Let's take a more effective exemption using explicable.
Now we notice in the previous scenario that when we start capturing life using explicable we start getting
some error message in some new browser saying that a certificate is not valid.
So this may be suspicions for some of the user.
So there is another way for using explicable more effective and undetectable.
So let's start explicable first and let's see how we can use it in a different way before starting what
we need to do we going to use word shark because white shark actually it's much more effective when
it comes to capturing traffic.
I'm gonna run wild shark on a permission small toy to capture traffic from all the network.
Then I'm going to save this file and import the file to explore and see how it can be translated to
something that can be understood.
So I'm going to start the program first.
I'm going to go here and uh we're gonna go to uh forensic and explicable and if you remember that is
some sittings that need to be done first.
So uh you have to start that batch server and you have tons of comment.
So uh if you don't remember just get back to the previous lecture.
So it opens a program but what I'm going to do right now I'm going to start was shark not do anything
in the program.
I'm gonna start to our shark and I'm gonna start capturing traffic and I'm gonna generate traffic from
different machine.
So uh this is what shark uh you need to go to capture and option and make sure that permissions mode
is active.
By doing that you are you'll be capturing traffic from all the computer inside your network.
And then uh also if you can go to a believe option and make sure also that resolving Mako.
This is uh active as well.
So I'm fine.
Now let's start the capturing.
So the setting is okay.
Do.
And here you go.
And I'm gonna choose a song that you can do that for wired or wireless it depend
and start capturing that.
No let me go to some other machine including my own machine.
So I'll go here and let me open a browser in my Windows 8 machine let me go to any website I went to
Yale.
I went to Google I would go to Google and notice that I will not get any error message.
And let me search for anything like for instance uh your
and let's search for some image in your
SO.
NO error is showing everything is going fine.
And as you can see everything is you know quite simple.
Uh let let me go to an e-mail.
Let me go to the main account
so I'm opening Jimmy.
Uh so you know everything is okay.
No error at all.
Now let me go to windows 7 machine on the network.
And this was the same machine we were receiving error while opening Google and so on.
You can see now that if you open Google for instance you don't get anything.
So no error will be showing open Google's open Microsoft no cert error.
If we go to let me go to my Web site and feel sick for to see my personal Web site
so as you can see we are going to different Web site.
And uh uh once I finish let me get back and let's close uh.
Let's.
And you notice that I am using different operating system Windows 8 Windows 7 everything everything
has been captured here.
So now that me stops capturing
and let me save this fine.
So I'm going to save it.
Michael in the next step as an limit for instance uh w is this
just don't forget what it's saved it's in the root directory okay NWS that's
now let's see how to import this file to explicable because you notice that the file is not so clear.
Right.
So what we're gonna do that we will create a new case number is named this case uh for instance.
Uh w w this
and I'll make sure that this time I'm gonna choose upload a pick up capture file.
I would not choose life capturing because we saw the life acquisition.
You know if it's a new operating system it will not go that's mostly it will keep giving you a certificate
that somebody chooses one key and it has been created.
So we're going to create the case.
I'm sorry.
Decision
and in the station will name it.
Let's see maybe the pseudonym.
Usually people are naming according to a date or times who can you know be able to distinguish in the
future.
Like this was done in the specific date so maybe I'm using a random date but with random names.
But when you are creating.
It's better to give them like names that you can trace in the future or understand.
Why is this capture has been taking so so a case then.
Sensation I'm opening now decision and what I'm going to do I'm gonna imports of fired which is uh to
W S this should be sort of a directory.
The U.S. must be
uh where is it.
It is one tablet as test.
This is a pick file as you can see.
You click on it and then you click on open.
And once the file has again I'm sorry
the rupee is
low.
Yes just you go some open and then upload an equal approach the content and translate it to a uh something
that you can understand and you can trace.
So let's see it showing you may take some minutes.
Until it load and lies
because a showing you the TTP traffic the Facebook traffic the uh uh e-mail traffic and you can get
all excellent.
So as you can see you know those are the TTP traffic nothing else if I was OK if I opened the Facebook
or I open an email or use it.
But he would be able to get that.
So let's see.
So let's go to graphic first press conference and to Dennis all the Web site that has been resolved.
So double click on it.
As you can see those are also Web site with the DNS IP.
Now let's go to the AAP.
I'm not very useful when it comes to our pandanus but I'm just showing you that he's translating those
hikes up from the White Shark to something that we can understand.
And the if we go now to web we can see the site all the sites at all user browse.
So just click on it.
As you can see all the sites out there you can see images from those Web site.
Any images that I browsed or I checked.
So as you can see there is some up here but
feed nothing is the rosy meal you can get the meal from here if uh if the rules like uh a chat can be
rebuilt.
It's an excellent tool actually.
And I would like you to spend some time studying the tools because I believe the rules a lot of sitting
uh that allow me even to get more.
So it's it's an excellent.
So I just want to show you as another example on how instead of capturing life packet to capture them
using words shark and then imports of fine and then analyze the content of the file using explicable.