Instructor: In this lecture, I wanna spend more time 2 2
with Wireshark showing you how to filter all 3 3
of these packets to only display the useful packets, 4 4
how to trace them, what do they mean, 5 5
and how to display more information about 6 6
each one of these packets. 7 7
Now what we did on the target computer so far, 8 8
we most of the traffic that we generated 9 9
was HTTP traffic, 10 10
so to get rid of all this information that's hard 11 11
for us to read, 12 12
we're just gonna type in here in the filters. 13 13
We're just gonna type in http. 14 14
Hit enter, 15 15
and as you can see now that filtered all the packets 16 16
to HTTP traffic only. 17 17
So this is the traffic that was basically sent 18 18
by the browser and is usually sent by web browsers. 19 19
They always send traffic over HTTP or HTTPS. 20 20
And since we're downgraded HTTPS to HTTP, 21 21
you wanna use the HTTP filter to see everything 22 22
that a target person is doing on the browser, 23 23
regardless of what they're doing. 24 24
Whether they're browsing websites, 25 25
whether they're watching a video, 26 26
whether they're looking at images, 27 27
whatever they're looking, it will be loaded over HTTP. 28 28
So looking at the first record right here, 29 29
we can see that this request is sent from 30 30
this IP, which is the IP of my target 31 31
to an IP on the internet. 32 32
So we can see that this is not a private IP, 33 33
this is an IP on the internet. 34 34
So it's sent to a server. 35 35
And if we double click this record, 36 36
we'll get much more information about the packet itself. 37 37
So we have the information about the frame, 38 38
which includes the size of the packet. 39 39
It includes the interface that it was sent on, 40 40
the time, and all that. 41 41
In the internet, we have information about the source MAC 42 42
address and the destination MAC address. 43 43
So where did this packet go from and where did it go to? 44 44
Remember when I first spoke about packets and how 45 45
they always travel from a source MAC to a destination MAC? 46 46
So this information is all stored in here. 47 47
In the internet protocol, we have information about 48 48
the IPs, so in the internet we had information about 49 49
the MAC addresses. 50 50
In the internet protocol, we have information about 51 51
the source IP and the destination IP 52 52
for this particular packet. 53 53
And the transmission protocol we have information 54 54
about the port, so we can see that this went from this 55 55
source port to port 80. 56 56
This is usually the default port used on web servers, 57 57
so in most cases whenever data is sent to a website, 58 58
it'll always be sent to port 80. 59 59
But the most important part in here is the hypertext 60 60
transfer protocol, which is basically the data sent 61 61
over HTTP. 62 62
Clicking on this will give us information on whatever 63 63
data has been sent over HTTP. 64 64
And like I said, this would contain everything 65 65
that was sent to and from a browser. 66 66
So right here we can see that this particular packet 67 67
sent a get request to a website called google.ie. 68 68
Now this is literally when we typed google.ie, 69 69
we didn't search for anything. 70 70
We didn't really do anything. 71 71
You can also expand this to see more information 72 72
about the actual request. 73 73
And you can even see the HTTP header sent if you wanna 74 74
get more information about this particular request. 75 75
Now this whole method of getting information follows 76 76
with all types of packets, 77 77
so you can double click any packet you have 78 78
and you'll be able to read the data sent 79 79
within this packet. 80 80
Now you can also in here see an arrow, 81 81
which basically means that this was a request 82 82
and the arrow back here marks that this was 83 83
a response to this request right here. 84 84
Now moving down you can see also see requests 85 85
for images. 86 86
What you can also do is click on any of these packets, 87 87
for example, again back to this get request, 88 88
right click it, and go to Follow HTTP Stream. 89 89
And this will basically follow the stream 90 90
that this request has caused, all the way down 91 91
to the response. 92 92
So if I click it, you'll see the response for this 93 93
particular request was this right here. 94 94
You can see that this was a PNG, 95 95
and literally the binary content of this PNG image 96 96
is right here. 97 97
So as you can see we're literally getting the raw data 98 98
in here. 99 99
Now I'm gonna close this and go back to what we had, 100 100
which was HTTP. 101 101
Now if we keep going down. 102 102
You literally see everything that has been sent 103 103
and received by the target. 104 104
So, for example, again in here we can see this was 105 105
a JavaScript file that was loaded by Google. 106 106
Then in here we can see another get request. 107 107
And this get request was where we searched for 108 108
that security, so you can even see the search term in here. 109 109
So let me double click this to show you in more details. 110 110
Again, this automatically went 111 111
to the hypertext protocol part. 112 112
Like I said, this is the HTTP part. 113 113
Whatever that gets sent to the browser, 114 114
and you can see that this was sent to google.com 115 115
first of all and the URI, so whatever went after 116 116
google.com was search and what we were searching 117 117
for that zsecurity which is exactly what we typed in here. 118 118
Again, in here you can see the full URL 119 119
with the search term. 120 120
This is literally what the user gets and their URL 121 121
bar in here. 122 122
So as you can see Wireshark literally shows everything 123 123
that flows through the interface. 124 124
In this lecture I wanted to show you a quick overview 125 125
on how we can filter data. 126 126
And don't worry too much about this. 127 127
We'll actually be using it more in the next lectures 128 128
and we will see how we can easily use it 129 129
to filter data and discover useful information.