Instructor: In this lecture,
we're gonna talk about the tool called Wireshark.
Wireshark is a network protocol analyzer.
It's not designed for hackers and it's not designed
for hacking and spying on other people on the network.
It's designed for network administrators so that they can
see what's happening in their network and make sure that
everything is working properly and that nobody's doing
anything bad or doing anything suspicious on the network.
The way that Wireshark works is it allows you to select an
interface and then logs all the packets or all the traffic
that flows through that interface.
So you're selecting an interface.
It could be a wireless card,
it could be a wired card, on your current computer.
And then it'll start logging all the information that flow
through that interface.
It also has a really nice graphical interface that allow you
to analyze this traffic.
So it allows you to filter these packets based on the
protocol using them like HTTP, TCP, and all that.
It also allow you to look for certain things.
For example, if you're looking for cookies
or if you're looking for posts
or get requests,
and it also allow you to search through these packets,
you can, search through the information that's stored
in the packets and find the things that you're looking for.
It's a really really big tool
and you need a whole course for it.
So in this course,
we're actually gonna use it in a few lectures,
just covering the basics or the things that's related to us.
So the main idea here is Wireshark is not a hacking tool.
It only allows you to capture the traffic that flows through
your own computer, through your own interface.
I'm gonna use it now,
and it's gonna become more clear to you.
So I'm just gonna go to kali
and we're gonna start Wireshark.
You can run Wireshark from the command prompt,
or you can just go on all applications and type Wireshark,
and it'll show up right here.
I'm gonna click that and that's gonna load the program
for me.
This is just the normal error.
Just ignore this error.
And this is the main interface of Wireshark.
So first of all,
you can actually just go to the file and go to the open.
And in here,
it'll allow you to open a file that you've already captured.
So for example,
if you capture the packets using a different sniffer,
using arrow dump or using man in the middle left or using
t-shark, which is the command prompt part of Wireshark.
So if you captured packets using any of these programs
and you started it in a file, you can just come in here,
open it and start analyzing that file.
This is really handy because sometimes you don't really want
to analyze the traffic on the fly.
So sometimes you just want to capture it.
If you're, sometimes you're capturing from small laptop
or your smart capture capturing from your phone,
and you're not even at home,
you're in somewhere else doing your pen tests and then you
go back home and then you want to analyze what you captured.
Then you can store that in a file.
And then just come here, go to the file,
open and open the file that you want to analyze.
So what I want to show you here is the idea that Wireshark
is not a hacking tool.
It's not going to capture things happening
in another device.
It'll only capture things
that flow through your own interface.
So right here, we can see that we have all the interfaces
in my computer.
So we can see that we have eth0.
We have any, which is just any,
and we have all the other ones that some of them are created
by virtual box.
So the main one here is eth0,
which is the virtual interface connected to my NOC network.
And you can see that there is no traffic flowing
through this.
So you can see that this is constant
and nothing's happening.
So what I'm gonna do now is I'm just gonna make this a
little bit smaller, and I'm gonna open my browser here.
And I'm just gonna go to a normal website.
I'm just gonna go to google.com.
Now as you can see right here,
you can see the traffic eth0 is a spiking up.
So there was some traffic generated through eth0.
So for sniffing on this,
we'll be able to capture these packets that were sent
over eth0.
Now what I'm gonna do is I'm gonna go to my windows
machine just to prove that point.
And I'm gonna browse the website here and you'll see that
eth0 will not be affected.
And the traffic that's generated on this windows machine,
which is in the same network as the kali machine,
it will not be captured by the kali machine.
So if I just go to Google again here,
you'll see that nothing happened in eth0.
So there is no traffic flowing through this.
It's still constant.
And we can only capture packets that go through eth0.
So now you'll probably ask then why Wireshark is so useful?
Why are we even talking about it?
If we can only see things that go through our own computer,
why are we talking about it?
Well we're talking about it because
we see there is a large number of ways
that you can become the man
in the middle.
We learned how to do this using ARP spoofing,
and in future lectures,
I'm gonna show you how to do it
by creating a fake access point.
So when we are the man in the middle,
if we start sniffing on the interface
that's used to become the man in the middle,
we'll be able to capture all the traffic generated by the
people that we're targeting
in our man in the middle attack.
So if you started the fake access point,
you can start sniffing on the interface
that's broadcast in the signal and you can capture all the
packets sent or received to anyone who's connected to
that fake access point.
If you became the man in the middle using ARP spoofing,
then just select the interface that you used when you
launched your ARP spoofing attack.
So for now, I'm gonna become the man in the middle,
using ARP spoofing.
You can use ARP spoof or bettercap as I showed you earlier,
but I'm gonna use bettercap using the exact same command
that we used to do.
So we're literally just doing bettercap followed by the
interface that is connected to my target network,
which is eth0.
And I'm launching my caplet, this spoof caplet,
so that it configures the ARP spoof module and runs it for
me to put me in the middle of the connection.
So I'm gonna hit enter.
And as you can see, it's working as expected.
So right now I should be in the middle of the connection,
intercepting anything the target windows machine sends
or receives.
Now let's go to the windows machine
and see if I do anything here
if it's gonna affect the traffic in eth0.
So we'll see if Wireshark will be able to capture traffic
generated by this computer.
So let's write anything here.
I'm just gonna Google it,
or I'm just gonna go to a different website.
I'm just gonna go to Bing.
And if we come back here,
you'll see that we have traffic being generated here,
and we can see that eth0 is actually capturing whatever
that's happening in a completely different device.
This is happening because when we are the man in the middle,
all the packets that's generated by the windows device is
actually being redirected to my own computer
right here to the kali.
And then Wireshark is sniffing that from the kali machine,
it's sniffing it from my own local machine.
It's not sniffing it from the network.
It's not sniffing it from the target computer.
So again,
if you're doing this with the fake access point and just
listen on the interface that you're broadcasting,
if you're doing this with a real wireless network,
if you're connected
to your home wireless network using land zero,
then you can just do this with land zero.
But with ARP spoofing,
you have to first redirect the traffic,
then you can use Wireshark.
Now this is just to show you what Wireshark is
and how it works.
And I just wanted to stress the idea that Wireshark is
not a hacking tool,
it's only a program that allows you to log packets
flowing through a certain interface
and then analyze these packets.
So in the next video,
we'll see how we can sniff
and analyze packets using Wireshark.