‫What is going on, guys?
‫My name is Hussein, and welcome to another episode of Wireshark Them All.
‫And today we're watching a shocking Postscripts database.
‫We're going to see how it does a look behind the curtain.
‫We're going to make a connection through from a Narges client to a post office database that I spun
‫up in the cloud.
‫This is using a LFN sequel.
‫It's a very easy service that I they are not a sponsor of.
‫This is just literally I love this service is just literally took me two minutes to spin up a post because
‫this is so I can do this video.
‫So how about we jump into a guy?
‫So here's what I'm going to do.
‫I'm using Narges Posterous and I made a video on how to connect to Upholsterers database from Analagous
‫Client.
‫Check out this video if you're interested.
‫But what we're going to do here is literally I have already established a Posterous database.
‫I created a table called employees and I added some rows.
‫And this client does the phone.
‫It connects to the database when it issues a query select store from employees.
‫And then once it does, returns the result and immediately closes the connection.
‫That's what it does.
‫Nothing else.
‫Right.
‫How about we jump into an end run of this client and see what it does?
‫So we're going to do a node, I believe I called it the query dojos.
‫When I do, that is what I get.
‫It just prints a beautiful table of whatever is in that cloud database that I created, Rick Admon Hosain,
‫all of those people are employees in the state.
‫So let's look at the Wireshark.
‫For Wireshark, here's exactly what we did right now.
‫These are all the packets, it's not as much as I thought, to be honest.
‫Right.
‫And I use the quick filter based on my client IP address and the server IP address.
‫So I just literally pinged that ruby whatever the server I got and I got the IP address and they used
‫it in Warshak to actually see what happens behind the scenes.
‫How about we do how about we actually look at this guy's first beautiful three request?
‫Sene Sinak ask why we're establishing DCB Connection, both because users who knew, right?
‫So what if that was a DCB connection?
‫So there is no escape of these Puppis unless you're doing a of which I which I talked about on this
‫channel as well.
‫And here's the thing was the first was the first person to make a request if the client says, OK,
‫I'm going to send you this thing and here's what it does send hey, here's my version protocol.
‫Here's my user, the parameters user.
‫I'm going to send another parameter database's this same database.
‫So the user username is this, the database is this and this is the client encoding.
‫I support UTF eight and.
‫You noticed that we didn't send the password for some reason, despite that, it is in the connection
‫strength by look at this, the president is right there.
‫That's the whole password.
‫I don't care.
‫You can take it because I'm going to destroy this innocence after this video.
‫But look at that.
‫We don't see the password.
‫And I'm always curious why the server says acknowledge I got a request, but here's the response.
‫What is the response?
‫Says, OK, I'm going to authenticate you.
‫I found that this username exists.
‫You can access me from this database, from from this user, from this client, from this IP address,
‫and just send me the password hash.
‫Let's go ahead and send it to me.
‫And this is not encrypted.
‫That's why it's very important for guys to encrypt Polska connection, pretty much everything.
‫But we're learning here.
‫That's why it's actually a good thing that this is going to click so we can see what's behind the scene.
‫So the service says, OK, the client says acknowledge and now the client is the P.
‫Catesby, which is a this is my M.D. five affordance, what is forty one character and so is the whole
‫thing is 40 character and the length of the.
‫And that's my password hash, I'm sure obviously is not going to save us here because the whole thing
‫is decrypted is unencrypted services you acknowledge and the server says, OK, look at this authentication
‫request success.
‫I have been able to authenticate you and here's a bunch of stuff now.
‫The application value, right.
‫What kind what kind of data type we use for integers, what kind of data type we use for dates, what
‫kind of data types you should talk to me on in case of super user.
‫There is no super user in this connection because of course, you're not supposed to be a super user
‫connected through the cloud.
‫Right.
‫At least in this connection.
‫Right.
‫What's the server version?
‫I'm using Ubuntu.
‫Oh, look at this.
‫Eleven point eight Polska eleven point eight.
‫I'm running on Ubuntu.
‫I don't know if it's eleven point eight Oberndorf Postgres because there is a Postgres eleven.
‫That's interesting.
‫No, I didn't see any version of Bosco's here, but yeah, it just sends a bunch of things and there
‫is the last thing.
‫I'm ready to receive your queries, maybe send me those queries.
‫All right, the client says, yo, I acknowledge your thing, I got it right, guys, I think that if
‫we can just delay a little bit and kind of just.
‫I guess, no, we cannot delay the act in this case because we don't know when the client is going to
‫issue that way.
‫What is this now?
‫So like several employees, we are.
‫Finished from the step, that step was literally that one line of code was all those, I guess up to
‫here, up to this packet, here is the query.
‫That's why the carriage queue and we're here now.
‫We're selecting select staff from employees and we just send it as plaintext.
‫Right.
‫And I wonder if the if the if the queries too long like E to select start and blah blah blah blah,
‫blah, blah, that's too long.
‫I don't wonder how many packets we're going to break this thing.
‫I guess it depends on the TCP window and all that stuff, but yeah, it's services.
‫I acknowledge they I received your query but I don't have a response for you yet.
‫But this is just an ACH.
‫So hey, I received your query and this is very important for the client to start unblock and do it
‫or it's async stuff.
‫Right.
‫And the thing I love that Warshak just recognize pretty much everything then.
‫I love this stuff.
‫And this is a toy that I just discovered.
‫I'm just in love with it.
‫All right.
‫So there's the actual content, just the three hundred bytes.
‫No, I take it back.
‫Two hundred thirty seven is the actual content.
‫Three hundred bytes is the whole with the garbage of the TCP stack that all that Oldfield's this is
‫rec, this is whatever all the content.
‫Right.
‫Data roll.
‫That's the data.
‫Look at that.
‫These are actual actual numbers, the content is numbers, and they are converted into a, I guess,
‫right to ASCII strength or UTF strings.
‫Awesome.
‫So that clients will say, yo, I acknowledge your your result and then what is X as a termination so
‫that I'm done, son, I'm done now.
‫We're here.
‫Right, because this is just Clines right now, we're here, we're killing that connection, we're calling
‫the connection to the client says, yo, I want to close and immediately.
‫After that doesn't even wait for an acknowledgement she's savaged client man.
‫All right, so the client just say, all right, I'm going to finish Accu, I'm going to fin and act
‫whatever we had before.
‫So the client just initiated the connection in this case to me.
‫If I what if it was me to avoid the TCP Waite's, I will actually have the server initiate the fennec
‫so that that client and the TCP wait.
‫So that's just like you don't have all this garbage DCPI weight stacks.
‫I might be wrong, there might be not possible in this case, but yeah I would avoid me avoid is on
‫the protocol.
‫I would flip this.
‫Yeah.
‫Since the client is initiating the closing this case.
‫Right.
‫We can actually respond with a fennec from the server.
‫So we wait a little bit from the client, but it really depends on the how the client is designed because
‫the in this case, the client PJI.
‫I think Brian forgot his last name.
‫Sorry, Brian, but yeah, he's the one who built this was Chris Norges Library.
‫So it depends on how the client is built as well.
‫So, yeah.
‫Yeah.
‫Vannak, the server says, acknowledge your fin and this is my fin and then I fin defen and then we're
‫Fanfani.
‫That's it.
‫We're done.
‫All right, let's clean this thing and let's throw in a monkey wrench where.
‫I don't know.
‫Let's add a bad.
‫Battling where the passion is standing is just wrong.
‫Why do this now?
‫I'm going to get another.
‫This is like a bogus error when things are wrong and you want bogus errors from the server as much as
‫possible because you don't want server gives you a hint, oh, the password is is good, but the username
‫is wrong or the user name is good.
‫But I never do this at the back.
‫An engineer never give B as ambiguous as you can to that client.
‫And I understand this is not a good user experience, but leave it you for security reasons be as ambiguous
‫and as.
‫And that what is that, because the word ambiguous is as confusing as possible, don't give that hacker
‫or someone clues to what is missing in their request.
‫I understand gives you bad user experience, but you need for security reasons to go back.
‫Look at those beautiful things.
‫Beautiful, beautiful, beautiful.
‫Tsipi connection through a handshake, all that jazz.
‫We talked about a three way handshake.
‫That guy says, yo, I minimum version is three and a minor version is what is this exactly is I still
‫don't understand.
‫And three point zero major is that maybe this is the Chris version.
‫I don't even know which which I'm using, which version, and it's not really clear how.
‫Never acknowledged, and the services cannot eat, I mean, Adara, I literally just found out, by
‫the way, and says, yeah, whatever the message that the server receives that Klein just printed it
‫for us.
‫Right.
‫Just like this is exactly what we got.
‫We got two thousand.
‫It's fatal.
‫And when it's fatal.
‫You got to close the connection.
‫There's no bigger contract for ba ba ba ba ba ba user this.
‫That's the bogus user and database.
‫Ba ba ba.
‫So at all.
‫Well, that's not good.
‫Really, we're sending the code.
‫It's not really the code, but still you like which file of the code, I didn't know that.
‫Even the line number.
‫Oh, come on.
‫That can be good.
‫I don't know about you, man, I think this is a little bit shady, OK?
‫It's an error.
‫Like I don't think we should send as just send the stack trace Cheesus.
‫I don't think this is a good idea.
‫Ach, fine acc oh OK.
‫We're where the client is acknowledging the settler the error and then that.
‫Oh look at that, this case.
‫The server is Fenning.
‫The server is fenning the connection.
‫So, like Fennec and the client will ask.
‫And then.
‫Oh, this is a mess right now.
‫We already established closing the connection, but the client this is a bug to me and the the client
‫code, right?
‫Because we clearly the server already established a connection, but we are sending it data.
‫And that's why we really need to this is one use case of the TCP waithe right.
‫Where it's actually waits for more packets to come to clean things up.
‫Obviously the client was the server will just immediately drop this connection.
‫So we're sending it for nothing.
‫And that's that probably explains the receipt.
‫Right.
‫So that's a bug, in my opinion.
‫I think it's a bug in the client code.
‫So it's a bug in here in the big package.
‫Right.
‫And basically, the the fix could be that if you receive a client or don't attempt to do and terminate
‫because.
‫Because the server will terminated for you, apparently.
‫I might be missing something, yeah, that explains the resets that we have here because like something
‫went out of sync and you started sending me packets while I'm trying to close.
‫Obviously, the client did essentially establish that close buddy and my guys that was like the postscripts
‫was shocking.
‫Bosco's the guys in the next one.
‫You guys stay awesome.
‫That lets us just what should I want to talk next?
‫And I'm going to see you in the next one.
‫Guys, say goodbye.