‫So we're going to use Carly for this demonstration, and we're going to need another system.
‫So here I have OWASP Broken Web Applications VM, which is one of my VMS, and it has a web application
‫and the web server is running by default.
‫So first, I want to sniff the entire traffic passing through the eith zero interface, right?
‫TCPDUMP is embedded into Carly, so we're ready to use it.
‫If you type tcpdump and then hit enter, it starts to listen to the traffic.
‫And by default, it listens to the interface of the use zero and that's exactly what we want right here.
‫So, right, there's no traffic at the moment, so let's make some noise.
‫I'll go to the OWASP CWA and Ping Carly.
‫Now, turn back to Carly, and yes, here we have the packets caused by the Pinkman ICMP Echo requests
‫and replies.
‫And there are some other packets too and of course, our request and the responses before them.
‫So we can limit the number of receive packets using the C parameter.
‫The command stops when it receives specified number of packets.
‫And here it stops after the fifth packet.
‫And having a look at the results, we see the domain names of the source and the destination systems
‫is especially good for remote systems outside the network, but we may want to see the IP addresses
‫of the systems instead of the domain name.
‫So to do this, we can use the end parameter.
‫And now the computers are listed with their IP addresses.
‫OK, so let's turn back to the first example.
‫We were listening to the eth0 zero interface and like I said before, it listens to this interface of
‫the interface is not specified.
‫And we can specify the interface we want to listen to by using the AI parameter.
‫Use AI with the name of the specified interface is zero in this example and hit enter.
‫Now, the second example, let's sniff only the TCP traffic between us and a target host.
‫TCPDUMP is the command itself, host parameters specify that the target, host and TCP is a protocol
‫we want.
‫Listen.
‫So it started to listen to the TCP packets between Cali and OWASP Speedway.
‫We have no TCP traffic at the moment, so let's create some.
‫So I'll open a browser window and visit a Web page hosted on OWASP BBWAA.
‫Now turn back to the terminal screen and whoa, we have a lot of TCP packets caused by HTTP requests
‫and responses.
‫Now we didn't use the end parameters, so we see the domain names and the service type, such as HTTP
‫instead of the port numbers.
‫Now let's run the same command once again, but with the end parameter.
‫So I'll go to the application and just click an arbitrary link to create some traffic.
‫Now back to the Terminal C, look at traffic with IP addresses and their port numbers.
‫So in the third example.
‫Let's have a look only at the VIP traffic received from the target host.
‫And right, if we don't enter any parameter, we will see the IP packets received from the target host,
‫however, we see a lot of different packets here as well.
‫Hmm.
‫So now I'll show you how to filter the received packets.
‫So to see only the received packets from the target host, we use SIRC.
‫So it's basically a keyword as our see before the host parameter.
‫Now the host IP and the IP keyword to filter the IP packets.
‫And look at that as soon as we hit enter, we start to receive some packets because the ping command
‫in the Iowa Speedway is still running.
‫We see the ICMP Echo requests, but we don't see the ICMP responses because we used these RC key word
‫before the host.
‫And we wanted to see only the received packets from the target host, so that's as it should be.
‫Now, let's go to the Web app and click any link to create some HDTV traffic.
‫And here are the IP packets of the HDTV requests.
‫Now you can press control and Siki to stop the command.
‫So in this next example, lit filter the TCP traffic of the entire network generated by HTTP requests
‫and responses.
‫So the net parameter to define the network, specify the network.
‫And here it's one seven two one six nine nine zero slash two four and a filter the HTTP traffic we can
‫specify Port 80.
‫So here we assume that the applications are using the default port, which is 80.
‫OK, so we'll start to listen.
‫Now we'll go to the Web browser and click any link to create the HTTP request.
‫And here is all the TCP traffic sent to or received from the default port 80.
‫So what would happen if we didn't use the port parameter?
‫Well, as you can see here, we would see the expected requests and replies as well because the ping
‫command is still running.
‫India was building a system.
‫So lastly, let's see the SS age traffic from a specified host to another one.
‫First, I'll go back to OWASP, BWR and check of the stage services running U.S Service Associate status
‫to check it.
‫Yup.
‫As I say, services running on OWASP bw.
‫So to see the port that SAGE listens to, you can use the netstat TI and LP command.
‫And as you see here, the top of the screen as state listens to the port to the default port for a sec.
‫So in Cali, I'll open another terminal screen and create an SSA connection between Cali and OWASP BW,
‫a type sage root at the IP address of OWASP, BW and hit enter.
‫And of the password of the user of OWASP BWB, which is remember, OWASP beetle hua is as long as you
‫haven't changed it.
‫And here we have an SS age connection.
‫So I'll go to the other terminal screen to create the tcpdump command.
‫As our co-host to specify the source host.
‫And DST host to specify the destination host.
‫And Port.
‫So now go to the SS age connection and send something to the Ottawa Speedway.
‫Hey, look at that, see, so we capture the packets in every keystroke.
‫The packets are from Carly to the poor 22 of a Wasp BWP, and I'm sure you saw it like I did because
‫we wanted to see the traffic only if the source host is Carly and the destination host is OWASP bw.
‫We don't see the S.H. packets received from OWASP BWR to see both sent and received packets.
‫We can change the command to something like this.
‫TCPDUMP hosted one seven two one six nine nine two one three nine and Port 22.
‫Now we'll see you receive packets as well as the scent packets.