Scribd Logo
Upload

Welcome to Scribd!

  • 276 views

    Wireshark Slides PDF

    Uploaded by

    Peter Asan
    Wireshark is a network protocol analyzer that allows users to capture and analyze live network traffic. It can be used for network troubleshooting, analysis, development, and security assessments. The document discusses how to setup Wireshark, including putting the network interface into promiscuous mode. It provides an overview of common network attacks like DNS poisoning, session hijacking, and man-in-the-middle attacks. It also explains how to use Wireshark's filtering options and follow TCP streams to analyze captured packet captures in more detail.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Wireshark Slides PDF

    Uploaded by

    Peter Asan
    276 views11 pages
    Wireshark is a network protocol analyzer that allows users to capture and analyze live network traffic. It can be used for network troubleshooting, analysis, development, and security assessments. The document discusses how to setup Wireshark, including putting the network interface into promiscuous mode. It provides an overview of common network attacks like DNS poisoning, session hijacking, and man-in-the-middle attacks. It also explains how to use Wireshark's filtering options and follow TCP streams to analyze captured packet captures in more detail.

    Original Title

    Wireshark-Slides.pdf

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Wireshark is a network protocol analyzer that allows users to capture and analyze live network traffic. It can be used for network troubleshooting, analysis, development, and security assessments. The document discusses how to setup Wireshark, including putting the network interface into promiscuous mode. It provides an overview of common network attacks like DNS poisoning, session hijacking, and man-in-the-middle attacks. It also explains how to use Wireshark's filtering options and follow TCP streams to analyze captured packet captures in more detail.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    276 views11 pages

    Wireshark Slides PDF

    Uploaded by

    Peter Asan
    Wireshark is a network protocol analyzer that allows users to capture and analyze live network traffic. It can be used for network troubleshooting, analysis, development, and security assessments. The document discusses how to setup Wireshark, including putting the network interface into promiscuous mode. It provides an overview of common network attacks like DNS poisoning, session hijacking, and man-in-the-middle attacks. It also explains how to use Wireshark's filtering options and follow TCP streams to analyze captured packet captures in more detail.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 11

    WIRESHARK BASICS AND

    NETWORK ATTACKS
    Hobo|Chukar|jolly?|TcP
    Introduction
    Wireshark
    What does it do?
    When should it be used?

    Along the way:


    n TCP/IP
    n Network Attacks
    n How to use Wireshark
    n Misc. programming/security tibdits
    What is Wireshark?
    Wireshark Network Protocol Analyzer
    Used for network troubleshooting, analysis, development, and
    hacking
    Allows users to see everything going on across a network*
    n The challenge becomes sorting trivial and relevant data
    Other tools
    n Tcpdump- predecessor
    n Tshark cli equivalent
    Can read live traffic or can analyze pcap files
    n Pcap packetcapture file
    n File created from libpcap library (allows us to read packet info)
    Where in the attack lifecycle would we use this tool?
    n What information can it give us?
    n How could we use that information?
    Setup
    Wireshark
    Network interface needs to be in promiscuous mode to
    view all packets on a LAN
    n ifconfig <interface name> promisc
    Need run as root
    n sudo wireshark &
    n & after a command gives you back the $ shell prompt
    Start packet capture
    n Chooseinterface
    n Watch packets fly
    A Step Back
    What is actually happening?
    In
    promiscuous mode: Interface passes traffic to cpu
    rather than just the frames
    n Get to see everything within the packets
    Broadcast traffic
    How do we manage to view a particular persons
    traffic?
    MiTM attacks*
    Network Attack overview
    TcP slides rock
    So lets look at them (briefly)
    Types
    DNS poisoning, XSS, other app-specific vulns
    Session hijacking, port scanning, SYN floods

    Route changes, ICMP bombs,

    ARP poisoning*, dDoS


    Man in the Middle
    A word of Warning
    Spoofing
    Cant I just pretend to be someone else?
    But wait! ARP!
    n Purpose to map out and connect machines and their IP addresses
    n MAC/IP addr. Pair
    n What is a MAC Adress? (nothing to do with ole Stevie Jobs)
    n A unique identifier assigned to a network interface for physical
    network communication layer
    n Typical conversation
    n if your IP address is w.x.y.z, send me your MAC address
    n All computers receive request, and the correct computer replies

    a connection between two users (famous Alice, Bob, Trudy


    example)
    Man in the Middle
    But waitARP!
    Trust model iswell, its not good
    n No
    accountability for computer responses. Does not (cannot)
    authenticate RARP*
    Easy to spoof
    n Race condition
    n Heh?
    n Flood Arp tables with incorrect info (e.g. Hey, Im the router!
    Forward all outbound packets to me!)
    n Refined spoofing between two parties
    n is it really that easy
    n Well, yes and no
    Back to Wireshark
    Once youve captured your packets
    What am I supposed to do with 18,000 packets?
    Filter options
    n Operators: ! == || &&
    n By source/destination
    n ip.<src,dst>==w.x.y.z
    n frame contains <string>
    n Search a particular string within a packet (very useful, a personal
    favorite)
    n The wireshark Analyze tab
    n Lots of stuff
    n For web traffic: Analyze->follow TCP/UDP stream gives youre the
    packet content in ASCII (and other formats)
    Wireshark and You
    Stuff TODO:
    Chain together filter options
    n (ip.src==10.105.225.100) && !(ip.dst==70.136.12.158)
    n Looks for all traffic from 10.105.225.100 unless the destination IP is
    70.136.12.158
    Read Packet Content
    n What do the packets look like (follow the TCP stream)
    n What ports are typically used when http traffic is unencrypted? Encrypted?
    n What are some protocols youve never seen before? What do they do?
    MiTM
    n Remember the warning
    n Set up
    n ????
    n Then you can filter all data to/from source
    n Profit
    Enough Talk, you Hobo!
    Demonstration

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy