Now, based on the feedback that I've received, I'm going to show you some additional Python scripts
and show you how you can leverage Pi shark to capture usernames and passwords automatically off the
wire.
In this example, I've got an OSPF script, I've got an FTP script and I've got a Telnet script.
These are Python scripts, so I'll show you in a moment how you can use both.
PY shock which leverages t shock to capture traffic off the wire in real time and then look for something
in that CAPTCHA such as OSPF and then print something.
Now I've expanded my genie three topology slightly.
I've still got my Ubuntu client, which is connected in this example to a Cisco switch, which in turn
is connected to an ether switch which is connected to the internet.
I've got an ubuntu to PC and I've got a Toolbox PC running here.
What I have done on the Cisco switch is enable port span or mirroring.
So on the Ethernet switch show run.
If I scroll down all the way to the bottom.
Notice I've got these monitor sessions.
I am monitoring traffic from this source interface.
Gigabit is zero one and I'm copying that to interface gigabit is zero zero.
So all traffic that's been received on gigabit zero one, this interface to the broader is going to
be copied to this interface.
In other words, to my ubuntu client where I'm running t shock and py shock.
So again.
Source interface gigabit zero one destination interface gigabit.
Zero zero.
I've got this toolbox server, it's running an FTP server, TFTP server, web server and so forth.
What I'll do is an example is copy the config of the router to the toolbox server.
Using FTP and using this FTP script, I should be able to see the username and the password dynamically
captured using py shock.
Okay.
Now in previous videos I've shown you how to install py shock, but I'll demonstrate it again here.
If you're happy with the installation of RT shock and PY shock, then skip the rest of this video and
go to the next video where I'll show you the first script, which is OSPF.
Okay.
So only continue watching if you want to see how to install this engine is three.
There is a problem downloading traffic from the internet through a Cisco switch.
So I'm going to get this ubuntu client to connect to the internet directly via the ether switch.
That's just so that I can install the software.
So on the ubuntu client IP config shows me my IP address.
First thing I'll do per my sort of list of scripts is app get updates.
Update Ubuntu references.
Okay.
So that's done.
Next thing to do is to install t shock.
PY shock a leverages t shock.
It basically is a wrapper for t shock so you can get it to do anything that t shock does.
So through a python script you can manipulate stuff in t shock.
You can extract information from t shock in the same way as if you were using it manually.
But we're doing that through Python.
Okay.
The next thing I'll do is install python three pip.
So app get install python three pip install that.
That actually installed Python at the same time.
So Python three will be installed as well and then I'll install PI Shark using pup three.
So basically you could just copy these commands onto an ubuntu host and install the software yourself.
I have shown you how to do this previously, but I just want to show you the full process of how to
get this set up.
Okay, that's done.
So the last step is pup install py shock.
Okay.
And that's done as well.
So Python three, that works t shock.
Hopefully we'll see some captures.
There you go.
So.
T shock is now installed.
PY shock is installed.
So going to delete that link and connect.
The PC directly to gigabit is zero zero on the switch because port mirroring is happening from this
interface to this interface.
So let's go back to the Ubuntu client and make sure that it's seeing the traffic, so to speak.
Are we seeing any packets?
Yes, we are.
There's an OSPF packet as an example.
There's copy and on the router as an example.
If I pinged 12168 120 2254.
That's the net cloud we should see ICMP traffic.
Assuming that that's working properly.
We don't see that.
Let's do a.
Let's do a ping to two, five, five.
Seeming that I'm doing it right here.
You can see the broadcast traffic so that ICMP traffic is being sent.
So that's great.
What I'll do is I'll lost test is ping from the toolbox to the router and make sure that that is seen
by the TX shock application.
So the router has got this IP address.
I'm going to well let's do it from the boom host from a boom to two so on a boon to to I should be able
to ping 192168 122 and the IP address of the router which is 82.
So the ping succeeds.
And on ubuntu one we should see.
Those ICMP packets.
And there you go.
Notice I can see the ICMP messages.
So that works great.
Okay, so in the next video, I'll show you how to use these Python scripts to capture traffic.