It's important to know Wireshark, Wireshark is a core skill for network engineers or anyone who's interested
in networking or network security or ethical hacking.
In this video, I'm going to show you how you can use Wireshark to capture the usernames and passwords
for various protocols such as Telnet, TFTP, FTP, HTTP, in other words, how you can capture the credentials
or read the information in various clear text protocols.
You should be using SSH rather than telnet.
You should be using SSL or TTPS rather than HTTP.
Be careful using clear text protocols in a network because the usernames and passwords and just other
information within those protocols can be captured very easily.
It's important again that you know how to use Wireshark.
But to make it interesting, let's combine Wireshark with ethical hacking and look at how you can learn
both Wireshark and learn ethical hacking as well as network protocols.
At the same time, in this topology, I'm using GNS3 to virtualize a network.
I've got a switch in the middle.
I've got a router.
This is a Cisco iOS V router.
Now, if you're not used to using GNS3, don't worry too much.
Basically, I'm running a Cisco router, cisco switch and Linux devices in this topology.
Another very important skill, if you're interested in being a good network engineer or being a good
ethical hacker is to learn Linux.
You need to know Linux.
Kali Linux is a great version of Linux that can be used for hacking.
But even if you're not interested in becoming a hacker but want to implement network security or be
a good network engineer, you need to learn Linux.
So in this example, I've got Web term.
It's a Linux client, but it's a GUI based client.
So here we go.
This is a GUI based client that will allow me to, for instance, to run Firefox, which gives me
the ability to use HTTP, but it also has a console.
So as an example, if I type if config, I can see the IP address of this device.
So this is a Linux based graphical client.
I've got an Ubuntu clients here.
This Ubuntu client is CLI based.
There's no graphical user interface on this client.
But you can see the IP address is 10.1.1.3.
I've also got a toolbox client.
This toolbox client is basically a server that allows me to run a whole bunch of protocols.
Once again, it's also Linux based IP addresses, 10.1.1.1.
So let's see if we can capture some traffic.
I'll start a Wireshark capture between the switch and the router in this topology, m GNS3 makes us very
easy because you can capture traffic in this virtual environment by simply right clicking on a link.
In the real world, you need to span a port,mirror a port or add a hub to the topology or a network tap,
network
tap is basically where you inject something in the network so that you can see the traffic going across
a link.
But we don't need to do that here.
GNS3 allows us to monitor traffic very easily.
So as an example, you can see a STP or spanning tree traffic.
You can see dynamic trunk protocol traffic, we can see CDP traffic.
We can already see which devices are in the network.
So as an example.
We can see that there's a device called Switch, which is a Cisco switch, it's using this version of
Cisco iOS, very easy to see information on the network using Wireshark.
But let's do this, on the Ubuntu client,
the client over here, I'm going to Telnet to the router and log in, so first thing is what is the IP
address of the router show IP interface, brief IP address of the routers 10.1.1.254.
So let's assume that a administrator or a user is telneting to router 1 and you are capturing traffic
on the network.
So telnet 10.1.1.254 password prompt is displayed, I'll put in the password type enable
put in the password type show run.
So this is the running configuration of the Cisco router.
The problem with that is it's in clear text.
So if I filter for Telnet in Wireshark, you can already see details of
the telnet session here, we can see as an example, the source IP address, destination, IP address,
source, port destination port, telnet uses Port 23.
So that's the initial connection from the PC to the router, router replying back, a bunch of information
is displayed here, but notice as an example, we can see the prompt
for the password, so user access verification, carriage return password and now a bunch of stuff negotiated
but notice C I S C O, that is the telnet password.
Bunch of other stuff is now displayed notices the prompt of the router.
User typed E
N, enable, in other words, is prompting for the password notice the source IP address is 10.1
.1.254.
That is the router asking the user for their password.
So in other words, the enable password user type CISCO press on carriage return and then type show
run R U N. run press carriage return.
Router is building the configuration and then displaying the configuration.
Now that's okay, but it's not very easy to read that.
So what I'm simply going to do is go to the first entry and right-click and type follow TCP stream
and notice, there you go, you get all of that information in one screen, so password,
telnet password is Cisco, typed enable password type is Cisco,
notice we've got blue and red here, so blue is the router prompting the user, red is what the user's
typing.
So what you'll notice is every character is sent individually.
So when you type s h as in show and then r u n as in run notice s h
send individually and then it's echoed back.
So when you're telneting to the router,
so in this example, let's go back to the Ubuntu client notice on the Ubuntu client, if I type S h,
it's a character that's sent to the router and then it's echoed back so I can see what I'm typing.
That's why when the link is really bad, when you type a character, it takes a long time for it to
display on the screen.
So you have to type s.
It goes all the way to the router and then it echoes back.
S back to you so you can see what you've typed when the link is bad
takes a long time for characters to display
but notice enable password Cisco type show run.
There's the full running configuration captured in Wireshark.
It was as simple as that to capture telnet traffic in the network.
That's why you don't want to use telnet.
If I type exit here the connection is closed once again
I'll follow that TCP stream scroll all the way down to the end, notice I was typing S H and then I
stopped that and typed exit to clear or end the telnet session.
As simple as that, to grab the full running configuration of a Cisco router using telnet.
Do not use telnet today unless you know the network is secure or it's offline or you don't worry too
much about the contents being read.
Simple as that.
To get Telnet traffic off the network.
Be careful.
What I'll do is stop this capture
and I'll save this
as Telnet.
So why don't you download them and import them to Wireshark and see if you can filter for traffic yourself
So why don't you download them and import them to Wireshark and see if you can folta for traffic yourself
and see if you can capture usernames and passwords as well, rather than just watching me do it.