In this lecture I want to spend more time with wire shark showing you how to filter all of these packets
to only display the useful packets how to trace them.
What do they mean and how to display more information about each one of these packets.
Now all we did on the target computer so far we most of the traffic that we generated was hasty teepee
traffic.
So to get rid of all this information that's hard for us to read.
We're just gonna type in here and the filters.
We're just gonna type in haste TTP hit enter and as you can see now that's filtered all the packets
too hasty teepee traffic only so this is the traffic that was basically sent by the browser and is usually
sent by web browsers.
They always send traffic over hash TTP or hash TTP as answers were downgraded hash TTP to TTP you want
to use the hash TTP filter to see everything that a target person is doing on the browser regardless
of what they're doing whether they're browsing Web sites whether they're watching a video whether they're
looking at images wherever they're looking it will be loaded over hash TTP
so looking at the first record there right here we can see that this request is sent from this IP which
is the IP of my target to an IP on the Internet so we can see that this is not a private IP this is
an IP on the Internet so it's sent to a server and if we double click this record we'll get much more
information about the packet itself.
So we have the information about the frame which includes the size of the packet it includes the interface
that it was sent on the time and all that in the ethernet we have information about the source mac address
and the destination MAC address.
So where did this packet go from and where did it go to.
Remember when I when I first spoke about the packets and how they always travelled from a source mark
to a destination Mark.
So this information is all stored in here in the Internet Protocol.
We have information about the IP is so in the Internet we had information about the Mac addresses in
the Internet Protocol.
We have information about the source IP and the destination IP for this particular packet and the transmission
protocol we have information about the port so we can see that this went from this source port to port
80 This is usually the default port used on web servers.
So in most cases whenever data is sent to a Web site it will always be sent to port 80.
But the most important part in here is the Hypertext Transfer Protocol which is basically the data sent
over Hastie TPD.
Clicking on this will give us information on whatever that has been sent over Hastie TTP and like I
said this would contain everything that was sent to and from a browser.
So right here we can see that this particular packet sent a GET request to a Web site called Google
dot i.e..
Now this is literally when we typed Google data we did a search for anything we didn't really do anything.
You can also expand this to see more information about the actual the request and you can even see the
TTP had their sent.
If you want to get more information about this particular request now this whole method of getting information
follows with all types of packets so you can double click any packet you have and you'll be able to
read the data sent within this packet now you can also in here see an arrow which basically means that
this was a request and the arrow back here marks that this was a response to this request right here
now moving down.
You can also see requests for images which you can also do is click on any of these packets for example.
Again back to this get request right click it and go to follow Hayes TTP stream and this will basically
follow the stream that this request has caused all the way down to the response.
So if I click it you'll see the response for this particular request was this right here.
You can see that this was a PMG and literally the binary content of this PMG image is right here.
So as you can see we're literally getting the raw data in here.
Now I'm going to close this and go back to what we had which was Haitian TTP.
Now if we keep going down you literally see everything that has been sent and received by the target.
So for example again in here we can see this was a javascript file that was loaded by Google.
Then in here we can see another get request and this gets request was what we searched for Z security
so you can even see the search term in here.
So let me double click this to show you in more details.
Again this automatically went to the hypertext protocol part like I said this is the TTP part whatever
that gets sent to the browser and you can see that this was sent to Google dot com.
First of all and the you are ice or whatever went after Google dot com was search.
And what we were searching for was that security which is exactly what we typed in here again in here
you can see the fully URL with the search term.
This is literally what the user gets in there you are Albar in here so as you can see wires shark literally
shows everything that flows through the interface.
And this lecture I want to show you a quick overview on how we can filter data and don't worry too much
about this will actually be using it more in the next lectures and we'll see how we can easily use it
to filter data and discover useful information.