In this lesson,
we're going to discuss the role of Wireshark
and reconnaissance in enumeration and pentesting.
Wireshark is a powerful tool used in network analysis
essential for penetration testers during the recon
and enumeration phases.
At its core, Wireshark is just a packet analyzer,
which means it captures and displays the data
traveling back and forth on the network in real time.
This visibility into the network traffic is invaluable
for understanding the communication between the devices,
identifying potential vulnerabilities,
and also mapping out network structures.
Wireshark helps us in passive recon
where you listen to traffic without actively
engaging with the target systems.
By capturing packets, you can observe the types
of protocols being used,
the IP addresses involved, and even specific details
such as open ports and services running on a network.
For instance, if you capture traffic
and notice a lot of HTTP traffic,
you might deduce that web servers are in use.
This information forms the foundation
for your penetration test,
allowing you to tailor your attacks more precisely.
During a penetration test,
you might capture a network traffic
and see HTTP requests
that include potential SQL injection attempts.
For example, consider the image showing a GET request
to hack/password.pl with parameters
that indicate a SQL injection attack.
In this image, this request suggests
that the endpoint hack/password.pl is susceptible
to a SQL injection.
By examining HTTP request parameters in Wireshark,
and you can see that the name
and password fields contain suspicious encoded characters
that are typical in a SQL injection attack.
You can then see the response from the request
towards the bottom, indicating that the attack
was successful by the message
letting the user know that they were logged in.
Wireshark is also essential to dissect the layers
of the OSI models from captured packets.
Starting from the physical layer all the way
up to the application layer,
Wireshark allows testers to view details
such as MAC addresses, IP addresses, TCP/UDP ports,
and the actual payload of the packets.
This granular view is key
for identifying misconfigurations,
such as services running on non-standard ports
or unencrypted sensitive information being transmitted.
Another example involves capturing SMTP traffic.
By examining the email headers and servers communicating,
you can identify the mail servers being used
by the target's organization.
This information can be leveraged
to conduct phishing attacks
or to understand just the flow
of sensitive communications within the company.
Next, let's consider Wireshark's role in enumeration.
Enumeration is a step beyond reconnaissance
where you actively engage with a target
to extract more detailed information.
Using Wireshark, you can monitor the responses from
enumeration activities like network scans, ping sweeps,
and service probes.
For example, if you're running a Nmap scan
to identify open ports and services,
Wireshark will capture the packets being sent
and the responses from the target.
This allows you to not just see the final results
of your scans, but also the raw data
exchanged during process.
Such detailed visibility can help you understand
if there are any anomalies
or unexpected behavior in the responses
which might indicate security mechanisms in place
like web application firewalls,
load balancers, or potential vulnerabilities.
Imagine you're testing a network
and perform a Nmap scan to identify open ports.
Wireshark captures all the SYN packets sent by Nmap
and the SYN-ACK responses from the target.
You notice that port 22 or SSH is open on several servers.
By examining the packets,
you can see the SSH banners that reveal the version
of the SSH software running on those servers.
This information can be important if you identify
that the version is outdated
and vulnerable to known exploit.
Another practical use of Wireshark
in pen testing is capturing and analyzing on-path attacks,
formerly known as man-in-the-middle attacks.
In an on-path attack, a penetration tester might intercept
communication between two devices
to capture sensitive information.
For instance, imagine intercepting HTTP traffic
between a client and a server.
Using Wireshark, you can capture the entire session
and extract data like login credentials
or session cookies to replay later,
demonstrating a vulnerability in a network security posture.
You might also set up Wireshark
to capture all traffic on a specific segment of the network.
Over time, you could identify patterns such as the presence
of outdated protocols like Telnet
or FTP being used without encryption.
These observations provide actionable insights
that you can include in your final report to the client
detailing how these insecure practices
can be exploited by attackers.
Let's take a look at the following captured data
from a Telnet data stream.
If you look here, the highlighted captured traffic
shows example login credentials
being transmitted in plain text.
This demonstrates a significant security flaw
as Telnet transmits data without encryption,
making it easy for attackers
or pentesters to intercept sensitive information.
Wireshark can also be used to capture DNS traffic,
revealing the internal structure of a network.
For instance, this image of DNS traffic shows
detailed information about a DNS query and response.
By analyzing this DNS traffic,
you can identify internal host names
and potential sensitive internal resources.
The image here shows a DNS query
for eastcoast.on.icomera.com,
which reveals information about the domain
and its associated IP address.
This can help in mapping out the network
and identifying targets for further enumeration.
So remember, using Wireshark effectively in your recon
and enumeration activities can provide you with
a wealth of information about the target.
Understanding how to capture
and analyze this data will enable you
to uncover hidden vulnerabilities
and prepare for a successful penetration test engagement.