Ok, welcome back. In our next segment,
we will talk about capturing FTP or file transfer protocol
traffic for analysis to see if you can find issues with a simple FTP transfer of data.
FTP, file transfer protocol, is one of the oldest
Unix-based TCP/IP protocols in existence.
It was used to transfer data from one host to another and is still very relevant today
with the new technologies where obviously securing it either with SSH,
or it's own secure functions which adds incryption to it.
The reason for this is because it is extremely unsecure in its native format.
It will send information in clear text including credentials and the data that is being sent.
So, although it's very helpful, it's a very helpful protocol, it is also very unsecure.
So with Wireshark, basically you capture FTP data to, to look at communication stream.
It's very lightweight although it does use TCP as an underlying mechanism so that
it can guarantee the transfer of the data to your TCP
but it is generally lightweight and as we mentioned before,
it can capture texts that you're sending, in clear text, so highly unsecure.
You can use Wireshark to find the issues with traversal which we'll get into momentarily.
And as you could see here, capturing FTP is actually very easy.
Simply open up Wireshark, run a capture,
and then for this example, what I did was I just opened up an FTP session to a website.
I chose one where I can download files as an example.
A lot of your printer, drivers and so on for your systems can be accessed this way.
And it's very common to access them this way.
So, what I did was I ran an FTP and did some work on it and interestingly,
when I was able to pull this up in Wireshark,
I was shown specifically the transmission in clear text.
So if I just run a filter on FTP and I pull up the TCP stream,
I can see that my log in credentials were sent in clear texts.
And basically, the log in was successful and I was able to transfer some data.
So capturing FTP with Wireshark is actually very easy.
Here, we showed you some specifics with how to filter for it.
And how to pull up the stream to look at the entire conversation.
So, problems with FTP -
Obviously, there's a few that we've already mentioned
such as passwords and information, your credentials are sent in clear texts.
This opens it up to a large amount of security vulnerabilties.
People can use these sites that are easily cracked
as ware sites and placed their own stuff on them for transfer.
Obviously, the stuff that they're putting on these websites is not user-friendly
and likely consitutes a security violation all in itself.
Maybe even criminal charges may be filed.
So when you have FTP servers, your first basic rule is to make sure that they're secure.
And a good way to do that is to use encryption and to try to lock it down.
So obviously, you could see on the slide that there's a secure version of FTP.
There's an SSH-based version of FTP.
So there's ways that you can, you can secure yourselves
so that you don't have some ongoing issues.
And FTP can have some issues with firewalls and NATing.
So one of the things that we're mentioning before is transversal.
And you would be able to find and capture that with Wireshark as well.
So you should be aware that you can have
these issues where these devices will break FTP communications.
And a way to find that is to obviously run a scan or run a capture
on the client and on the server and take a look at the communications and see what's going on.
You can look at the TCP stream and determine whether the data has been
encrypted or decrypted or if there's a problem logging in or
if there was any kind of communications issues.
And you can also validate whether the session or the communication is being blocked
or broken with network address translation.
And here you could say just from a simple capture, we were able to log in.
We were able to basically get into a Unix box and function pretty easily, but again,
the worst thing that you could see here is that everything is passed in clear texts.
So, a reminder if you're using Wireshark, please be conscious of the fact that
you will be able to capture this information which may be against
the company's policy, so just make sure that you are aware of that .