Welcome to our lesson on network-based attacks.
In this one, we're going to tell you
about what is a network-based attack and start that now.
So a network-based attack is one that
deals with network and network services.
It is fairly straightforward.
It's really just something that isn't related to the operating
system.
Instead, it deals with network, the packets traveling
across the network, or on services
that utilize the network, but are more operating
system-agnostic, if you will.
So that would include our ARP, our DHCP, SMB, FTP, Telnet,
and SSH.
A lot of those services we can take advantage of, and we have.
We've done that in exploitation as well as
in footprinting scanning and enumeration.
We looked at some of these services and the ways
that we can interact and take advantage
of a null session or a SSH session
and attacking it with a password spraying or brute forcing it.
Those are some network-based attacks.
And we've already done several of them.
What we're going to get into in this course
is going to be more "man in the middle"
attacks, where we have two systems that
are talking to each other on a network
that we are also connected to.
And they talk back and forth.
And what we are able to do is hear their traffic
because here's one of the things.
When network traffic goes out, it has--
if it's on the network, then it is
encased in some Layer 1, Layer 2, and Layer 3 protocols.
And when it gets sent out, it's not broadcast out.
It is sent to an endpoint.
But it's electrical signals.
So depending on how things are set up on the network,
traffic might hit all the points on the network,
usually with a switch.
You don't have any of that issue.
Back in the hub days, it was really
easy to listen to everyone else's traffic.
Now that those are a thing of the past,
in order to listen to traffic that
isn't meant for your machine, you either
need to connect to a SPAN port, which
listens to all the traffic on a switch, or you need to poison.
The easiest way to poison is ARP poisoning.
And we'll practice that.
It's where you start broadcasting out
ARP packets that tell the other machines on the network
that you are a certain IP address.
Inside a network, packets are bound to an IP address.
But they get routed inside the network based on MAC address.
So you spoof with ARP poisoning a MAC address.
Then you can have traffic meant for another machine come
to you.
And we'll dive more into that in a future lesson.
But another thing that we can do is promiscuous mode,
where we listen to all traffic.
If we're lucky, we might hear traffic that's-- even though
it's not intended for our machine,
if we turn on promiscuous mode, which is pretty standard with
most packet captures, then we will be able to listen to other
traffic on the network.
And I'll give you a taste of what that looks like.
We're going to jump into a virtual environment.
And we'll live in here for the rest of the lesson.
This is a Linux environment.
So let's look at our IP address.
And you can see we have--
[INAUDIBLE]-- there we go--
a few connections.
But our IP address in it is going
to be 192.112.112.2 on a 24 network.
Let's do a quick Nmap scan of this network.
Let's go 0/24 and just see what's out there.
And we've got a .1, .3, .4, and .2.
So if we do 1 through 4, and let's also do a service scan--
well, let's go just aggressive.
Let's just see what these machines are, what's on them.
Aggressive mode is going to do a few extra things.
It's going to run, obviously, the port scan, but a service
scan, operating system scan, and some default scripts.
It's the same as [INAUDIBLE].
So it should return to some useful information.
If you don't mind being loud, an aggressive scan
will usually get you some info.
So .1 has SSH open.
It's got HTTP and HTTPS.
That's what we should be expecting for this lab.
We've got .3-- also has HTTP open.
It's also got a MySQL database.
.4 has HTTP and HTTPS.
Perfect.
So the joy is--
let's go look around at what's in here.
192.112.112.1-- if it doesn't return anything quickly,
then we'll move on.
.1 is our router.
.3 has bWAPP.
Let's go with HTTPS.
It's not there.
And that should fit.
Correct.
So .3 doesn't have 443.
So it shouldn't have that open.
So we go 4.
4 has some issues.
But I trust it.
It's bWAPP on HTTPS.
So that's good.
We should also have a default. That's good.
So .3 only has HTTP.
And .4 has HTTP and HTTPS.
We're .2.
So don't worry about that.
Awesome.
Well, we are making some network traffic.
Let's take a look at it.
This is Wireshark.
We have played with Wireshark before.
We want to be interacting on eth1.
So eth0 here was a 10.1.
We don't need to worry about that.
That's just for the VM to talk.
Eth1, though, has our 192.112.
So let's listen on eth1.
And begin.
Click the little fin.
And it will start capturing.
Now, what is it doing?
Let's refresh this so it gets some network traffic.
We could also run our scan again,
create some network traffic.
We could even run that aggressive scan,
just create a ton of traffic.
Perfect.
So these are packets.
A lot of these are TCP packets.
Makes sense-- I just did a TCP scan--
should be tons of TCP packets going to and from .2,
which is my machine, out to .4, initially.
That was that HTTP traffic.
And then-- did that ARP scan.
And this was two MAC addresses because, remember,
that's how ARP works.
So when I did that [INAUDIBLE],, it did an ARP scan.
And then it did some other scans, got back.
Who is where? .4 is at 04.
Cool.
That's neat.
So we captured-- there's not going
to be any more traffic because we created all the traffic.
So we will stop the capture.
Just hit Stop there.
So what do you do in Wireshark?
Well, let's walk our way across.
Wireshark has some neat things in here.
We can open captures.
We can save captures.
Let's do that.
Let's call this "rando."
And I'm just going to save it to the desktop.
And it's going to save it as a pcapng.
It's next-generation PCAP, which is a packet capture.
It's a Wireshark file.
So save that.
It is now on the desktop, somewhere.
I don't see it.
There it is, on the desktop.
So we can save it.
We could open a new one, rando.pcapng.
I already have it open-- so no change.
You can import hex dumps.
You can export some packets.
I'll get into that in a second.
We have a few different views, some things
that we can change in here.
So name resolution is neat.
We could resolve physical addresses.
So that's MAC addresses.
If our MAC address relates to a known host,
then it'll tell us the name.
But if it doesn't know it, then it'll
just show the MAC address.
Same with network addresses-- if we were--
there we go-- demossl.ine.local.
That is, apparently, us.
And INE is the machine that we're hitting.
So it resolved that for us.
And these were broadcast.
Remember, ARP scan, it was broadcast.
So it resolved our MAC addresses.
I turned that back off.
See?
There you go.
Resolved-- INE to broadcast.
Otherwise, it would look like this.
It's fairly common to keep physical address resolution on.
Sometimes, people even want their transport address.
So it says in here what things are.
But I'm going to turn that off.
You can zoom if you need to change size.
There is colorization of packets.
So all these packets--
I want that back on.
What I meant to show you was the coloring rules.
So in here, you can see different types of packets
mean different things in this coloring scheme.
It's not too terrible to understand.
ICMP traffic-- so our HTTP traffic--
fairly common to see.
That's neat.
You can change it up.
You can turn things on, turn things off if you want.
And then you can change some of your columns and your layout.
We'll get into that in a little bit.
You can use some keys.
This menu is only really helpful to tell you what the keys are.
Moving through the packets, through this menu,
is not super helpful.
But using those hotkeys can make some of your work faster.
There's captures.
We started to capture [INAUDIBLE]..
There's some options for captures.
You can choose which interface you want to use.
You can apply capture filters.
I'll get to filters in a bit.
You can even hone in on some of these things?
Which IP address are you going to use on that interface?
You can choose where your output is going to go.
You can save it as a pcapng or a pcap
and create new files after so long.
That can be really helpful if you have a long capture.
We'll play with that in TShark as well.
It's more options.
Again, stop the capture after a certain time.
It's very similar to make a new file.
And you can have it collect with resolved names.
Then there's some analysis.
This is really just applying display filters
and playing around with things as we see them.
Statistics, though, is quite useful.
So we can go to Protocol Hierarchy
and see what protocols are on this network.
So most of it's all Ethernet frames, IPv4--
guess there's some traffic that was Ethernet that was not IPv4.
But it's not marked as IPv6.
It's going to be our ARP.
Is that under-- yeah.
Sorry.
Some of the tabbing--
that is that other 6%.
We have some UDP traffic.
Our TCP traffic includes a whole bunch of stuff
because we did that scan.
So it found the MySQL.
So it sent some scripts for the MySQL.
It found SSH.
So it sent some scripts for SSH, set some extra things
to connect.
And so that's the protocol hierarchy.
We can see what kind of packets are in this capture.
We can dissect them by conversation.
So which machine talked to which machine?
Initially, over Ethernet, it's just going to be MAC addresses.
We can look at IPv4.
We could even resolve this, if we wanted to.
Turn on that name resolution and the conversations off.
New resolution turns on there--
no IPv6, though there was TCP traffic.
And you can scroll through and see all the conversations--
so different than the overall packages.
A lot of these packets--
packages-- a lot of these packets
are part of a conversation.
You can see over here on the left,
there's this line going alongside.
Well, it goes dotted.
And it'll eventually end down there.
That was all one conversation, or it
started at one point, had some breaks where it's dotted.
These weren't necessarily conversations.
Then they were-- sorry.
You get endpoints.
This can be quite useful.
Also, name resolution is an option here.
It's a little-- just slightly different
than the conversations.
Another one-- packet lengths.
And then you could get into some flow
graphs, which are interesting.
Some HTTP traffic information can be quite useful.
That is that one.
We're not messing with telephony in here.
We could do some cool labs.
And we will have some cool labs, but for VoIP.
So with wireless, we're not going to get in those today.
So what do we have?
What columns are these?
We have this number column.
We've got time.
And it says "format as specified."
But that's a decimal.
And it starts at 0.
So this is a relative time-- relative time to what?
Let's find out.
Right-click and Edit Column.
And then it says, oh, time is specified.
That's really useful here.
Well, where is it specified?
Go back up here into View, Time Display Format.
And it's seconds since beginning of capture.
So those decimals are seconds.
They're fractions of a second.
What is most common is UTC Date and Time of Day, Control-Alt-7,
just because it looks the same for everyone.
And it goes with UTC because it's common.
It's easy.
It's known.
You can change it into local time if you really want to.
But most people who are working with packet captures,
doing investigations, don't--
they leave everything in UTC and run the investigations
off that, at least in my experience.