And this lecture we're going to talk about a tool called wire shark wire shark is a network protocol
analyzer.
It's not designed for hackers and it's not designed for hacking and spying on other people on the network.
It's designed for network administrators so that they can see what's happening in their network and
make sure that everything is working properly and that nobody's doing anything bad or doing anything
suspicious on the network.
The way that whale shark works is it allows you to select an interface and then logs all the packets
or all the traffic that flows through that interface.
So you're selecting an interface that could be a wireless card.
It could be a wild card on your on your current computer and then it'll start logging all the information
that flow through that interface.
It also has a really nice graphical interface that allow you to analyze this traffic so allows you to
filter these packets based on the protocol using them like HDTV TGP and all that but also allow you
to look for certain things for example if you're looking for cookies or if you're looking for post or
get requests.
And it also allows you to search through these packets.
It can you can you can search through the information that's stored in the packets and find the things
that you're looking for.
It's a really really big tool and you need a whole course for it.
So in this course we're actually going to use it in a few lectures just covering the basics or the things
that's related to us so the main idea here is why a shark is not a hacking tool.
It only allows you to capture the traffic that flows through your own computer through your own interface.
I'm going to use it now and it's going to become more clear to you.
So I'm just gonna go to college and we're going to start to our shark.
You can run wild shark from the command prompt or you can just go on all applications and tripwire shark
and it'll show up right here I'm gonna click that and that's going to load the program for me.
This is just the normal error.
Just ignore this error and this is the main interface of where shark.
So first of all you can actually just go to the file and go to the open.
And in here it will allow you to open a file that you've already captured.
So for example if you captured packets using a different sniffer use an arrow dump or use in man in
the middle left or using key shark which is the command prompt part of the shark.
So if you captured packets using any of these programs and you started it in a file you can just come
in here open it and start analyzing that file.
This is really handy because sometimes you don't really want to analyze the traffic on the fly so sometimes
you just want to capture it if you're sometimes you're capturing from small laptop or your small capture
in from your phone and you're not even at home you're in somewhere else doing your pen test and then
you go back home and then you want to analyze what you captured then you can still do that in a file
and then just come here go to the file open and open the file that you want to analyze.
So what I want to show you here is the idea that while shark is not a hacking tool it's not going to
capture things happening in a in another device.
It will only capture things that flow through your own interface.
So right here we can see that we have all the interfaces in my computer so we can see that we have 88
0.
We have any which is just any and we have all the other ones that some of them are created by virtual
box.
So the main one here is if you're 0 which is the virtual interface connected to my not network and you
can see that there is no traffic flowing through there so you can see that it's this is constant and
nothing's happened in.
So what I'm going to do now is I'm just gonna make this a little bit smaller and I'm going to open my
browser here and I'm just gonna go to a normal Web site I'm just gonna go to Google dot com
now as you can see right here you can see the traffic 80 heads euro is a spike in up so there was some
traffic generated through it it's Europe.
So for sniffing on this we'll be able to capture these packets that were sent over 88 0.
Now what I'm going to do is I'm gonna go through my windows machine just to prove that point and I'm
going to browse the Web site here and you'll see that 88 0 will not be affected and the traffic that's
generated on this Windows machine which is in the same network as the Kelly machine it will not be captured
by the Cally machine.
So if I just go to Google again here you'll see that nothing happened in 88 0.
So there is no traffic flowing through this.
It's still constant and we can only capture packets that go through 88 0.
So now you'll probably ask then why why are sharks so useful why are we even talking about it if we
can't read.
If we can only see things that go through our own computer why are we talking about it.
Well we're talking about it because we see there is a large number of ways that you can become the man
in the middle.
We learned how to do this using a Sharpie spoofing and in future lectures I'm gonna show you how to
do it by creating a fake access point so when we are the man in the middle.
If we start sniffing on the interface that's used to become the man in the middle.
We'll be able to capture all the traffic generated by the people that were targeting in our mind in
the middle attack.
So if you if you started the fake access point you can start sniffing on the interface that's broadcasting
the signal and you can capture all the packets sent or received to anyone who's connected to that fake
access point if you became the man in the middle using AARP spoofing.
Then just select the interface that you used when you launched your AARP spoofing attack.
So for now I'm going to become the man in the middle using AARP spoofing.
You can use AARP spoof or Buttercup as I showed you earlier.
But I'm going to use Buttercup using the exact same command that we used to do.
So we're literally just doing Buttercup followed by the interface that is connected to my target network
which is 88 0 and I'm launching my couplet the spoof couplet so that it can figures the AARP spoof module
and runs it for me to put me in the middle of the connection so I'm gonna hit enter and as you can see
it's working as expected.
So right now I should be in the middle of the connection intercepting anything.
The target Windows machine sends or receives.
Now let's go to the Windows machine and see if I do anything here.
If it's going to affect the traffic in 88 0 so we'll see if Fairchild could be able to capture traffic
generated by this computer.
So let's write anything here.
I'm just going to google it or I'm just gonna go to a different Web site I'm just gonna go to Bing
and if we come back here you'll see that we have traffic being generated here and we can see that 88
zero is actually capturing whatever that's happening in a completely different device and a device that's
not even connected to our network.
This is happening because when we are the man in the middle all the packets that's generated by the
Windows device has actually been redirected to my own computer right here to the Kali and then wired
shark is sniffing that from the Kali machine it's infinite from my own local machine it's not sniffing
it from the network it's not sniffing it from the target computer.
So again if you're doing this with the fake access point then just listen on the interface that you're
broadcasting if you're doing this with a real wireless network if you're connected to your home wireless
network using land zero then you can just do this with land zero but with AARP spoofing you have to
first redirect the traffic then you can use wire shack.
Now this is just to show you what why a shark is and how it works.
And I just wanted to stress the idea that our shark is not a hacking tool.
It's only a program that allows you to log packets flowing through a certain interface and then analyze
these packets.
So in the next video we'll see how we can sniff and analyze packets using wire shark.