Here everyone welcome to network traffic analysis with wireshark in this video we're going to show how
to use wireshark to analyze the traffic capture from the attack scenario simulated.
In the last video which was capturing network traffic with wireshark that's where we used métis plate
to exploit the vulnerability of an I.R.S. daemon on the display table to V.M. to spawn a root shell
and execute commands.
With root privilege in this video we assumed to know nothing about the attack and we take the role of
a network forensic analyst that must reconstruct the incident examining the traffic captured during
the attack to begin we acquired PCA PMG file in Wireshark.
We should see the made window divided into three pans the top and shows the list of capture packets
and the related info such as the source and destination IP addresses the protocol the length and so
on.
The middle Panchos the details of the packets while the lower pan shows the hexadecimal view of the
data content.
Selecting a packet we could see in the middle Panne the details about the headers or the protocols started
from the lower layer on the top which is data link up to the higher layers network and TradeSports layers.
For example this pacu does the AARP request made by the attackers host to the target machine that has
this target IP address and requesting for the target mac address.
Before in the packet.
Is the reply sent by the target machine from the attackers host with its MAC address.
The next three packets from the three way handshake that initiates the TCAP connection from the attackers
host to the I.R.S. daemon on port 6 6 6 7.
We can observe the typical sin sin ack ack sequence of the three way handshake.
Right clicking on one of these packets and then select bhalo TCAP stream ballista TZP packets are filtered
to display only those belonging to that connection as we could see in the top pan.
This feature gives us a clear view of the data exchange between the attacker and the target.
We also show the data in the window.
In other formats for example in hexadecimal and then save them to an output file.
In particular we can observe the payload highlighted in red.
This payload opens a reverse bind or connect back shell on the target exploiting a backdoor on the I.R.S.
daemon.
Clicking on the payload.
The packet that contains the payload is highlighted in the main window.
We could copy its contents.
Right clicking on it and then selecting for example copy bytes as hex plus A.S.C. I'd dump
then open a text editor and pasting the contents
the following TCAP packets are related to the connection made by the reverse bind shell to the attackers
machine on port 4 4 4 4 if we reichlich on this packet for example and select follow TCAP stream.
We see that the attacker executes some commands with root privileges on the target.
Clicking on file export packets dissection we can export all the packets and their details in various
formats like plaintext CXXVI and so on.
Awesome.
We've just seen a brief example of networked forensic analysis using Wireshark and hope.
This has been enough to show the power and effectiveness of this valuable tool if you like to practice
more with it.
Why are sharks.
Wiki provides several sample packet captures downloadable from this page.
All right in this section we introduce network forensics and the fundamental theory of networking particularly
the TCAP IP protocol suite.
Then we covered the capturing and the following analysis of network traffic with wireshark.
In the next and final section we're going to discuss the reporting phase.