Instructor: In the previous video 2 2
we seen how we can launch Wireshark 3 3
and we said that we can actually just open 4 4
a file that contains packets that we already captured 5 5
and we can start analyzing them using Wireshark. 6 6
In this video I want to start sniffing packets 7 7
and then generate some traffic 8 8
in my Windows machine 9 9
and then we'll see how 10 10
we can analyze these packets using Wireshark. 11 11
So I'm already the man in the middle 12 12
as I've said you first have to be the 13 13
man in the middle to use Wireshark 14 14
and then the traffic that's generated 15 15
in the Windows machine is actually 16 16
filmed through eth0 as we seen in the previous video. 17 17
So before I start capturing the packets, 18 18
I wanna go to the options 19 19
and I just wanna show you what options we can set. 20 20
So first you can see all the interfaces 21 21
that you have and you can see the traffic generated on them. 22 22
And you can see eth0 is actually generating 23 23
some traffic every now and then 24 24
because it's actually coming from the Windows machine. 25 25
So in here you can select the interfaces 26 26
that you want to start capturing on 27 27
and you can actually select more than one interface 28 28
and all we have to do is just hold the control 29 29
and then click other interfaces 30 30
that you want to listen on. 31 31
For example, we can just click them like this. 32 32
But for now I actually only wanna sniff on eth0. 33 33
Now if we go on the output 34 34
you'll see that you have an option to store 35 35
these packets somewhere 36 36
so again if you only want to sniff 37 37
and you don't want to analyze things 38 38
then you can just go onto browse 39 39
and you can store the packets 40 40
that you're gonna sniff somewhere 41 41
and then you can analyze them whenever you have the time. 42 42
At a different time you can just open 43 43
them with Wireshark like I showed you 44 44
in the previous video, 45 45
you can just go on file, open 46 46
and then open the packets and start analyzing them. 47 47
Now I have eth0 selected 48 48
and I'm just gonna click on start. 49 49
And that will start capturing packets. 50 50
Anything that's gonna flow through eth0 51 51
will be captured and it will be displayed in here, anything. 52 52
I mean images, pictures, messages, cookies, 53 53
anything that that computer does on the internet 54 54
will flow through eth0 and therefore 55 55
will be captured by Wireshark. 56 56
So it's not like man in the middle life 57 57
where it was only showing us the important 58 58
information right here you'll see anything, 59 59
all the traffic that's generated. 60 60
Now, I wanna go and generate some traffic 61 61
on the target computer so we can analyze it here 62 62
but before I do that 63 63
I'm gonna go back to buttercup 64 64
and I wanna see my hsts caplet 65 65
so I can downgrade https to http 66 66
'cause if everything goes over http 67 67
we won't be able to see or read anything 68 68
because like I said, 69 69
everything will be encrypted. 70 70
So I'm gonna hit enter 71 71
this will work as expected, 72 72
we'll go back to Wireshark 73 73
and let's go to the target computer. 74 74
I'm gonna go to google.ie 75 75
and let's search for something 76 76
so for example let's search for zSecurity 77 77
and keep in mind everything is loading 78 78
over http in here so that's why we'll be able to read 79 79
and analyze everything that we're loading right here. 80 80
Now, let's go back to Wireshark 81 81
and see how we can filter this information 82 82
and discover the websites visit 83 83
by the target, see the requests, and all that. 84 84
So I'm gonna click on the stop button to stop this. 85 85
Now this is the main interface of Wireshark 86 86
and you can see that the first thing we have 87 87
is each one record of this is a packet. 88 88
Now you'll see here the columns, 89 89
first of all here is the number of the packets 90 90
so you have this one is number one, 91 91
number two, number three and number four. 92 92
And the time, 93 93
you'll see the time when this packet was captured 94 94
so zero is when we first started sniffing 95 95
and then the time increases as we go down 96 96
and it shows when these packets were captured, 97 97
when they were sent basically. 98 98
You can also see the source, 99 99
so this is the device that the packet was sent from 100 100
and you can see that this one is not sent 101 101
from our target it's actually coming from the internet 102 102
from a server that has this IP 103 103
and it's going to our target computer 104 104
which is 10.20.14.206. 105 105
You can see the protocol so it's TCP for this one. 106 106
You can see that it's ICMP in this one 107 107
and you can see that it's ARP for this. 108 108
You can see the length which is the size 109 109
and you can also see info about this packet. 110 110
Now we can also notice that 111 111
these packets have different colors. 112 112
Usually green is TCP packets, 113 113
dark blue is DNS packets, 114 114
and if we go down we should actually be able to find 115 115
some of them and you can see all of these are DNF packets. 116 116
Light blue usually is UDP 117 117
but we don't have any UDP packets at the moment. 118 118
And you can also see we have some black packets 119 119
and these are TCP packets that 120 120
had a problem, that had issues. 121 121
Now I know what you're thinking, 122 122
there are so many packets in here 123 123
and a lot of them might not be useful to you 124 124
depending on what you're trying to get. 125 125
But don't worry about this, 126 126
in the next lecture I'm gonna show you 127 127
how to filter these packets to only display 128 128
the relevant ones and then analyze them 129 129
to extract the useful information.