Okay.
So in this video, I'm going to show you how to capture Fttp off the wire using pipe shock.
So I'm using a Python script once again.
I'm importing PI shock.
I'm doing a live capture on Ethernet zero.
So this one to host is going to be capturing traffic in real time of Ethernet zero.
And then I've got a loop here saying that for packaging capture, if it's an FTP packet, so look for
FTP in the packet.
In other words, find out if it's an FTP packet.
This is a TRAI and exception rule which basically says try and do something.
If there's a problem with the output.
Yeah.
Then just continue with the script.
Don't break the script.
So try and do the following.
Output equals package or FTP.
So we're looking for an FTP packet.
And then if we find user in this output, which I've made a string print username and then print the
actual output as a string, otherwise in other words else if look for pass in the string and then print
this output out.
So it's actually going to be easier just to show you this.
So let's run the script and then I'll show you what it's doing exactly again.
So I'll create a script called FTP, TCP.
Why paste that script in?
So this is a very basic script that I've written once again.
So cat ftp p y there's a very basic script.
What I'll do now is run that script.
So Python ftp p y.
So Python three running ftp tcp.
Why?
Nothing's happening at the moment.
But what I'll do is copy.
The running config from the router to the toolbox server.
So the first thing I need to do is specify a FTP username, which in this case I'm going to specify
as root and FTP password in this case is going to be three.
That is the username and password that I need to use on the FTP server which is running on Toolbox one.
So this is the FTP server.
IP address ends in 99.
So let's get that onto console.
Up here it is.
And then on the router.
What I'll do now is copy the running config from the router to the FTP server.
IP address 100 21681 2299 that's the IP address of the toolbox server config will be that.
This will then log into the FTP server and copy the config which it's done.
Notice writing config.
That's been done.
But notice on my ubuntu host.
I can see username is root password is DNS three.
I've just formatted the output nicely using this little script.
So looking for user.
There it found it prints this output.
So prints username.
There we go.
Prints the output.
That's what its captured.
So the FTP layer, in other words, in the same model, it's not layer two, it's not layer three,
it's higher layers.
So this is actually an application FTP runs on TCP.
So it's not layer two Ethernet, not three, which is IP, not four, which is TCP.
It's layers 5 to 7.
FTP username is this.
Password is gen three.
You can see that in the output there.
So it's looking for the username, looking for the password and essentially printing it out.
So let's do that again.
Copy running config ftp ftp server is this.
Notice once again that I'm copying the config from this router to this toolbox, but because I'm running
span here, the ubuntu client is seeing this.
Now you could use hacking tools like eta kap to poison the network or you could do other things such
as set up a rogue DHCP server and default gateway to manipulate where traffic goes.
And I'll show you some of those using Kelly Linux in this course.
So copy the config to the FTP server.
It's done.
And notice there again is a username and password.
So you could once again run the script and simply get this running in the background and save it to
a file or email it to you or do something else so that you get the username and password off the wire.
Okay.
So that was an example of FTP.
Let's try telnet.
Telnet is not a good idea.
Neither is FTP and other clear text protocols in a network.
We should use encrypted protocols whenever possible.