Before we move into our next section where we return for a final time
in this course into the demonstration environment,
let's first go through what we are talking about
when we performed traffic replay.
There are two main ways that traffic replay is performed and they
include the first that involves the direct transmission of traffic
from a previous capture through a local interface and the second
where the captured traffic is used as part of an overall solution to
perform a specific action.
Let's now review these one at a time.
The first and simpler version of these methods simply takes
an existing capture and redirects this traffic through a
local interface as captured.
One of the main purposes of this type of replay is to test systems to ensure
that they are able to process traffic quickly and correctly.
An example of this is if we initially capture the creation of
multiple TCP sessions on a live network. We can then take this
traffic and run it past different types of appliances to ensure
that they are able to correctly process each of these sessions and
perform appropriate actions.
Understand that we are not limited to sending and
receiving this traffic at a specific rate.
We can choose to process this traffic at the exact rate that it was captured at,
or we can choose to speed up or slow down this rate to our own needs.
For example,
if we take this same capture of TCP sessions and
initiate a replay at a higher rate,
we would be able to test the true rate that a specific system is able
to process the traffic and process it correctly.
Or in other words, it can be used to load test different appliances.
However, as this course is focused towards network security,
it is likely the second main purpose for these types of tools
is the one that is the most interesting.
Since these tools have the capability to send traffic in the
exact same format that it was originally sent,
it is possible to use a capture of live traffic to potentially break into
systems using parts of these captures for authentication.
In our demonstration,
we will show an example of this using FTP where we can use
the username and password information held within the capture
to log into a remote FTP server.
Of course, FTP is clear text, and because of this,
isn't hard to do manually,
but it is also potentially possible to set up these types of attack on
other technologies that use encrypted passwords.
Remember that these passwords are sent in a specific
format over the network to a remote server,
and if you can replicate this in such a way that this remote server
thinks you are the original person with credentials,
then you may be able to gain access to it for further exploitation.
The problem, however,
can be that this type of attack will likely not work with the
direct transmission of captured traffic.
Some alteration to the session parts of the traffic will need to be
made to ensure that the remote server believes that you are the same
person or process requesting access.
This is where additional code will be required to work along with the
captured traffic to ensure the highest level of success.
So with that covered,
let's move into the next section where we show our example script in operation.