# Module 5.3: Wireshark challenge

<span style="font-weight: bold;">Wireshark overall plan:</span>

- learn how to read networks using nmap and ipnetmonitor
- install wireshark and learn how to read packets
- learn about the dialog all machines use on the internet (DNS, ARP, ACK-SYN, ICMP)
- learn how to install a wireless router to create an isolated hacker network (hackz0rz)
- use this network to attack and defend using metasploit
- learn how to protect yourself

<span id="bkmrk-downloading-parrot-o" style="font-weight: bold;">Downloading parrot-os:</span><div id="bkmrk-https%3A%2F%2Fparrotsec.or">[https://parrotsec.org/docs/virtualization/utm-configuration/](https://parrotsec.org/docs/virtualization/utm-configuration/)</div><div id="bkmrk-downloading-kali-lin"><span style="font-weight: bold;">Downloading kali linux:</span>  
<div>[https://www.kali.org/docs/virtualization/install-utm-guest-vm/](https://www.kali.org/docs/virtualization/install-utm-guest-vm/)</div><div>  
</div><div><span style="font-weight: bold;">Local downloads:</span></div><div>

1. go to elab.hpa.edu
2. look for computer engineering lower folder (bottom of page)
3. look for installers folder
4. download UTM and parrot-os.utm images
5. install on your own laptop
6. go to wireshark.org and install the version that matches your computer (windows, mac, apple silicon)
7. open wireshark and begin your challenge

</div><div>  
</div><div><span style="font-weight: bold;">Wireshark challenge: Part 1: http</span></div><div>Your challenge is to view the login credentials of an insecure <span style="font-weight: bold;">http</span> request using wireshark</div><div>

1. start wireshark
2. choose an active network interface (look for the squiggly lines)
3. apply the http filter
4. go to the IP address posted on the board
5. start packet capture
6. refresh the page
7. login to the admin pages (see board for credentials)
8. stop the packet capture
9. look through the packets for a POST entry
10. find the login and password you used
11. repeat this with another host
12. repeat using the http.request filter

<div><span style="font-weight: bold;">Wireshark challenge: Part 2: arp and icmp</span>  
</div><div>

1. open terminal
2. run ping to another machine
3. start wireshark with the arp filter
4. repeat with the icmp filter
5. what is the MAC address of the sender and recipient?
6. what was the round trip time for each packet?

</div><div><span style="font-weight: bold;">Wireshark challenge: Part 3: ACK-SYN</span>  
</div><div>

1. open a browser and visit a non-https host
2. filter with tcp in wireshark
3. fine a tcp 3-way handshake
4. what does ARP do, and why did it appear before the ping?
5. what do ICMP messages tell us about connectivity?
6. how can this delay help identify potential network intrusions?

</div><div><span style="font-weight: bold;">Server challenge:</span></div></div><div>

1. setup an apache server on one of the raspberry pi units
2. password protect some part of the web server (look up how to do this, either .htaccess or another method)
3. share your IP address with another student (the "attacker")
4. have them watch using wireshark as you login
5. challenge them to gain your password
6. question: why do we gather packets for later use using pcap?

</div></div>  
---

<small>Migrated from Apple Server Wiki. Original page ID: E3H2f941</small>