WEBVTT 00:00.520 --> 00:01.520 Yes, that's right. 00:01.540 --> 00:04.780 It's time to talk the basics of sniffing. 00:05.170 --> 00:12.220 We have to understand that when we talk sniffing most of the time in a certified ethical hacking perspective, 00:12.550 --> 00:20.800 we're talking about specifically network sniffing, packet sniffing, using network interface cards 00:20.800 --> 00:22.390 in promiscuous mode. 00:22.930 --> 00:30.790 Now, I've got to tell you something right now, it is something that you often hear about as internal 00:30.790 --> 00:38.530 reconnaissance, and that is individuals on your network that have converted their network interface 00:38.530 --> 00:40.660 card or had Wireshark to it. 00:40.660 --> 00:48.220 A tool like Wireshark, of course, is a network sniffing packet sniffer, and they have Wireshark and 00:48.220 --> 00:53.170 their network card has been moved to promiscuous mode and they are capturing packets. 00:53.200 --> 00:57.190 Now, this should really never happen internally. 00:57.520 --> 00:58.450 Why is that? 00:58.870 --> 01:07.900 Well, what we seek to do is we seek to lock down every single workstation that connects to your internal 01:07.900 --> 01:15.880 network and lock it down so that Wireshark, in fact, no application can be installed in that user's 01:15.880 --> 01:21.910 desktop, but in a more sophisticated controlled environment, maybe it is Wireshark specifically or 01:21.910 --> 01:32.140 win Pcap or end cap or USB cap, any of those capture protocols and programs that are looking to take 01:32.140 --> 01:34.450 the NIC and make it promiscuous mode. 01:34.780 --> 01:42.520 So just understand that that should be very, very rare that you have internal users turning on a packet 01:42.520 --> 01:42.970 sniffer. 01:43.000 --> 01:46.600 We typically make this part of the network policy that they can't do. 01:46.840 --> 01:50.980 It's enforced through the security settings on their workstations. 01:51.250 --> 01:52.030 It's all good. 01:52.690 --> 02:00.310 Now understand that if someone is sniffing packets and they're in a transparent, switched infrastructure, 02:00.580 --> 02:02.830 they get pretty bombed pretty quickly. 02:02.830 --> 02:06.640 And that's because the switches are doing what they were built to do. 02:06.970 --> 02:11.860 Intelligently forwarding filter frames only to those workstations that need to receive it. 02:12.250 --> 02:18.130 So when they're eavesdropping, they're only getting their conversation, let's say, with some other 02:18.130 --> 02:18.550 node. 02:18.790 --> 02:21.540 And that's probably not what they want to get. 02:21.550 --> 02:28.450 They want to get other conversations, especially if they're doing the sniffing as a stage of reconnaissance. 02:28.840 --> 02:35.830 So ARP spoofing and MAC flooding are two things that we're going to be talking about as methodologies 02:35.830 --> 02:43.360 to go ahead and try and intercept traffic that would not otherwise be for that recipient. 02:44.080 --> 02:47.320 Now there's passive versus active sniffing. 02:47.330 --> 02:49.270 You probably wouldn't be surprised, right? 02:49.270 --> 02:54.700 You're not surprised at all that we're breaking this subject down to passive and active like we do so 02:54.700 --> 02:57.310 many of our certified ethical hacking topics. 02:57.670 --> 03:04.060 Passive here means we are just grabbing the traffic, we're doing our analysis, and no one would know. 03:04.390 --> 03:07.360 And there is no manipulation made of the traffic. 03:07.630 --> 03:14.020 But if we are grabbing packets and manipulating things in any way, shape or form, we would consider 03:14.020 --> 03:16.630 that active sniffing of the network. 03:17.290 --> 03:25.780 Keep in mind that the active sniffing, just like any kind of more active attack, is going to be many 03:25.780 --> 03:28.480 times much more worthwhile. 03:28.810 --> 03:36.370 Get much more information, get more valuable information, but it comes at the risk of getting caught. 03:36.520 --> 03:38.500 So there's that balancing act once again. 03:39.250 --> 03:43.810 What would be typical steps then in a sniffing style of an attack? 03:43.990 --> 03:46.150 Well, the attacker would first find the switch. 03:46.150 --> 03:51.580 They're going to attack, and then they would begin discovering everything they can about the network. 03:51.820 --> 04:00.460 They would then select a target machine and they would begin to spoof our addressing so that traffic 04:00.460 --> 04:02.080 is being sent to them. 04:02.260 --> 04:05.410 That should be being sent to that target machine. 04:05.710 --> 04:14.530 This is the classic man in the middle style of attack as the the attacker is now playing the role of 04:14.530 --> 04:17.050 the target and it is receiving the packets. 04:17.050 --> 04:18.370 That's that man in the middle. 04:18.910 --> 04:25.750 The attacker now, of course, can analyze and steal data that was intended for that target machine. 04:26.660 --> 04:34.220 Now, one of the steps that we are going to impress upon you here for keeping these types of attacks 04:34.220 --> 04:39.950 at bay and keeping them where they're not going to cause a huge issue for your organization. 04:40.220 --> 04:47.120 One of the initial steps that we want to talk about right away is for you to eliminate those protocols 04:47.300 --> 04:50.360 that will send information in clear text. 04:50.480 --> 04:51.250 Look at this. 04:51.260 --> 04:52.370 It's a long list. 04:52.640 --> 04:57.920 Notice that with HTP, there's HTP s as the alternative. 04:58.010 --> 05:04.460 With FTP, there's SFTP, so there's often going to be secure variations. 05:04.700 --> 05:08.720 Hey, I had telnet on the brain and listed it twice there. 05:08.750 --> 05:09.530 Sorry about that. 05:09.920 --> 05:14.960 But yeah, telnet is not going to be what we want to access. 05:14.960 --> 05:20.780 The remote terminal will use H, which is going to give us the security we're looking for. 05:21.290 --> 05:28.100 Notice I did flag simple network management protocols version one and specifically to see is the version 05:28.100 --> 05:30.080 that is commonly used out there. 05:30.350 --> 05:36.470 Those versions version one, version two version to see all of those versions, they are not secure. 05:36.980 --> 05:44.630 The SNP version three can be configured in a secure manner and that's why I didn't put it on this list. 05:44.870 --> 05:52.370 So we want to make sure that we stop using protocols like this that would be vulnerable to sniffing 05:52.370 --> 05:58.990 attacks if we have to use them, like the post office protocol or pop functionality. 05:59.000 --> 06:06.800 Well, oftentimes we are encrypting that over a VPN connection or something like that so that that traffic 06:06.830 --> 06:07.940 cannot be intercepted. 06:08.600 --> 06:13.820 Well, now that we have a sense for network sniffing, we're going to get in more detail about it in 06:13.820 --> 06:15.920 the remainder of this module.