Packet analysis (Basic)

Network Packet Analysis (basic)

Ahmad Muammar W.K. OSCP

Technical Workshop (25 Oktober 2012)

Tuesday, January 22, 13

Introduction

• A.K.A y3dips

• Pro. Bandwidth Hunter

• IT(Sec) Consultant/Pentester/py.Coder

• Founder echo.or.id, ubuntu-id, idsecconf

• @y3dips, [email protected]

Network Packet Analysis - Ahmad Muammar W.K. OSCPTuesday, January 22, 13

Packet Analysis

• Captured Network Traffic

• Analyze the protocols, carve out the files, search for strings


• Analyze fileds within protocols

• Analyze Protocols within packets

• Analyze Packets within streams

• Reconstruct higher-layer protocols

Packet Analysis


• Too many stream packet

• Packet corrupted or truncated

• Contents encrypted at different layers

• Unstandard protocols

Issue Found


• Examination of one or more fields within the protocol’s data structure.

Protocol Analysis


• Packet Analysis

Packet Analysis


WiresharkAhmad Muammar W.K. OSCP

Network Packet Analysis Technical Workshop (25 Oktober 2012)


WireSharkAdvance Usage


Wireshark Display

• Packet List

• Packet Details

• Packet Bytes


Packet ListPacket List

Packet Details

Packet Bytes


WiresharkColoring Rules


WiresharkCapture Filters


Capture Filtersfor the shake of the performance


Capture/BPF syntax

• Type: host, net, port

• Direction: src, dst

• Proto: ether, ip, tcp, udp

• Logical oepration: &&, ||, !


Capture Filters

• Filtering the host

• host ipv4/ipv6

• host hostname

• ether host mac (00-11-22-33-44-55)

• src/dst host 192.168.1.1


Capture Filters

• Filtering the Protocol/Port

• port 443

• !port 443

• protocol name (e.g: icmp)

• !protocol name (e.g !icmp)


Capture Filters

• Protocol Field

• icmp[0] == 3 (unreachable)

• icmp[0] == 8 (echo request)

• tcp[13] & 4 == 4 (RST)

• tcp[13] & 1 == 1 (FIN)


Display FiltersSee only what you wanna see


Display Filters

• !tcp.port=443

• tcp.flag.syn=1

• !arp

• tcp.port==21 || tcp.port==23

• smtp || pop || imap


Packet AnalysisWrong Dissector


Protocol Dissector

• Allow Wireshark to automatically break down into various section so that it can be analyzed

• Translator, decoder

• Not work for non-standard/default port.


Wrong Dissector

• So its an SSL traffic

• But, why we able to see all info

• FTP Traffic using port 443?

• Decode it with FTP


Packet AnalysisReconstruct File and Data


Reconstruct Data

• nc -lv 110 > confidential.pdf

• nc -vv 192.168.1.222 110 < confidential.pdf

• non standard port send pdf and zip


Packet AnalysisReconstruct PDF File


Packet AnalysisReconstruct Zip File from NC file transfer


Packet AnalysisReconstruct Zip File from FTP server


Packet AnalysisDecrypting and decode ssl packet


Network Packet Analysis

Ahmad Muammar W.K. OSCP

Technical Workshop (25 Oktober 2012)


Packet analysis (Basic)

Documents

Transcript of Packet analysis (Basic)