Hello, my name is Steve Bowen and in this lecture you will learn wireshark packet capture approach,
wireshark dependencies, capture filters, etcetera in detail.
In this section we are covering basics to get you started with Wireshark and here in order to start
the Wireshark, you can also go to the application menus here and write Wireshark in the search button
and you need to start Wireshark as a root user with superuser privileges.
You can enter the password.
When you win.
This dialog appears and you can see the everything you need, the network adapters and so on.
So you can also start the Wireshark from the terminal in order to start terminal.
If you if you just write the Wireshark here and here, as you can see here, we can see the Ethernet
or any network interface cards.
That's why we need to start Wireshark on Sudo Wireshark you will enter the password and that's it.
Once the application is launched, the main interface is shown, including sections for basic capture
controls, capture filters and display filters.
Now you will select the desired interface from the list by clicking and hit the start capture button
to capture.
In this case, we have the Ethernet zero and any you can also select any you.
In this case it will also listen to Bluetooth, to wifi and so on.
In this case we will select the Ethernet because we don't have any connected device.
So the internet and here, that's it.
So we started the Ethernet if anything occurs.
And as you can see here, our.
Router and switches are talking.
And here, as you can see here, who has this IP address.
Tell to this IP address.
And as you can see here, there's a like I'm so excited with Wireshark here.
So here we have we can start the capture here.
So the capture from here and you can specify the filters and that's it.
So when capture is in progress by default, it shows live the packets being captured in various colors.
And we can start again here so we can go to our vulnerable web application here.
In this case, it's target.com.
And let's log out.
And whenever we are doing something on the Wireshark or whenever someone does something on our local
area network, it will show us the exact bytes, byte by byte representation.
And here we can start stop capture with this buttons here.
And let's first understand the packets here.
Right?
So it's time to investigate a capture at the individual level.
And this is an example of one of the TCP packets captured here.
Now, we will.
Go to here and enter our password.
Right?
So that's for example, consider this as a Facebook or any banking website here.
So now we will have admin and we'll enter our password and that's it.
Now, Wireshark should capture this.
And here, as you can see here, we are seeing something.
Let's actually stop it now.
We will analyze it.
And here we are seeing something neat to see like login here, login, PHP and as you can see here,
its application w-w-w form URL encoded here.
So now let's select this by clicking on it.
You can select the packets and here in this here you the packets details will appear.
Let's actually use the.
Grommet here.
I will draw links on the screen.
That's it.
And here we have the.
Let's start the grommet.
Here we have tool painting, clear screen and.
Yes.
As you can see, we have also have the.
Application drawing thing.
That's it.
So now when a packet is selected.
Wireshark opens the bottom panel.
Here you can see here, bottom panel, this is the bottom panel of Wireshark.
So this bottom panel, which gives us important information of the on the features that are conveniently
presented in the same way as the OSI model.
So the number of layers seen changes as the protocol selected changes here in this example from the
top down, we can see the frame layer.
It has the protocol Http, as you can see here, and it's in the Ethernet data link layer.
And the we can also see the IP network layer.
We have Ethernet to Internet protocol version four source address and destination address transmission
protocol and we have port and so on.
And we also have the hypertext hyper protocol, which we will get some pretty confident information,
confidential information from that here.
So we will get the passwords we entered the last time we visited our website, right?
So if there are more layers or headers in the packet, it is sequentially decoded in the Wireshark packet
view.
So for a packet with multiple encapsulated protocols to decode it properly, there must be a dissector
available that decodes the corresponding protocol layer.
So every packet decode starts with a frame.
The sector, right.
It dissects the detail of the captured metadata itself, as you can tell it the timestamps.
Right.
So the, the frame, the sector passes the data to the lowest level data, the sector in the data link
layer, for example, the Ethernet Ethernet, the sector gets triggered from the for the Ethernet heater.
So the packet is then passed to the next sector and the network layer, for example, IPV, IP version
four or version six, the sector gets triggered and so on.
So each stage of the sector decodes and displays the details of the packet and the sectors can be righted
as Self-registering plugin, for example, a shared library or DLL or built into Wireshark source code.
So the biggest benefit of going with the plugin approach is that rebuilding a plugin is much faster
and if the the sector is built into the source code, the wireshark needs to be completely recompiled
and rebuilt.
Hence it makes more sense to variety the sector as a plugin.
Right?
So you will learn more details on these sectors in next lectures also.
But let's firstly get started with the capture filters in Wireshark.
So we will discuss in detail capture filters in the next lectures, but only basics have been included
here in this section for completeness on getting started discussion.
So capture filters are used to decrease the size of captures by filtering out only relevant packets,
matching the condition before they are added to the capture file.
So clicking on the capture options button shows a screen containing a list of interfaces.
So in order to do that, you will need to find this setting icon and it's usually there.
And here when clicking on that, you will see this dialog here.
So to set a filter, either an interface can be double clicked like this or a custom filter can be entered
in the box.
Right?
So now we will open the again or before that let's actually enter our.
Password again because our.
Previous packet analysis is lost because we don't save them as earth here.
And that's it.
And now we're going to see the post login here.
This is usually the login pages.
Uh, that uses the post method.
And here now, we will go to that again.
So we stopped the filter.
And here we as I said, you can double click on the capture options.
But remember, before double clicking on any interface on this dialog, you need to save the file in
order to not get lost and captured interface.
So here to set a filter, you can also select a custom filter can be entered in the text box.
So there's a list here that shows example of simple capture filters.
For example, we can use the SRC here SQ Host so we will enter the SRC.
Host So let's actually scan our host with Nmap.
So nmap sv here.
Typhoon.
Typhoon target.com.
And now we will get that host domain IP address, IP version four address and now.
Sorry.
We'll just put this and here, yes, we can see the IP address here.
192168 13 142 And now we will use this filter to just listen to the packets from this host.
And here, in order to do that, we will just write that IP address down.
Because 13 point yes, one for two and you can press on start and we can also save them before starting
a new capture or we will not save them in this course.
And as you can see here, whenever we restart this page, there is something new will come here.
And as you can see here, it's.
The new information is gathering.
So now we will go press on logout.
And here we also have this 302 font and we can read it from the hypertext transfer protocol.
We have no cash.
Connect type.
Connect length.
And so on.
Now, what are we going to do is we will do that example again.
We will enter our passwords, in this case admin and our password.
That's it.
And click on login.
And here, as you can see here, we are seeing that familiar post request again.
Yes.
We have this, this.
This here.
Let's log and log out again and admin here and.
Passport.
And here, as you can see here, we have several information here.
So you can also use another.
Filters as well like.
Net.
Right.
So we can with this net here.
And you will need to delete this and 24 subnet mask.
So we will listen to the packets to and from all host part of the network here.
So from 0 to 255 IP address.
Right, right.
So we can also use the port here port and we will listen to only packets that.
Connected within this port here.
So communicating with this port here and.
Now, since we are communicating on Port 80, we will see informations here.
And we also have the display filters on Wireshark, which we will discuss in next lecture.
My name is Stefan and I'm waiting you in the next lecture.