Instructor: In the previous video
we seen how we can launch Wireshark
and we said that we can actually just open
a file that contains packets that we already captured
and we can start analyzing them using Wireshark.
In this video I want to start sniffing packets
and then generate some traffic
in my Windows machine
and then we'll see how
we can analyze these packets using Wireshark.
So I'm already the man in the middle
as I've said you first have to be the
man in the middle to use Wireshark
and then the traffic that's generated
in the Windows machine is actually
filmed through eth0 as we seen in the previous video.
So before I start capturing the packets,
I wanna go to the options
and I just wanna show you what options we can set.
So first you can see all the interfaces
that you have and you can see the traffic generated on them.
And you can see eth0 is actually generating
some traffic every now and then
because it's actually coming from the Windows machine.
So in here you can select the interfaces
that you want to start capturing on
and you can actually select more than one interface
and all we have to do is just hold the control
and then click other interfaces
that you want to listen on.
For example, we can just click them like this.
But for now I actually only wanna sniff on eth0.
Now if we go on the output
you'll see that you have an option to store
these packets somewhere
so again if you only want to sniff
and you don't want to analyze things
then you can just go onto browse
and you can store the packets
that you're gonna sniff somewhere
and then you can analyze them whenever you have the time.
At a different time you can just open
them with Wireshark like I showed you
in the previous video,
you can just go on file, open
and then open the packets and start analyzing them.
Now I have eth0 selected
and I'm just gonna click on start.
And that will start capturing packets.
Anything that's gonna flow through eth0
will be captured and it will be displayed in here, anything.
I mean images, pictures, messages, cookies,
anything that that computer does on the internet
will flow through eth0 and therefore
will be captured by Wireshark.
So it's not like man in the middle life
where it was only showing us the important
information right here you'll see anything,
all the traffic that's generated.
Now, I wanna go and generate some traffic
on the target computer so we can analyze it here
but before I do that
I'm gonna go back to buttercup
and I wanna see my hsts caplet
so I can downgrade https to http
'cause if everything goes over http
we won't be able to see or read anything
because like I said,
everything will be encrypted.
So I'm gonna hit enter
this will work as expected,
we'll go back to Wireshark
and let's go to the target computer.
I'm gonna go to google.ie
and let's search for something
so for example let's search for zSecurity
and keep in mind everything is loading
over http in here so that's why we'll be able to read
and analyze everything that we're loading right here.
Now, let's go back to Wireshark
and see how we can filter this information
and discover the websites visit
by the target, see the requests, and all that.
So I'm gonna click on the stop button to stop this.
Now this is the main interface of Wireshark
and you can see that the first thing we have
is each one record of this is a packet.
Now you'll see here the columns,
first of all here is the number of the packets
so you have this one is number one,
number two, number three and number four.
And the time,
you'll see the time when this packet was captured
so zero is when we first started sniffing
and then the time increases as we go down
and it shows when these packets were captured,
when they were sent basically.
You can also see the source,
so this is the device that the packet was sent from
and you can see that this one is not sent
from our target it's actually coming from the internet
from a server that has this IP
and it's going to our target computer
which is 10.20.14.206.
You can see the protocol so it's TCP for this one.
You can see that it's ICMP in this one
and you can see that it's ARP for this.
You can see the length which is the size
and you can also see info about this packet.
Now we can also notice that
these packets have different colors.
Usually green is TCP packets,
dark blue is DNS packets,
and if we go down we should actually be able to find
some of them and you can see all of these are DNF packets.
Light blue usually is UDP
but we don't have any UDP packets at the moment.
And you can also see we have some black packets
and these are TCP packets that
had a problem, that had issues.
Now I know what you're thinking,
there are so many packets in here
and a lot of them might not be useful to you
depending on what you're trying to get.
But don't worry about this,
in the next lecture I'm gonna show you
how to filter these packets to only display
the relevant ones and then analyze them
to extract the useful information.