Wireshark is a packet analyzing tool which deals with PCAP (Packet Capture Files). It is a software that can capture packets on NIC (Network Interface Card).
### Network Taps
Network taps are like a physical device that physcial tap between a cable these are used DFIR (Digital Forensics and Incident Response) or Threat Hunting and Red Teams to sniff and capture packets.
There are two ways to tap network
First is by using hardware to tap the wire and intercept the traffic as it comes across, an example of this would be a vampire tap
Second is planting a network tap would be an inline network tap, which you would plant between or 'inline' two network devices. The tap will replicate packets as they pass the tap. An example of this tap would be the very common Throwing Star LAN Tap
### MAC Flood
MAC Floods are a tactic commonly used by red teams as a way of actively sniffing packets. MAC Flooding is intended to stress the switch and fill the CAM table. Once the CAM table is filled the switch will no longer accept new MAC addresses and so in order to keep the network alive, the switch will send out packets to all ports of the switch.
### ARP Posining
ARP Poisoning is another technique used by red teams to actively sniff packets. By ARP Poisoning you can redirect the traffic from the host(s) to the machine you're monitoring from. This technique will not stress network equipment like MAC Flooding however should still be used with caution and only if other techniques like network taps are unavailable.
## Wireshark Filters
```
and - operator: and / &&
or - operator: or / ||
equals - operator: eq / ==
not equal - operator: ne / !=
greater than - operator: gt / >
less than - operator: lt / <
```
### Filtering Examples
ip.addr == <IPAddress>
ip.src == <SRCIPAddress> and ip.dst == <DSTIPAddress>
tcp.port eq <Port#> or <ProtocolName>
udp.port eq <Port#> or <ProtocolName>
## Analyzing ARP Packets
<imgsrc="https://imgur.com/hYhfCvm.png"/>
1. What is the Opcode for Packet 6?
`request (1)`
<imgsrc="https://imgur.com/Ky69t8h.png"/>
2. What is the source MAC Address of Packet 19?
`80:fb:06:f0:45:d7`
<imgsrc="https://imgur.com/wJBZEHY.png"/>
From the packet info we can see that it's telling that this IP belongs to this MAC address tso this is a reply packet (opcode 2) in ARP
3. What 4 packets are Reply packets?
`74,400,459,520`
<imgsrc="https://imgur.com/A7kuRnF.png"/>
4. What IP Address is at 80:fb:06:f0:45:d7?
`10.251.23.1`
## ICMP
ICMP stands for Internet Control Message Protocol and is used for uitilties like `ping` , `traceroute` and etc. Ping has two codes for the two things that it does , `request` and `respond`. For request code is `8` and for response code is `0`.
<imgsrc="https://imgur.com/BSg91tr.png"/>
We can see that in packet 4 and 5 ping is used and in packet 4 it's a request so code `8` and in packet 5 is a respond so code `0`.
1. What is the type for packet 4?
`8`
2. What is the type for packet 5?
`0`
<imgsrc="https://imgur.com/MKES7C2.png"/>
We can see the timestamp here which is `May 31, 2013` now this might differ from other timezone it maybe `May 30` or `May 31` for me it was 30 because of differnt timezone
3. What is the timestamp for packet 12, only including month day and year? note: Wireshark bases it’s time off of your devices time zone, if your answer is wrong try one day more or less.
`May 30, 2013`
<imgsrc="https://imgur.com/oRlxgW3.png"/>
Here to see value of the `data` string , right click , select `copy` then the `value`.
DNS stands for Domain Name Service , it's a protocol that resolves domain names into IP addresses , because routers work on IP addresses and need to understand which IP belongs to which domain so they query it through a DNS a server by defualt public dns server is `8.8.8.8` which is Google's DNS Server.
<imgsrc="https://imgur.com/HKP8mSM.png"/>
1. What is being queried in packet 1?
`8.8.8.8.in-addr.arpa`
<imgsrc="https://imgur.com/Od3OMPu.png"/>
2. What site is being queried in packet 26?
`www.wireshark.org`
<imgsrc="https://imgur.com/NopC8o3.png"/>
3. What is the Transaction ID for packet 26?
`0x2c58`
## HTTP
HTTP stands for Hyper Text Transport Protocol it is used in world wide web `www`to access resource ,wwww is an information system where documents and other web resources are identified by Uniform Resource Locators(URL). HTTP is used by some sites but this isn't secure secure meaning that connection is not encrypted. It is used to send GET and POST request inorder to receive resources.
<imgsrc="https://imgur.com/nKyB094.png"/>
We can see these statistics by navigating `Statistics` > `Protocol Hierarchy`.
1. What percent of packets originate from Domain Name System?
`4.7`
<imgsrc="https://imgur.com/6ZI1Fjl.png"/>
We can from the packets that this is the IP which ends on "237".
2. What endpoint ends in .237?
`145.254.160.237`
<imgsrc="https://imgur.com/A2HXVca.png"/>
3. What is the user-agent listed in packet 4?
`Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113`.
<imgsrc="https://imgur.com/NHwn5Sq.png"/>
4. Looking at the data stream what is the full request URI from packet 18?
6. Looking at the data stream what is the full request URI from packet 38?
`http://www.ethereal.com/download.html`.
## HTTPS
HTTPS stands for Hyper Text Transfer Protocol Secure , it's the same as HTTP but the only difference is that the connection will be encrypted with the websites
```
Client and server agree on a protocol version
Client and server select a cryptographic algorithm
The client and server can authenticate to each other; this step is optional
Creates a secure tunnel with a public key
```
<imgsrc="https://imgur.com/zUa2ruy.png"/>
1. Looking at the data stream what is the full request URI for packet 31?
`https://localhost/icons/apache_pb.png`
<imgsrc="https://imgur.com/AGUN6XU.png"/>
2. Looking at the data stream was is the full request URI for packet 50?
