Skip to main content

Wireshark

Migration

Wireshark lab:

  1. find your IP address: ipconfig or ip a on linux
  2. open wireshark
  3. find your interface-look for squiggly lines
  4. double click on the interface to start
  5. notice the flow of packets, everything you see
Network scanning is a bit like burglary:
  1. who lives where: ARP
  2. are they home? ICMP ping
  3. what is their street address?
  4. do they answer the door? ACK-SYN
  5. what doors or windows are open? netcat 
One could also make the analogy with a "man on the inside": if inside your home is the same as your LAN (local area network), then being able to plant a spy inside defies all of your security (firewalls in progressa network).
Malware is like sending a letter to your house, someone opens it thinking it is safe, and it maps out where your valuables are, in some case throwing them out the window do be collected. 

part 1: ARP

    ARP stands for address resolution protocol It checks MAC hardware addresses against IP addresses “resolving” them run the same wireshark flow, but with the arp filter what do you see? hacker note: how could you “spoof” your MAC address? why would you want to? look up ARP poisoning-why would someone do this?

    part 2: Ping

      ping is what we use to see if a machine is active ping uses a protocol called ICMP or internet control messaging protocol ping a device you know if active on the network repeat the flow above with the icmp filter what did you see? look up what length and ttl mean hacker note: how could you hide your computer on a network? why would you do so?

      part 3: DNS

        you know that DNS is how we convert names into addresses on the internet DNS servers can be local like on a LAN for internal machines “point me to elab.hpa.edu inside the building” or external “point me to google.com” you can test this using the nslookup tool on your computer open terminal, use nslookup to lookup a local address like elab.hpa.edu repeat looking for an external address like google.com in the nslookup window, type server 8.8.8.8 and repeat the two steps what do you notice?try loading a web page hacker note: why would a hacker want to intercept your DNS query? (think of airports and Starbucks) type exit to leave the nslookup program

        part 4: ACK-SYN

          http and most web traffic uses a system called “ACK-SYN handshake” in the following order:
            SYN is sent from the client to the web server, synchronizing the conversation and opening ports needed (like port 80) ACK is sent from the server to the client, acknowledging the port is open SYN-ACK is sent from the client saying “got it” connection is open, data transferred FIN is used to end the link

            example: web pages

              open wireshark, start a capture browse to a web page, capture packets look for ACK what type of packet is this? repeat with the tcp filter (hit return after applying the filter) repeat going to a machine serving xml what do you see? hacker note: how could you infect another computer using this?

              part 5: netcat

                netcat is a program that allows a user to establish a connection with another machine it can be used for a machine to machine chat without using the internet (e.g. we cannot see your conversation without wireshark)
                  open wireshark, in the filter window enter tcp.port == 1234 on a client machine, type netcat -l 1234 in a terminal window on your machine, run netcat <ip address of client> 1234 then return type some text does it show up on the client machine? look for the packets on wireshark can you see the text in each packet? try these flags:
                    n is the ip address l means listen v means verbose p means port number did you notice there was no password needed? why would it be dangerous to leave nc -l open? look up a reverse shell and explain how to do this hacker note: how could malware open this, and what could it do then?

                    part 6: netcat port scanning

                      netcat can be used to scan for ports use the format nc -v -n <ip address> port-port end
                        open wireshark, start a capture run the command nc -v -n 8.8.8.8 1-100 filter using this filter: ip.addr == 8.8.8.8 what do you see? repeat with a local address (web server, device)go to the device (e.g. port 80) and watch packets hacker note: how can a hacker use this command to look for open ports? how could you detect it happening if you are a white hat or sysadmin (system administrator)? if you had access inside a network, how could this be useful? if this were packaged into malware, how could it be useful?



                        Migrated from Apple WikiServer Wiki. Original page u3F713S1d.ID: u3F713S1d