So coming back to exploit get traffic let us say we already figured out that what we're the AP requests
that came from the IP the other query that we can look for is what was the response.
Our work was the request response bear from that particular IP.
So we can write a filter with say that actually D-B request or SCDP UDP responds that word from IP address
185 1:58 153rd or 2 0 4.
So if you look at the peak snapshot now you'll see that there is a GET request then followed by a response
which contains 49 595 bytes.
Then there was another request to a pretty long and we're you are right and that was followed by another
text messaging matter response.
Then there was another pretty long GET request that you or I it is pretty long and it's followed by
another response which is basically an application Hexham as download MIME type.
So this is how you can see what was in the quest and what was the corresponding response that came back
to you.
So from this query we have an idea that there were three malicious requests made and they all resulted
in two successful responses.
Had two of them seem to like dexterity M-L pages and the last one looks like an application or probably
in X-C or something like that.
You can further right click on one of those requests.
Click on follow APCP screen to further drill down into what happened.
So let's say we right click on the first request and go to follow tree follow PSAP stream to see what
happens.
So this will launch and the request response.
Bear in the wire charge you and you can see that this is the long get request.
It's pretty long it has a lot lot of characters.
The interesting part here is the reference frame.
It says that the traffic has been referred from this particular domain and this pretty much looks like
India.
So we're now you can go back to your peak out and look for this IP address.
Look for this particular piece.
And you can see what exactly is there inside it.
So once again once you reach to that get request you can right click on it.
Follow VCP stream and you'll see that this web page is pretty small and all it contains is an iPhone
screen.
So I-frame is nothing but redirecting your traffic to the particular source that has been mentioned
in the frame.
So this is how the attacker sends the traffic from a legit make web site using tedious.
All the way to the exploits so we're coming back to or explored get paid you can basically look at the
content of the landing page as well.
Most of the time it's going to be heavily obfuscated and it's going to be very very challenging to be
off it scared them it's not easy it's pretty complicated.
You will have to do some add ones and browser based debugging in order to really get the actual script
or the actual issue DML page which will contain all enumerations scripts in much more readable format.
So here is another example of how explored gets off the station would be visible to you in a bad now
looking to hour another get request.
You'll see that this get request is nothing but an application Shockwave Flash.
So what is happening in this case is that once the browser was able to figure out that you have a wonderful
Waterson of Flash Player running on your machine it basically sends you a flash exploit.
There are two ways of identifying it.
In fact there are three ways of identifying it.
One can be directly from the get request if the get request contains or dark as WFA extension.
We can say that.
OK.
This is a Flash file.
But in this case if you see there is no extension it's a pretty long you tried that.
And it doesn't really contain darters WFA extension.
So from here we were not able to identify that this was a flash file coming down in the response.
You can look at the Content-Type field which basically points out that this is nothing but a shock will
be fine.
The third way is to look at the Magic by it.
So far flash files a magic bytes is CW is in fact there are two different magic bytes for flash fires.
One is CW W-S which is compressed and the other is S-W as they both are basically pretty appropriate
to the shock of the Flash file formats.
So we will go into much more details as to how we can individually analyze these exploits for the time
being.
Let's focus on the malicious traffic or the malicious exploit the traffic itself.
OK.
So this was a quick demonstration on how we could look at the request response how we can look at what
malicious traffic was served by the exploit kids.
What was the actual exploit that was launched on the girls.
And the ones you have the idea is you can also figure out what's the host and you can also write filters
based on the host as well.
You can also look at all the DP requests.
So what happens is once your machine has been infected or ones the exploit was successful and the payload
was dropped on your machine you might want to look at all the issue to be required that get generated
from your machine because once the payload is there on your machine and once it's exit yielder it will
start making a lot more get requests and that's where searching based on IP or searching based on hostname
would not really help you much.
So you can look at and its GDP request filter to basically see what all requests response bears what
all the requests were made on your machine.
Another way would be to just filter out the traffic based on timestamp.
If you can if let's say you know that they first get requests was made at 23 15 then you can basically
filter all your traffic all from 23:15 all the way to let's say five or six minutes.
So that will give you a much more clearer understanding as to what were the traffic that was specifically
generated by the exploit.
Good.
Because a lot of time the gaps can be really huge.
They can contain a lot of medical data.
So filtering the traffic based on time Stan would again be a very helpful way of narrowing down your
search directly to the information that you looking at.
So this was all about smart kids and the next video will start analyzing and playing with some big gaps
that contains exploited traffic.
Thanks for watching the video.