Skip to main content

Module 5.3: Wireshark challenge

Migration

Wireshark overall plan:

  • learn how to read networks using nmap and ipnetmonitor
  • install wireshark and learn how to read packets
  • learn about the dialog all machines use on the internet (DNS, ARP, ACK-SYN, ICMP)
  • learn how to install a wireless router to create an isolated hacker network (hackz0rz)
  • use this network to attack and defend using metasploit
  • learn how to protect yourself

Downloading parrot-os:
Downloading kali linux:

Local downloads:
  1. go to elab.hpa.edu
  2. look for computer engineering lower folder (bottom of page)
  3. look for installers folder
  4. download UTM and parrot-os.utm images
  5. install on your own laptop 
  6. go to wireshark.org and install the version that matches your computer (windows, mac, apple silicon)
  7. open wireshark and begin your challenge

Wireshark challenge: Part 1: http
Your challenge is to view the login credentials of an insecure http request using wireshark
  1. start wireshark
  2. choose an active network interface (look for the squiggly lines)
  3. apply the http filter
  4. go to the IP address posted on the board
  5. start packet capture
  6. refresh the page
  7. login to the admin pages (see board for credentials)
  8. stop the packet capture
  9. look through the packets for a POST entry
  10. find the login and password you used
  11. repeat this with another host
  12. repeat using the http.request filter
Wireshark challenge: Part 2: arp and icmp
  1. open terminal
  2. run ping to another machine
  3. start wireshark with the arp filter
  4. repeat with the icmp filter
  5. what is the MAC address of the sender and recipient?
  6. what was the round trip time for each packet?
Wireshark challenge: Part 3: ACK-SYN
  1. open a browser and visit a non-https host
  2. filter with tcp in progresswireshark
  3. fine a tcp 3-way handshake
  4. what does ARP do, and why did it appear before the ping?
  5. what do ICMP messages tell us about connectivity?
  6. how can this delay help identify potential network intrusions?
Server challenge:
  1. setup an apache server on one of the raspberry pi units
  2. password protect some part of the web server (look up how to do this, either .htaccess or another method)
  3. share your IP address with another student (the "attacker")
  4. have them watch using wireshark as you login
  5. challenge them to gain your password
  6. question: why do we gather packets for later use using pcap?

Migrated from Apple WikiServer Wiki. Original page E3H2f941.ID: E3H2f941