OK, so on the Cisco router
I'm going to enable the HTTP service, so IP HTTP and I want to enable the HTTP server, so basically rather
than Telnet into the router, I'm going to be able to open up an HTTP session to the router.
What I'll do is start a Wireshark capture here
and I'll filter for HTTP traffic, nothing has been captured at the moment.
I'll go back to GNS3.
Here's the console for the Web term client.
So I'll see if I can ping the router, ping 10 .1.1.254, so I can ping the router.
What I'll do is start Firefox
and connect to 10.1.1.254 that's the IP address of the router.
I need to enter my username and password, which is Cisco in this example, I'm not going to save the
password.
I can go to diagnostic information and see syslog information so that stuff is stored in the syslog exec
type command such as show IP Interface brief
run the command and notice there's the output of show IP interface, brief show run will allow me to
view the running configuration of the router.
So I've now just retrieved the entire running configuration of the router through HTTP.
Not a good idea
because notice here I can see the information so I can see as an example, show, tech show extended
ping commands, we can see a URL to cisco.com.
We can see a fave icon.
We can see a whole bunch of information in the output here.
So I'm able to view the HTTP text, clearly various commands, stuff like that.
Let's go a
bit further down.
So I'll follow this information.
Follow HTTP stream.
Notice there's the show IP Interface brief command, so I can see all of that.
So be careful, because hackers or others will be able to view
the running configuration of a router as shown here.
Notice there's the enable password.
So again, all I did was select some text, follow HTTP stream and I can see the stream so I can see
information such as the configuration.
I can see clear text passwords.
There's the enable password.
I can see the vty password shown in clear text.
Be very careful using clear text protocols, so I'm gonna filter for HTTP once again and notice right
in the beginning we've got this unauthorized option.
So we told that we need level 15 access to access information on the server and then we've got to data
sent from the client to the server and notice authorization credentials, Cisco, Cisco, so there we
can see the username and the password used to access the server.
So that's not very good.
Let's try setting up a different username
so username
David, password Cisco IP HTTP.
Authentication, let's go for local, so that'll use a local username and password for authentication
rather than just the enable password.
I mean, what's scary about this is I've just picked up the enable password
but let's go back to
connecting to the server with the new username and password.
So, 10.1.1.254
David, password
and what I'll also do is set the username David privilege Level 15, so give him level 15 privileges.
Try that again, notice I can log in, so I've been able to log in, as David and do command such as show
IP Interface brief, and that works again
but now I'll scroll down through my wireshark capture and what I'll do has just filter for HTTP.
So there's unauthorized as a message.
Next message, notice credentials, David Cisco, that gives me full privileges to the router.
I have full rights to this router and can do anything on this router that I want to with that username
and password.
It's just crazy.
So let's do another one username, Peter Privilege 15, password Cisco123 great passwords
those.
I'll shut this browser down, connect again.
10.1.1.254 Peter Cisco123.
What was it, 123, yep, click, OK.
When save that
type command, once again, such as show access lists, probably no access lists on this router so nothing
there.
Show interface
Gigabit00 is the output of that command, but once again scrolling down
in our Wireshark capture.
There's unauthorized so we need 15 privileges.
There's our username and password, Peter Cisco 123, and then once we've done that
we can actually see all the data.
So as an example, I'll follow the HTTP stream here.
Notice there is a list of commands that I could use.
Show this one.
Notice there's the output of show interface, so show interface, gigabit 00.
There's all the output.
Don't use HTTP, don't use telnet, don't use FTP and TFTP unless you sending that across an encrypted
tunnel.
The stuff is in clear text.
Anyone can grab your username and password and data if you use these protocols.
So don't use them.
Okay, I'll stop this Wireshark capture, and what I'll do is save this file, so HTTP.
Be careful using these protocols, don't use them if possible.