Now in this lecture I want to show you how to use whale shark to discover data sent through forums whenever
someone fills up a form.
And obviously this will allow us to get usernames and passwords if people log in to their accounts.
So I'm already running better cap so I'm already the man in the middle.
And NY shark here.
I'm just going to start a new captcha so I'm going to continue without saving this one.
The filter is already set to ETP so it's only going to show me his TTP packets in here and I'm going
to go to a target Web site in here so let's go to one Web dot com.
Now keep in mind like I said you have to be logging into a hash TTP page but that's fine because we
already learned how to bypass hash TTP as an even partially bypass.
Yes.
So I'm gonna be logging into a website that just uses hash TTP here because it's just simpler.
And we've already learned how to bypass hasty G.P.S. and HST yes.
So there is no point of repeating that we're logging in with the user name that is set to admin.
I'm gonna set the password to 1 2 3 ABC.
I'm gonna click on log in and this should have been captured by wire shark.
Now let's go ahead and actually try this with a Web site that uses each TTP s.
So let's go to Stack Overflow.
Dot com
again as you can see as long as the Web site gets downgraded to normal hash TTP then we'll be able to
capture the data sent to and from this website.
So we're just going to log in put the user name or put it to Zaid at that security dot org and then
we'll get to put the password.
So we'll just do one two three one two three.
A B C and let's go back to why a shark and see how we can discover the user name and the password.
So first of all I'm going to stop the captcha and what we want to look for is post requests.
So you see in here this request right here was posed for example and here there it was.
Get now forums are usually sent over post especially log and forums.
So if you're looking for log in information you want to look for post in here.
So going down we can see we have a post request in here.
Now I'm going to click here to actually show less information so it's easier for us to see so we can
see this post was sent to Google.
We're not interested in that.
We're looking for stuff that was sent to one Web site.
I'm going to keep going.
We can see we have a post request here to a log in page.
So this is definitely interesting.
Now if we look down let me just make this smaller so if we look down here and look at the hasty AML
forum data you can see that we have a user name here submitted to test hasty AML 5.1 web dot com.
The user name is admin and the password is 1 2 3.
ABC
now if we scroll down again looking for post requests you can see we have a post request for a page
called users log in.
So again very very interesting if we click on this you'll see if we scroll down you'll see we have the
email Zaid at that security dot org and the password 1 2 3 1 2 3 ABC.
Again this just goes to show you that with Wired shark you'll be able to capture everything.
Now this can actually be very very useful because I noticed that better cap is great at sniffing passwords
and it pretty much gets to the passwords all the time.
But in the old cases sometimes it was failing to filter the user name and password for me.
So with wire shark you'll actually be able to get everything that passes through your interface.
So what you could actually do is you can just go to your couplet that we always use the spoof couplet
this one right here open it with a text editor and as you know in this couplet we turn on our sniffer
in here so we said this nifty outlaw called Too true.
And then we turn it on but before turning it on you can actually set the net that sniff that output
to a location for a file that'll contain everything that Buttercup captures so you won't actually have
to start why are shark wild Buttercup is working.
You can just in here specify a place.
So for example let's say root capture file that cup and then when you run your spoof couplet it'll turn
on the probe Turn Turn on the recon run your spoofing attack putting you in the middle of the connection
it'll run the sniffer as well and it will store everything that better cup captures in a capture file
then all you'll have to do is come here go to file open and open the file that you captured and analyze
it as I'm doing right now so this can be very very useful.
Also if you don't have a lot of resources on your computer or if you had a small laptop or even a phone
and you capture data with it store everything in a capture file and then just open it in here and wire
shark and analyze it now finally before I finish this lecture because all we're talking about right
now is filtering data a really really useful feature when filtering data is the control feature defined
so you can just press control f from your keyboard.
This will open this bar right here the search bar which you can use to find anything within the captured
packets.
So first of all I'm going to set the search to search within the packet details.
I'm going to keep this too narrow and wide in here I'm going to set this to strength so that it looks
for a normal text and for example let's say I'm looking for log ins that a person named Z has attempted.
All I have to do is just type Z and if I hit enter and as you can see it's taking us to the log in attempt
when I logged in to stack overflow or let's say you're looking for log in attempts by a person named
admin or for a user named admin.
Again if I hit enter it's going to take me to the first time an occurrence of the word admin happened
which is in here.
It doesn't really contain any useful information but I can just click on find to find the next packet
that contained the word admin.
Again this packet doesn't really contain anything useful.
We can go next we'll actually have to go to the end of the file and go up because that was the first
thing that we logged in.
So I'm just going to keep clicking on next and right here we have the Post's request for the admin.
And if we go down again as you can see we have the user name as admin and the password as one two three
ABC.
So this feature can be very very useful to help you find what you're looking for whether you're looking
for a specific log in name whether you're looking for a specific tag a specific file and so on.