocol.
And we will choose the key rb5
because our current
protocol as the version 5.
And in here you will choose your
keyfile, but before doing this,
you should choose this option.
You should check this option.
To try to decrypt covers Bluffs to
obtain additional information and
some information that
has been encrypted. So now
let's choose our key
type file in here and we
have it in here. They deny
dc.com.key
Your file can be in a format dot
tab.
and open
then you shouldn't change your
UDP Port TCP Port
information. If it is not necessary and
click on the okay button.
Now as you can see there is
such more additional information
we have
after the decrypting process, we
have a lot of
extraordinary and
extra information about our traffic
So now if we can look at
the ticket field, we can
see the ticket information ticket data as
a plain text.
So let's look at this.
and
Let's look at these information in here.
You can see the
encrypted ticket part. Now, you can
see the key value now,
let's expand and
learned encrypted ticket party
and
here it is. That is it.
So now we can see the key value as you
can see.
The circle and we have now key
value data information
and we can see the key value
now.
So there are so much more information in
addition to key value and
you can see also authorization data
in here.
And there are such more information.
as you can see
so you can analyze these data.
if you need to this ones and
some other information you can obtain.
So that's all about curbs traffic and
the curves process.
and after the curves negotiation
as you can see in this step,
the driver's negotiation
has been completed and after this step
now client can
Access to the HTTP servers as
you can see now the client can send an
HTTP request to
the server. So you have learned how
the clients and the cover
servers talk to each
other and after this negotiation process
how the client access
to a server in our
Network just like in our example, it was an HTTP
server. So you can
analyze your PK files. You can
analyze your packets following these method.
And that's all for covers protocol.
So that's all for now. See you on the next video.