> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/network-based-attacks.md). # Network-Based Attacks ### **Network-Based Attacks - Part 1** **What is a Network-Based Attack?** * Network based attacks is the one that deals with network and network service. It isn't related to operating system. * Network Services like ARP, DHCP, SMB, FTP, Telnet, SSH Man-in-the-middle attack
``` ip a ``` ``` nmap -sn /24 nmap -A /24 -t 4 ``` * Listen Wireshark on eth1 and start capturing ``` nmap /24 -sn ``` * stop capturing * save capture > Desktop > rando.pcapng We have few different view > name resolutions > resolve physical addresses (if doesn't knw it then it will show the mac address) View > Coloring rules Statistics > Conversations (We can dissect them by conversation so which machine talking to which machine) No. section in wireshark has \_ symbol it indicates the start and end of a conversation Statistics > flow graphs view > time display format Statistics > Protocol hierarchy *** ### Network-Based Attacks - Part 2 * to edit the columns right click > column preferences add source port and destination port * to check the conversation right click > Follow > HTTP Stream * it keeps history in display filters right click > Follow > TCP Stream click on filter out button How to create our custom display filter ? Press + and fill the labels and filter name. * Right click on the display filter > Display Filter expression * There are 600,000 different type of display filter Some Display Filters : * ip.addr == 192.168.0.1 Follow > TCP Stream * To download a file File> Export Objects > HTTP *** ### Tshark ``` tshark -v ``` ``` tshark -h | more ``` ``` tshark -D ``` ``` tshark -i ``` ``` tshark -r HTTP_traffic.pcap ``` tshark -r \ * Protocol Hierarchy ``` tshark -r HTTP_traffic.pcap -z io,phs -q ``` * Total number of packets ``` tshark -r | wc -l ``` ### Filtering Basics * Filter only HTTP traffic ``` tshark -r -Y 'HTTP' | more ``` * Filter with source IP and destination IP ``` tshark -r HTTP_traffic.pcap -Y 'ip.src==192.168.252.128 && ip.dst==52.32.74.91' ``` * Filter HTTP GET Request ``` tshark -r -Y 'http.request.method==GET' | less ``` * Filter HTTP GET request with advance field filtering like URI ``` tshark -r -Y 'http.request.method==GET' -Tfields -e frame.time -e ip.src -e http.request.full_uri ``` * contains filter, its actually like regex ``` tshark -r -Y 'http contains password' ``` * specific site filter ``` tshark -r -Y 'http.request.method==GET && http.host==www.nytimes.com' -Tfields -e ip.dst' ``` * IP contains ``` tshark -r -Y 'ip contains amazon.in && ip.src==192.168.252.128' -Tfields -e ip.src -e http.cookie ``` * User agent filter for OS enumeration ``` tshark -r -Y 'ip.src==192.168.252.128 && http' -Tfields -e http.user_agent ``` *** ### ARP Poisoning ``` ip a ``` ``` nmap /24 ``` ``` wireshark ``` * capture on eth1 ``` echo 1 > /proc/sys/net/ipv4/ip_forward ``` arpspoof -i eth1 -t \ -r \ ``` arpspoof -i eth1 -t 10.100.13.37 -r 10.100.13.36 ``` * we see telnet traffic now stop the capture. * By ARPspoofing , we told 36 that we are 37 * Display filter = telnet right click > follow > tcp stream ``` telnet 10.100.13.36 ``` * creds in the packets * username: admin * password MyS3cr3tP455 * Telnet is not secure *** ### WiFi Traffic Analysis * We have Protocol 802.11, which is related WiFi * What is the name of the open, so no security, SSID, present, and packetdump > (wlan.fc.type\_subtype==0x0008) && !(wlan.wfa.ie.wpa.version==1) && !(wlan.tag.number==48) As we don't find WPA or other thing that means no security in SecurityTube\_Open * Which of the SSID home network is operating on which channel? > wlan contains Home\_Network Channel : 6 * Which security mechanism is configured for SSID lazy artists? > wlan contains LazyArtists WPA2PSK * is Wi-Fi protected setup WPS, which access point which SSID has that turned on? > (wlan.ssid contains Amazon) && (wlan.fc.type\_sybtype==0x0008) Look at beacon from **Amazonwood** because that's where it would show it. We want to know if it has WPS * What is the total count of packets which were either transmitted or received by the device with a MAC address of E8DE27 ? > (wlan.ta == e8:de:27:16:87:18) || (wlan.ra == e8:de:27:16:87:18) 5701 packets * What is the MAC address of the station which exchanged data with SSID securitytube open? > wlan contains SecurityTube > ((wlan.bssid == e8:de:27:16:87:18) && (wlan.fc.type\_subtype == 0x0020)) * from the last question, we know that a station was connected to SSID SecurityTube Open. Provide the TSF timestamp of the association response sent from the access point to the station. > ((wlan.bssid == e8:de:27:16:87:18) && (wlan.addr == 5c:51:88:31:a0:3b)) && (wlan.fc.type\_subtype == 0x0001) Note: Subtype can be found in the particular packets *** ### Filtering WiFi * Filter wlan traffic ``` tshark -r -Y 'wlan' ``` * What command can be used to only view the de-authentication packets ? ``` tshark -r -Y 'wlan.fc.type_subtype==0x000c' ``` * What can be used to only display WPA handshake packets? ``` ts==hark -r -Y 'eapol' ``` * What command can be used to only print the SSID and BSSID values of all the beacon frames ? ``` tshark -r -Y 'wlan.fc.type_subtype==8' -Tfields -e wlan.ssid -e wlan.bssid ``` * What is the BSSID of SSID Lazy Artists? ``` tshark -r -Y 'wlan.ssid==LazyArtists' -Tfields -e wlan.bssid ``` Note: BSSID = MAC Address * SSID home network is operating on which channel ? ``` tshark -r -Y 'wlan.ssid==Home_Network' -Tfields -e wlan_radio.channel ``` * Which two devices received the DeAuth messages ? State the MAC address of both. ``` tshark -r -Y 'wlan.fc.type_subtype==0x00c' -Tfields -e wlan.ra ``` * Which device does MAC address 5c:51:88:31:a0:3b belong to ? Mention manufacturer and model number of this device. ``` tshark -r -Y 'wlan.ta==5c:51:88:31:a0:3b && http' -Tfields -e http.user_agent ``` ***