Another important tool that any penetration testers should be aware of is a network sniffer network
sniffer.
It's a tool that allow you to capture traffic from your network and analyze it.
And this is very useful especially if you are doing penetration testing for a wired or wireless network.
During this lecture we going to explain one of the best network sniffer tool which is why a shark.
I suggest that you go through those lectures more than one time and get yourself familiar with the tool
because it because it's a very effective tool to capture traffic analyze it and allow you to understand
how the network is working and also allow you to understand how it can be manipulated.
I know that some people may try to use whale shark before but they didn't felt comfortable with the
amount of hexadecimal that hex says that showing and the numbers and so on.
So we're going to try to simplify how to use this tool but one more time I suggest to go through the
lecture more than one time and get yourself familiar with it.
And if you need any additional resources please let me know and I'll be happy to help you.
Now let's start to tune and let's see how to understand the network surfers as a shark sniffer and how
to analyze simple traffic.
So I'm going to open it all and assuming that is not showing on this shortlist I'm going to tripwire
shark.
And as you can see I have to white shark.
So I can use either one of them.
And before starting.
Just be aware that my computer my Kelly Linux computer IP is 1 9 2 1 6 8 163 130 8.
So I'm going to click on a key here.
But before starting before the start sniffling I need to change some sitting just to simplify the traffic.
I mean whatever I'm going to do right now you can reverted back after finishing this exercise so we're
going to go to capture and I'm going to go to option and then I'm going to remove two different options
I have here an option called Enable permissions mode which is enabled and permissions mode will allow
the scanning Linux machine to capture not only traffic coming and going to the skelly Linux machine
but to capture any traffic inside your network.
So if I keep it on right now we're gonna get a huge amount of traffic so I'm gonna just remove it temporary
and once I finish the exercise I'm going to get it back.
So now I'm only going to capture traffic going and coming to my Kelly Linux machine locally and then
from option here I can also remove this one that is all of my addresses also generate some traffic so
we can click on close so you can do that just to simplifies the traffic that will be captured at the
beginning and then you can enable enable them back then we're going to choose capture traffic from which
interface.
I mean if you are capturing wireless traffic you can capture it from a wireless network.
But in my case I'm going to capture from H.R. 0 which is our net zero.
This is a LAN network adapter so I'm asking him to capture only traffic from land together.
I'm gonna double click on it and you're going to start capturing the traffic and I need to generate
some traffic.
So let me open the browser and let me type in your web site.
So for instance w w w o can
so
see
anyway I went to a specific Web site.
I think I was playing with the DNS.
So that's why I'm typing Google to get me something else.
Let me go to but this will do it.
So I went to the specific Web site and as you can see some traffic has been captured here.
So I'm going to stop this traffic and then we're going to start to analyze the traffic so that we capture.