So we're covered on numerous occasions.
The first step in our process is look at the traffic to see if we can find anything that is suspicious
and just start looking through here workshops helping you out because there's all these red things over
here.
That's usually indication of a reset.
So we start looking through the traffic you see there are lots of resets in this traffic that's not
normal in a normal production network you're not going to see this many resets when you see these mega
resets.
More than likely somebody is doing something trying to gather information.
Because remember a reset means something is not there it's an abnormal close of TCAP connection.
And when we start looking at this we want to actually look at it from the approach of our mouth ideology.
Remember the entire time we're learning how to hack and develop and learn these different types of techniques.
We want to be able to analyze it at the lowest level and that's the packets and that's what I want to
understand it's all about what's in the packets not the tool.
So you want to be a layer 2 Layer 3 those types of things when you're doing your skill enhancement to
learn how to do the different types of techniques to either do the hacking side or do the recovery from
a hack.
OK.
So you look at what it look for open ports and then we look for data and then we'll look for sessions
and then we look for streams to see if any of the data has been used in any type streams that some type
of an attack in most cases.
So if your review is again there's been a reset packets.
What we do is determine what's causing these resets It's a probable sign of a port scan but we put in
our filter our flags that sin call.
And our TCAP dot flags as we want.
So we've got them both and we apply it.
Remember these are all the ports that were open because of the response of the sin and the act that
we're looking at here.
So we start looking you can start making your list 139 of course that buy a sports car some 80 traffics
will look at that 135 more net buys 21.
So nifty piece or 10 25 Microsoft messaging services four four five more net bias 10 27 10 26 14 33
which is as cruel as cure all traffic in here right.
Those types of things so we can start going through here and we can look and see.
It's a repeated pattern.
So now we know pretty much that's the only ports that were open that this possible suspect or whatever
here is because we really don't know yet.
But we know something suspicious because we see all these different types of Proby.
So now if we go into one of these that we've got to sit back on and we followed the stream and there's
nothing there that means this was a scan.
Now we've got two types of scans.
We have a connect scan which completes the three way handshake and we have a self scan or a half open
scan which doesn't complete the three way handshake.
And when you see this right here the Sandison at the ack and the reset acts of this completed the three
way handshake.
So this first scan we look at right now in this packet 2 1 1 1 2011 shows that we have a port scan.
In fact we have what's called a connect scan.
OK so now we clear that filter and we put it and apply it again and again what are we looking for.
We're looking at the open ports.
So we've got the 14:30 3 that's always a good one to take a look at.
So we apply this follow the stream and we see once again this is a query of a probe and a port scan.
In this case it's the half open scan.
So it Packett 1503 we have a second thought by Sendak which of course is the target and then the reset.
Notice how it's Arisa not a reset that the theory was would a stealth scan it wouldn't be law.
But the target.
But today pretty much all your detection modern devices know this.
And they will detect these types of thing.
OK.
So now we've done that.
So what's the next thing in our methodology.
Well maybe we look for open ports and the next thing is data to look at data.
We do TCAP that flags that push equal equals one and we apply it.
This is all packets that have data in them.
Everybody has different preferences but my preferences I've said before I just use the bottom window
data window here and I start looking in this lower window to review the information see what I want
to investigate.
And that's kind of how we do it.
We just scroll down.
All right.
So what goes through every possible one.
Because we've covered quite a bit of things on this.
Those types of things.
So we've got some good information here lots of different things a lot of push a lot of data.
I started looking through Myners that version that bind.
So now here a version of BIND telling me that they extracted a bind version on that service.
And again remember what we're looking for here is what did the potential suspect or attacker uncover
with scanning.
Because the way the methodology works for an attacker the way it works is for the live systems once
they get live systems a little port.
Once you got ports you look at services what's running on those ports and then they do enumeration what's
running on those ports and can i log in and do the types of things in this case.
We see we've got Samba down in here.
So again that's our process.
There's one more for you to look at when you see a packet like this a get request packet as we're shown
here.
All right.
So when you see that type of packet
it's manually entered it's manually entered because that's all you have.
Remember if you are going to be doing this from a browser you normally would see the actual type of
browser an additional Medhat data here about the actual browser being used.
So again that's a manual probe that extracts the actual banner from a web server.
In this case than have anything on it which is good.
Now we go back to our filter.
Remember you can save these filters as well so you don't have to keep doing this over and over again.
And I keep looking at different things so what am I looking for.
Again looking for things that look weird suspicious right here got Microsoft's some information about
Microsoft those types of things and the best way to explain the OCP off line certificate services those
types to these PLX probably not going to be to read the data in the TLM because that of course is encrypted.
So since it's protected encrypted we probably can't find a whole lot on that.
So we're OK here so we'll just keep going down let's go down here a little ways.
And again it's a process.
You supply this process and you practice and you practice it over and over again until you get better
at what you're doing.
All right.
So we've seen some FGP traffic so let's do a TCAP port equal call 21.
These are all RFID packets in the trace.
All right we've got some down here and what I use to look for here is I look for a three way handshake
so you see this when you send this send back and the reset.
Right.
So you're starting to look and see is there any in there in the FPP that goes since and ack ack because
I just scrolled down a little bit here any time I'm doing the analysis or forensics investigation and
I'm looking to see if it's going to change its characteristics.
Now I do have something interested here that might have to look out later but just keep going through
and looking at the different things until I see a three way handshake right here.
So this goes a sad goes a act.
There's the band or the Microsoft FGP server.
Now that's right click it followed TZP stream and now we have a user Anonymous was allowed nonsuccess
allowed logged in intern in passive mode data collection ready transferor starting.
So now the perpetrator the suspects uncovered that in this case this network was allowing anonymous
FGP.
All right.
So that means that an active witness would be.
Can I do it right.
So again these are the types of things we want to do.
So a lot of things we can do here.
If I do TCAP flags push again equals one and I reply I just look at the data.
So again it's just a process of following out a methodology step by step methodology and look for data
in the packets.
All right.
Now one of the things we've always got the capability of is just recognize immediately when something
doesn't look right and TCAP we have our six flags urgent and push resets in and fit.
Now it's normal traffic to see certain flags set an abnormal traffic to see flags said that shouldn't
be set.
So we go in here and we start looking.
We're looking for some abnormal traffic.
So what would be abnormal traffic and open in a closed session in the fin in the same package should
never happen.
Remember the sin is the first sequence and get sent in back in those times.
You never should have this.
See how we've got a thin skin.
Remember thin is a normal clothes.
A sin or a synchronize is a normal open.
So I've got to open and close Also I've got a data and I got the urgent partners said this is in fact
here at 1 2 9 4 4.
This is a crafted packet.
So that would be something to investigate to see if the crafted pack of getting data back but this one
here is even better.
This one is 1 2 9 8 7 is actually ffin push an urge in.
This is the classic signature of an X scan using the in map tool.
So we've uncovered all this information.
So if you were doing that were forensics on this trace you know this person is doing lots of Port scanning.
All right.
So they're doing port scanning and we say after port scanning we do enumerations of the data is identified
with the enumeration and then from there we try to leverage and look for vulnerabilities and that's
kind of what we're trying to do when we're doing our hacking.
So everything we've discovered so well so far shows the suspects in that tour to gather information
from the network here and 13 to 0 7.
If we come down here we actually get the indication that is in fact in that.
So if you come down 13 to 0 7 right here how do I get that indication in MAP scripting engine right
there tells me it's an IMAP scripting engine so when you're using that scripting engine it's run in
all these different scripts by default or depending on the perpetrator the suspect.
That could be run and specific ones.
All right.
So we know they're running that and we've also got some Web traffic in here.
So one of the things we always want to do is we want to actually look at port 80 traffic.
So let's do a TCAP poort equal equals.
And the Zoeller port 80 traffic as you can see I'm starting to see profiling here.
This is all in mabbe scripting engine stuff.
The options command all this stuff in that scripting engine remember really the best way to look at
the Web traffic I can apply another filled netfilter is frame contains 200.
OK.
And now when I apply 200 OK this is all responded to by the web server.
And I just start looking for different types of things and I say OK let's look at this.
Follow TCAP stream.
This showed me 200 OK and it tells me the hacking tool Nido was being used here.
Now the nice thing is they're not deploying any evasion tactics.
So this hacker is is running a default and Ito's can't or is not familiar with the intrusion and invasions
and all the other stuff it can do.
Now the bigger concern from a security standpoint is right here Microsoft I guess 6.00 was not good
that I got Microsoft I 6.00 server in this trade because there's been lots of vulnerabilities in Microsoft.
I was sick porno.
So again we now know Nikko's being used so what covered in the past was if I knew a web scanners being
used the best way to look at the Web scanner traffic is to click on statistics and then what I'd do
is I go into a TTP requests and there they are.
And you start Sienese start looking at some of these requests look kind of strange.
That's because it's a scanning tool in this case.
It's neat though is just see Nico's doing all this cool stuff.
All these different things it's doing.
And as we go we're loading more and more stuff to access all those types of things.
So again a lot of information being used is just seeds still trying to load all the actual tool traffic
because so much data there and you see stuff that shouldn't be that PWT password easy access you CNC
shouldn't see that in your network traffic.
So again it's understanding what to look for OK.
So you got the idea of that.
Now we've covered the majority of the actual types of things to look for.
So if we go who would go to this pack it is want to show you one thing here 15 7:43 we just keep looking.
Again it's just a matter of looking through the packets and looking for the data.
So in this case I got a script command.
This is Nito use in the script command.
And I come TCAP stream and this is what you want to see.
In this case unauthorized.
So even though they ran the attack in this case turned to a script command.
It's an authorized but the bad side is we still see Microsoft II as 6.00 which is not good.
So again these are the types of things you can uncover when you actually look at different types of
things.
So if we go and we do our TCAP up port and what happens is the more you do this you get used to looking
for patterns.
Remember all hackers follow some form or a methodology.
So we look in here and we start seeing some information some 14:30 through traffic that's all port scan
traffic.
There's a three way handshake so we can take a look at that.
Always look for the data.
We can do that as well.
Microsoft eschewing all server.
So we you see it's use in Microsoft as Cuil server and wigging Stracke information from that.
Now I've covered the solution here and I've got the index and those types of things.
So again what you want to look for is where is that I S-box let's look at that again TCAP P-Dub port
equal equals 80.
Now let's see who got the Cincinnati x we get three way handshake we got to get request.
Right.
It looks like in this case to get request is going to this 60 let's see.
We've got to 200 Okay.
And we got Mike Kristoff I was 6 now from the standpoint of what we're doing here in our analysis and
learn how to hack like a pro.
Now I know what the attacker is going to do is they're going to extract this information and that's
my vulnerable.
So I don't want to do is I want a filter just on traffic to and from that machine because I know it
is our weak machine based on what we're seeing here.
So now this is all the 160 traffics now is 30 years or 60.
Traffic host 60 traffic.
Now we started seeing a lot of information going to come from that box.
So what do we look for.
Well again it's that process just the same process we've applied over and over again.
We looked through here.
I just like the lower window people have different preferences and we do different things and we cover
a lot of different information and how to do that.
Now I don't want to give away all the secrets because I want you to actually do some research and figure
out some things that home.
So if I go here on this packet and follow the stream and to help students rest in client tool actually
just type in help.
And you go see and you start seeing you get some data in here.
All those type within scripts negotiate different things and what was the one I said to look or Frank
contains So I do a frame contains 200 OK.
And I P Di a d d are equal equals 1 9 2 to 1 6 8 1 7 7 dot 60.
Now the other filter that says give me all the frame contains 200 OK and the IP address.
Now see if I get the data.
Now I've got data and I started looking down here and now I start seeing more and more information that
went to and from that machine and from here it's a matter of trying to put all this together and find
out what's taking place.
So there's no real magic key here it's just basically taking a look at a stream and look for the data.
In this case for four founders say well why is it in there.
Because if you keep going down it's still extracting information resource can't be found.
All right as I scroll down we go again.
Microsoft Dyas porno neco.
This is all the Niek scanned stuff going on.
All right.
So this is all neat though are different things and information to description.
And again as we keep going down we've got more and more data to review.
Now the trick is and I showed this before is when it's a data base looking for database content and
in some cases you discover where the database content is.
But in this case since it's Nido or likely is just the scan.
But you've got the idea and I kind of wanted to give you this type of information now for this packet
capture.
So now it's new to actually apply it explore more and build your own capture files.
Remember when you do anything related to hacking or any type of incident response you want to always
bear to look at the packet level.
So start wireshark run your different attacks and review them and the protocol analyzer at the packet
level.
This is how you can learn to hack like a pro and hack like a pro means you understand network attacks.
You understand all these different things.
Attackers can do at the packet level.
A lot of people thinks it's run tools.
It is not running tools.
It's looking at the packets understand what the tools do on the network by analyzing those packets.
And then you can create your own tool or better yet you can create and mimic a tool just by running
data that matches that what you discovered in your protocol analysis.
And that's how you learn to hack like a pro.
Enjoy it and have fun.
Thanks.