Instructor: Now in this lecture,
I wanna show you how to use Wireshark
to discover data sent through forms,
whenever someone fills up a form.
And obviously, this will allow us
to get usernames and passwords
if people log in to their accounts.
So, I'm already running BetterCAP,
so I'm already the man in the middle.
And in Wireshark here, I'm just gonna start a new capture.
So I'm gonna continue without saving this one.
The filter is already set to HTTP
so it's only gonna show me HTTP packets in here.
And I'm gonna go to a target website in here,
so let's go to vulnweb.com.
Now keep in mind, like I said,
you have to be loggin' in to a HTTP page,
but that's fine because we already learned
how to bypass HTTPS, and even partially bypass HSTS.
So, I'm gonna be logging into a website
that just uses HTTP here, because it's just simpler,
and we've already learned how to bypass HTTPS and HSTS,
so there's no point of repeating that.
We're logging in with a username that is set to admin.
I'm gonna get the password to 123abc.
I'm gonna click on Login,
and this should have been captured by Wireshark.
Now let's go ahead and actually try this
with a website that uses HTTPS.
So let's go to stackoverflow.com.
Again, as you can see,
as long as the website gets downgraded to normal HTTP,
then we'll be able to capture the data sent
to and from this website.
So, we're just going to log in.
Put the username, we'll put it to zaid@zedsecurity.org,
and then we're gonna put the password.
So we'll just do 123123abc.
And let's go back to Wireshark,
and see how we can discover the username and the password.
So first of all, I'm gonna stop the capture.
And what we wanna look for is POST requests.
So you see in here this request right here was POST,
for example, and here it was GET.
Now forms are usually sent over POST,
especially login forms.
So if you're looking for login information,
you wanna look for POST in here.
So, going down we can see we have a POST request in here.
Now I'm gonna click here to actually show less information,
so it's easier for us to see.
So we can see this POST was sent to Google.
We're not interested in that,
we're looking for stuff that was sent to Vulnweb.
So I'm gonna keep going.
We can see we have a POST request here
to a login page, so this is definitely interesting.
Now, if we look down, let me just make this smaller.
So if we look down here, and look at the HTML form data,
you can see that we have a username here,
submitted to testhtml5.vulnweb.com.
The username is admin, and the password is 123abc.
Now if we scroll down again looking for POST requests,
you can see we have a POST request
for a page called users login.
So again, very, very interesting.
If we click on this, you'll see, if we scroll down,
you'll see we have the email, zaid@zedsecurity.org,
and the password 123123abc.
Again, this just goes to show you
that with Wireshark, you'll be able to capture everything.
Now this can actually be very, very useful,
because I noticed that BetterCAP is great
at sniffin' passwords.
And it pretty much gets you the passwords all the time,
but in the odd cases, sometimes it was failing
to filter the username and the password for me.
So, with Wireshark you'll actually be able to get everything
that passes through your interface.
So what you could actually do is you can just go
to your caplet that we always use, the spoof caplet.
This one right here.
Open it with the Text Editor.
And as you know, in this caplet,
we turn on our sniffer in here,
so we set the sniff.local to true,
and then we turn it on.
But before turning it on,
you can actually set the net.sniff.output
to a location for a file that'll contain everything
that BetterCAP captures.
So you won't actually have to start Wireshark
while BetterCAP is working.
You can just, in here, specify a place.
So for example, let's say root/capturefile.cap.
And then, when you run your spoof caplet,
it'll turn on the probe, turn on the recon,
run your spoofing attack,
putting you in the middle of the connection.
It'll run the sniffer as well,
and it'll store everything that BetterCAP captures
in a capture file.
Then, all you'll have to do is come here,
go to File, Open, and open the file that you captured,
and analyze it, as I'm doing right now.
So this can be very, very useful also
if you don't have a lot of resources on your computer,
or if you have a small laptop, or even a phone.
And you capture data with it,
store everything in a capture file,
and then just open it in here in Wireshark and analyze it.
Now finally, before I finish this lecture,
because all we're talkin' about right now is filtering data,
a really, really useful feature when filtering data
is the Ctrl+F feature, the Find.
So you can just press Ctrl+F from your keyboard,
this'll open this bar right here, this search bar,
which you can use to find anything
within the captured packets.
So, first of all, I'm gonna set the search
to search within the packet details.
I'm gonna keep this to Narrow & Wide.
In here, I'm gonna set this to Strings,
so that it looks for normal text.
And for example, let's say I'm looking for logins
that a person named Zaid has attempted,
all I have to do is just type Zaid.
And if I hit Enter.
And as you can see, it's taken us to the login attempt
when I logged in to Stack Overflow.
Or let's say you're looking for login attempts
by a person named admin or for a user named admin.
Again, if I hit Enter, it's gonna take me to the first time
an occurrence of the word admin happened,
which is in here.
It doesn't really contain any useful information,
but I can just click on Find to find the next packet
that contained the word admin.
Again, this packet doesn't really contain anything useful.
We can go next.
We'll actually have to go to the end of the file and go up,
because that was the first thing that we logged in,
so I'm just gonna keep clicking on next.
And right here we have the POST request for the admin.
And if we go down again, as you can see,
we have the username as admin and the password as 123abc.
So this feature can be very, very useful
to help you find what you're looking for.
Whether you're looking for a specific login name.
Whether you're looking for a specific tag,
a specific file, and so on.