- [Lecturer] In this segment, we're gonna take a closer look
at secure and insecure protocols, specifically SSL
and TLS and FTP.
Now to do this we're gonna use Wireshark to capture packets.
So I have Wireshark installed and configure it on my system.
I've configured it to resolve IP addresses to host names.
So you won't just see source IP and destination IP,
but you'll also see the host names.
And we're going to start with capturing wireless traffic.
So I'm gonna go to wifi
and I'm going to start capturing wireless traffic.
I do happen to have a browser open right now,
pointing to Google and I'm actually gonna go over
to my browser as you're watching the screen.
And I am going to open up cnn.com
and we'll need to resolve to cnn.com.
We're gonna get some news,
but we're also going to get some advertising.
We're gonna get some video feeds
and we're gonna get some content from other providers.
So you can see all the connections going at this point.
And just having CNN open on my browser.
All right, I am going to close my browser now.
I'm gonna come back over to Wireshark
and I am going to stop the packet capture.
So what you're seeing in Wireshark on the top third
of the screen, these are all the packets that were captured
during that session.
What you're seeing in the middle of the screen is details
of the packet that's highlighted in the upper part
and then on the lower part
of the screen what you're seeing is the payload.
So one things that we're most interested here in is,
is how are we communicating in the browser?
Are we communicating securely?
Meaning are we using SSL
or TLS both running on port 443?
And which one are we using?
SSL or TLS?
And if we're using TLS, what version?
So I'm just gonna apply a filter here.
I'm gonna look for SSL.
And interestingly enough, what gets returned
to me is a lot of TLS protocol packets.
I'm move this down a little bit
so you can see a little bit better here.
So when I do my filter for SSL, again
TLS is getting returned.
And if I scroll down,
what I'm seeing is actually no SSL
and all of the connections were TLS.
And you can see that some of them are TLS version 1.2
and some of them are TLS version 1.3.
Again, I have a number of different connections
that are happening simultaneously.
Some cases I'm connected to the Turner Network
and others to other content that's being served up
maybe video as well as the initial connection to Google.
We can see some Client Hellos, we can see exchange
of cipher information, see exchange Server Hellos.
So a lot that's going on here in this TLS session.
But really what I wanted to ensure was
that my connections was using SSL or TLS
and preferably not SSL and preferably TLS
and TLS version 1.2 and above.
And so we've gotten our assurance from capturing the packets
and being able to look specifically
for the type of protocol.
I am going to clear this now
and I wanna show you something else.
I wanna show you what an insecure protocol looks
like when you're doing a packet capture.
So I am going to run FTP locally
on my machine and do a login.
Now, FTP in and of itself is considered an insecure protocol
because it's a clear text protocol.
So what I'm gonna do is I'm gonna start capturing
with my loop back adapter.
So that's looking just at my local system.
And I'm gonna bring up a command prompt
and I'm gonna start FTP.
And I am gonna say, I open a session
and I'm gonna open a session
on my local host and it ask me to log in.
I'm gonna log in as anonymous
and it says anonymous access allowed.
And it's gonna suggest I send my identity
my email name as a password.
I'll just use sari@sari.com.
And there's an issue, it's not allowing me to log in.
That's really irrelevant because what I wanna show you
is that all of that login information was captured
and will be viewable in clear text.
So I am going to just close out this session
and now we're gonna come back into our packet capture.
I'm gonna clear the filter because nothing I did was SSL
and our filter is still asking just to show SSL traffic.
All right, so now we have all the packets we just captured
during the local host session.
And what I'm gonna do now is apply another filter to FTP.
And I wanna call your attention
to the right hand side of the screen.
You can see that I started the Microsoft FTP service.
You can see the command was successful.
You can see where it says user right here.
That user logged in with the credentials of anonymous.
Then the message that came back
that said anonymous access was allowed.
Then the password, which I use sari@sari.com.
And then there was that error message that we saw
that the user couldn't log in and then the quick command
and then the FTP service shutting down and saying goodbye.
The key here is in this insecure protocol,
this clear text protocol we could see everything
that happened.
When we were looking at the SSL or TLS connections,
we weren't getting that clear view right into the payload,
the data that was being transmitted back and forth.
So I've done all this with Wireshark.
This was just a really, really brief overview
and introduction to Wireshark if you haven't seen it before.
I think it's an absolutely critical skill to have
to be able to capture traffic and to analyze that.
So if you aren't familiar with using a tool similar
to Wireshark or using Wireshark,
I would strongly suggest that you download it
and just start working with it.
Once you have it installed and again, it's free.
There's a really good help section.
You can get to their website, you can ask questions.
There's FAQs, there's sample captures
there's a really good wiki.
Again, knowing this is good for the exam,
but it's really, really essential
for every cybersecurity professional to be able
to do this kind of work regardless
of what your specialty area is.
And that's a closer look
at packet capture and in insecure and secure protocols.