Wireshark

From Grayhat cheatsheets
Jump to navigationJump to search
  • Once packets have been captured, used display fileters, to select which ones are shown. Not the same as capture filters. Capture filters are simpler and less flexible, and are used to reduce the number of captured packets, which can be very large in an active network. For example, a display filter to show only packets for port 110 is "tcp.port eq 110", and the equivalent capture filter is "tcp port 110". Display filters are in the toolbar above the packets captured, and to apply capture filters we need to go to "capture > options", or "capture > capture filters". Also in the welcome page, where we choose the interface to sniff, we can apply a capture filter.
  • Big files, etc, are split into several packets. With wireshark we can arrange them, to see the contents, as if there had been no packet fragmentation. We need to right click on the packet and hit "follow TCP stream"

We need to select the appropriate interface for the capture, or promiscuous mode, to detect in all interfaces.

  • We can filter by the IP (both of sender or receiver), with the filter "ip.addr == x.x.x.x "

 

  • To filter packets from a range of IPs we use the filter "ip.addr == 150.244.0.0/16"

 

  • If we have captured encrypted traffic (SSL), and we have the key log file (with format <ClientRandom> <space> <Secret>, see for details: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format), we can decrypt the traffic. For that, in wireshark go to Edit > Preferences > Protocols > SSL, and browse the key log file in the field called "pre master secret log filename". Clicking ok will decrypt the packets which can be decrypted, and in those (with SSL or TLS protocol), we will see a tab at the bottom of the dump, where it says Frame, and another (among several) which says Decrypted SSL data (xxx bytes). The second one contains the decrypted packets. If we right click on one such packet, and Follow SSL stream, we will see the stream of decrypted data, contrary to TCP stream, still available. It is very possible that we still find what looks like encrypted data in the stream, and in that case it means that the packets contain images, video or other non text contents.
  • We can extract to a folder all the files contained in a capture file (files, images, videos, etc). This applies to encrypted data, if we have been able to decrypt it. If not, not everything will be retrieved. To extract all or some of the files, in wireshark go to File > Export objects > HTTP, and select what to export in the dialog that appears. This and the previous tricks are used in HackTheBox's Marshal in the middle challenge