Skip to main content

Wireshark

Wireshark lab:

  1. find your IP address: ipconfig or ip a on linux
  2. open wireshark
  3. find your interface-look for squiggly lines
  4. double click on the interface to start
  5. notice the flow of packets, everything you see
Network scanning is a bit like burglary:
  1. who lives where: ARP
  2. are they home? ICMP ping
  3. what is their street address?
  4. do they answer the door? ACK-SYN
  5. what doors or windows are open? netcat 
One could also make the analogy with a "man on the inside": if inside your home is the same as your LAN (local area network), then being able to plant a spy inside defies all of your security (firewalls in a network).
Malware is like sending a letter to your house, someone opens it thinking it is safe, and it maps out where your valuables are, in some case throwing them out the window do be collected. 

part 1: ARP

  • ARP stands for address resolution protocol
  • It checks MAC hardware addresses against IP addresses “resolving” them
  • run the same wireshark flow, but with the arp filter
  • what do you see?
  • hacker note: how could you “spoof” your MAC address?
  • why would you want to?
  • look up ARP poisoning-why would someone do this?

part 2: Ping

  • ping is what we use to see if a machine is active
  • ping uses a protocol called ICMP or internet control messaging protocol
  • ping a device you know if active on the network
  • repeat the flow above with the icmp filter
  • what did you see?
  • look up what length and ttl mean
  • hacker note: how could you hide your computer on a network?
  • why would you do so?

part 3: DNS

  • you know that DNS is how we convert names into addresses on the internet
  • DNS servers can be local like on a LAN for internal machines “point me to elab.hpa.edu inside the building” or external “point me to google.com”
  • you can test this using the nslookup tool on your computer
  • open terminal, use nslookup to lookup a local address like elab.hpa.edu
  • repeat looking for an external address like google.com
  • in the nslookup window, type server 8.8.8.8 and repeat the two steps
  • what do you notice?
  • try loading a web page
  • hacker note: why would a hacker want to intercept your DNS query? (think of airports and Starbucks)
  • type exit to leave the nslookup program

part 4: ACK-SYN

  • http and most web traffic uses a system called “ACK-SYN handshake” in the following order:
  1. SYN is sent from the client to the web server, synchronizing the conversation and opening ports needed (like port 80)
  2. ACK is sent from the server to the client, acknowledging the port is open
  3. SYN-ACK is sent from the client saying “got it”
  4. connection is open, data transferred
  5. FIN is used to end the link

example: web pages

  1. open wireshark, start a capture
  2. browse to a web page, capture packets
  3. look for ACK
  4. what type of packet is this?
  5. repeat with the tcp filter (hit return after applying the filter)
  6. repeat going to a machine serving xml
  7. what do you see?
  8. hacker note: how could you infect another computer using this?

part 5: netcat

  • netcat is a program that allows a user to establish a connection with another machine
  • it can be used for a machine to machine chat without using the internet (e.g. we cannot see your conversation without wireshark)
  1. open wireshark, in the filter window enter tcp.port == 1234
  2. on a client machine, type netcat -l 1234 in a terminal window
  3. on your machine, run netcat <ip address of client> 1234 then return
  4. type some text
  5. does it show up on the client machine?
  6. look for the packets on wireshark
  7. can you see the text in each packet?
  8. try these flags:
    1. n is the ip address
    2. l means listen
    3. v means verbose
    4. p means port number
  9. did you notice there was no password needed?
  10. why would it be dangerous to leave nc -l open?
  11. look up a reverse shell and explain how to do this
  12. hacker note: how could malware open this, and what could it do then?

part 6: netcat port scanning

  • netcat can be used to scan for ports
  • use the format nc -v -n <ip address> port-port end
  1. open wireshark, start a capture
  2. run the command nc -v -n 8.8.8.8 1-100
  3. filter using this filter: ip.addr == 8.8.8.8
  4. what do you see?
  5. repeat with a local address (web server, device)
  6. go to the device (e.g. port 80) and watch packets
  7. hacker note: how can a hacker use this command to look for open ports?
  8. how could you detect it happening if you are a white hat or sysadmin (system administrator)?
  9. if you had access inside a network, how could this be useful?
  10. if this were packaged into malware, how could it be useful?



Migrated from Apple Server Wiki. Original page ID: u3F713S1d