Hello everyone in this lesson. I will tell you the FTP
analysis.
So before starting to analyze let's talk
about the FTP protocol for a while.
while transfer protocol
As you know ATP is a
standard Network protocol user to transfer files from
one horse to another over a tcp-based network
such as the internet FTP is
built on a client server architecture and
use a separate control
and data connections between the client and the
server when a client initiates an
FTP session it established control
connection with the server the client then
sends commands such as requesting a directory this
thing or uploading a file
over this connection the server response
to these commands and send status
and error messages back to the client.
So for file transfers is separate
data connection is established between the client and
server the client initiates the
transfer by sending a command
over the control connection such as retrieve
to download a file as
retr or store
as St. Or to upload
file.
The server then sends or receives the
file over the data connection and FTP
uses two main modes
of file transfer.
First one is asking mode and binary
and the second one is binary mode
asking mode is used for text
files and translates line
ending characters between different
platforms binary mode is
used for all other file types and doesn't
perform any translations.
So FTP is a widely used protocol
for transferring files, but it has some security
issues. For example, it sends
login credentials in plain
text and which can be intercepted by
attackers. And therefore it
is recommended to use secure file transfer protocols
such as SFTP or
FTP over SSL TLS.
And now let's investigate
APK file.
We have a PK file.
associated with FTP protocol and
FTP Network traffic
and in here first, we should
know that we only need to type FTP
as a filter.
in the display filter field
and you need to type FTP
as a filter to see only FTP packets
in our pickup file.
And click on the enter.
as you can see now we have only
the
FTP packets
And we will apply another.
Filtering expression and this filtering
is like the this FTP dot
request.
and
Dot
comment
Ftp.workers dot command, this filter
brings us the commands used
in the requests made to
the FTP server. For example, we can
use in this filtering we can
use user command from FTP commands
to analyze users trying to
login to FTP server for this. It
is enough to make a small change in our filter
and we can add the
command.
that we want to see the packets associated
with it and in here you can
type the command as
user
So now we want to see the
packets which has been applied
user command and when
we click on the enter.
As you see in here now, we
have only the packets which
is used which is applied a
user command.
and in here
it brought all packets associated with
the user command and FTP commands are
sent to the server.
FTP commands are sent to the server as plain
text and the server reply also in
plain text.
So remind that keep in mind that and some
common FTP commands like
this, let me show you.
in another screen
So you see the FTP commands in
here and first one is user and
pass commands there for
authentication process as you
guess user.
Is used to enter the username and
pass command is
used to enter the password information
and PWD is
used to display the current working directory
on the server. And the other one is
commonly used and CWD is
used to change the current working
director on the server and least
command is used to display a list
of files in the current directory on the server.
So the retrieve command
are ETR is used
to download a file from the server and the
store is used to upload a
file to the server and there is
a delete command which is
used to delete a file on the server.
So the last one is last one
is create a command and it is used to close the
FTP session.
And now let's continue to investigate in
our PK file.
You can also use that filter. I'm gonna
show you to detect attacks such
as Brute Force login attack and you
can use that command to
investigate the Brute Force
attacks.
Now we are typing our filter expression.
FTP Dot
response
and that
code
and is equal to
5
30
so this number is our Response Code
number Response Code value.
And since these Response Code
returns a failed login attempts, we
can analyze whether there are
attack patterns and in very
short time periods. It can be
investigated whether there is an attack by evaluating many
aspects such as
too many unsuccessful password entries or
if the source IP is
suspicious. So let's click on
the enter.
And we have in here a few
packet with the response
code 530.
And as you can see in here this type
of response.
Is showing us the incorrect password packets, which
means not locked in.
So there is a statement with incorrect
password.
And we can analyze some attempts some
login attempts in this way.
So now let's look at the another PK file.
You can use the FTP even data
filter to see the transfer data.
You can use I mean this filter
FTP here from
data
so
you can use this filter to see
the transfer data with this
filter. You will see the data downloaded with retrieve
command and upload it to the server
with Stockman. So now let's
click on the enter.
And as you can see in here some data
packets via.
FTP protocol
and you can see the retrieved command.
in the first packets
And you can also see the packets with
store command.
So
in here
Wireshark also allows you
to
why shall also allows you to
follow the TCP stream of a specific
packet and this can be useful when
analyzing the data transfer to follow the
TCP stream.
You can.
Right click on a packet and select
follow then TCP stream.
and you will see the
the TCP stream which is associated the
packet that you have selected. So
there is a TCP stream
with Tom FTP data.
And you can follow the FTP stream in
this way.
You can investigate the data
packets in
here.
And now we can close this screen.
And I will cancel this filtering.
I want to just type the FTP
command and
in order to obtain
better conversation stream associated
with the FTP protocol
for example, let's select this packet and
When you click on the follow anticipate stream.
like this
that is what I want and what I want
to show you and as you can see in here.
there is a FTP stream FTP
conversation and firstly
there is a user login
as
Anonymous and then
we can see in here password information.
And the there's a command.
Nftp command CWD.
and
so on.
so here
a file is downloaded which is
called Excalibur that hqx
extension. You can
see in here and
there is an another file which is uploaded
to the server with this name.
So you can see the all the entire FTP communication
FTP stream in
this window and you can investigate all
the FTP traffic.
So this is history is really useful window
to analyze the FTP traffic.
Now we can close this window.
and
another useful tool in Wireshark
In order to see the file contents in
clear text you can use the Wireshark built-in
feature as I as I
told you before and this
feature is export objects.
Maybe you can guess in
here under the file menu.
You will go to the export objects and
you can choose the FTP data.
So in here the data.
Which has been seen in the FTP traffic
you can choose the file that
you want to export and then you
can choose the save button and you
can investigate in detail these
files.
And you can analyze them whether there
is a suspicious patterns and you
can use this window to make
these analysis.
So
you can use this tool this Wireshark tool
to obtain the file that
you want to export.
And we can close now.
And you can look for some suspicious commands such
as chmod command which
is used to change the executing permissions of a
file. As you know, chmod command
is used to change the permissions of
a file and in order to find and look
for suspicious FTP data commands. You
can use the FTP hidden
data parameters.
again, we will use
the FTP Heaven data filter
expression FTP even
and data then we
will add another perimeter
in here that command.
And in here we will write the filter
like this. Let's suppose
that we are looking for whether there is a
CH command. So then we write this filter.
Sorry.
FTP data that
command
is equal to
Ch.
node
so
let's click on the enter.
And as you can see, there is no packet with
chmod command which contains
Sage Mode commands. There is
no packet with this command. So or we
can write that to find
out whether there is
a packet with this command and you
can use these filter again.
Ftpdata dot command matches. Maybe
you will remember this.
and command
is chm mode again.
You can use this way.
To in order to find the packets with
this command as well.
So when we click on the enter, the
result will be the same of course
and so there is no packet usage
mode command in and now let's
change this command to list.
let's look at
this command
and click on the enter as you can see.
There are a few files if you packets with
list command.
and
this command is used in these packets.
And you can create your filters, of course.
using the packet details information
so we want to create our filtering
with the command parameter, so
To do this we can use this perimeter in here.
And you can right click.
Then prepare as filter and select
it.
as you can see
it is applied directly.
so
this is the another way to create your filtering
expressions.
Okay, that's all about FTP protocol
see on the next video.