WEBVTT 0:00:06.480000 --> 0:00:11.340000 So, in this video, we're going to be taking a look at how to analyze a 0:00:11.340000 --> 0:00:17.640000 PCAP that contains evidence or traffic that was captured on a network. 0:00:17.640000 --> 0:00:24.300000 And our objective is to investigate or to analyze the traffic to identify 0:00:24.300000 --> 0:00:35.340000 evidence of and validated by an intruder, right, who got access to a network. 0:00:35.340000 --> 0:00:39.960000 So, hopefully this will give you a better idea of just how much information 0:00:39.960000 --> 0:00:42.340000 you can extract from a PCAP. 0:00:42.340000 --> 0:00:48.580000 But more importantly, I'll be walking you through the logic behind identifying 0:00:48.580000 --> 0:00:53.260000 specific type of activity, in this case, networks scans. 0:00:53.260000 --> 0:00:56.980000 So, this video has a lab associated with it. 0:00:56.980000 --> 0:01:03.340000 The lab is just going to be below this video and is actually or is pretty 0:01:03.340000 --> 0:01:09.340000 much named exactly pretty much as the same title as this video investigating 0:01:09.340000 --> 0:01:14.740000 network scans. So, I'm going to fire up my lab environment and I'll be 0:01:14.740000 --> 0:01:17.900000 seeing you in a couple of seconds. 0:01:17.900000 --> 0:01:23.560000 All right. So, I'm currently within the lab environment and very, very 0:01:23.560000 --> 0:01:27.360000 similar to the previous lab in terms of what we have on the desktop. 0:01:27.360000 --> 0:01:28.840000 But we have three tasks. 0:01:28.840000 --> 0:01:31.880000 So, this lab has three specific tasks. 0:01:31.880000 --> 0:01:36.680000 We have a task one which involves examining the first captured PCAP called 0:01:36.680000 --> 0:01:38.700000 one dot PCAP NG. 0:01:38.700000 --> 0:01:40.700000 NG is just next generation. 0:01:40.700000 --> 0:01:42.520000 It's still a PCAP file. 0:01:42.520000 --> 0:01:47.400000 So we're supposed to analyze it to identify who the attacker, who is the 0:01:47.400000 --> 0:01:52.320000 attacker and who is the victim in terms of IP addresses. 0:01:52.320000 --> 0:01:57.980000 We need to also identify the type of scan being performed or conducted. 0:01:57.980000 --> 0:02:00.660000 In this case, it's most likely a port scan, right? 0:02:00.660000 --> 0:02:08.200000 And the third objective for task one is to identify the two open ports 0:02:08.200000 --> 0:02:09.800000 and the two closed ports. 0:02:09.800000 --> 0:02:18.060000 So, the PCAP in question is under module seven and lab 21 and one dot 0:02:18.060000 --> 0:02:23.560000 PCAP NG. So, we'll open this up with wire shock and let's get started. 0:02:23.560000 --> 0:02:28.940000 So, I'm just going to bring this up in here and let me zoom in so we can 0:02:28.940000 --> 0:02:31.500000 see this a little bit better. 0:02:31.500000 --> 0:02:33.460000 And there we go. 0:02:33.460000 --> 0:02:37.220000 Very nice. So, we have the source and that's going to be important and 0:02:37.220000 --> 0:02:38.800000 the destination. 0:02:38.800000 --> 0:02:41.820000 We then have the protocol. 0:02:41.820000 --> 0:02:45.560000 So, given that we're dealing with a, you know, network scan could be a 0:02:45.560000 --> 0:02:46.520000 host discovery scan. 0:02:46.520000 --> 0:02:50.220000 But in this case, most likely a port scan, we can actually see some very 0:02:50.220000 --> 0:02:52.360000 interesting activity here. 0:02:52.360000 --> 0:02:55.820000 So, first things first, if you understand how TCP works in terms of the 0:02:55.820000 --> 0:03:00.940000 TCP three way handshake, you're already at an advantage because network 0:03:00.940000 --> 0:03:05.720000 scanning tools or port scanning tools like NMAP allow you to perform different 0:03:05.720000 --> 0:03:10.420000 types of scans, you know, in this case, specific to TCP. 0:03:10.420000 --> 0:03:15.680000 So, you have, you know, the TCP connects scan, you know, which essentially 0:03:15.680000 --> 0:03:19.120000 involves the entire three way handshake in order to determine if a port 0:03:19.120000 --> 0:03:20.140000 is open or closed. 0:03:20.140000 --> 0:03:24.000000 So, that means you have the SIN packet with a SIN flag set. 0:03:24.000000 --> 0:03:29.360000 So, the three way handshake SIN, SIN ACK, ACK and then RST or reset, right? 0:03:29.360000 --> 0:03:34.380000 So, here we can see a SIN, okay, and then a reset, okay, very interesting. 0:03:34.380000 --> 0:03:43.380000 So, SIN, SIN, SIN, and then we have a reset ACK, okay, so interesting. 0:03:43.380000 --> 0:03:48.220000 Then we have a SIN, SIN, SIN ACK and then reset, okay. 0:03:48.220000 --> 0:03:51.200000 So, very, very interesting stuff we have in here. 0:03:51.200000 --> 0:03:58.680000 So, the key point that I want to make clear here, as you can see, is that 0:03:58.680000 --> 0:04:02.240000 an attacker conducting port scanning on a network will likely be sending 0:04:02.240000 --> 0:04:06.140000 a large number of SIN segments, regardless of the type of scan they are 0:04:06.140000 --> 0:04:08.760000 running, TCP scan that is. 0:04:08.760000 --> 0:04:16.280000 So, what we can do is use the display filter to filter for messages or 0:04:16.280000 --> 0:04:19.040000 packets with SIN flags. 0:04:19.040000 --> 0:04:26.020000 So, in order to do this, we say TCP dot flags dot SIN, okay. 0:04:26.020000 --> 0:04:32.740000 That will give us, you know, right, we adjust the SIN packets here. 0:04:32.740000 --> 0:04:39.160000 So, first thing that we can see is that a lot of the SINs or the SIN packets 0:04:39.160000 --> 0:04:45.160000 or packets with the SIN flag set are coming from, let's see, we have 133, 0:04:45.160000 --> 0:04:49.520000 yeah, a lot of them are coming from 133, you can see these all the SINs, 0:04:49.520000 --> 0:04:55.700000 the RSTs or the resets are being sent by 192.168.153.1. 0:04:55.700000 --> 0:04:59.460000 So, it's most likely the victim, the attacker, most likely has the IP 0:04:59.460000 --> 0:05:04.760000 192.168.153.133. 0:05:04.760000 --> 0:05:11.880000 Okay, now, in order to determine the type of scan being used here, we 0:05:11.880000 --> 0:05:16.480000 need to pretty much analyze or examine at least one port that's being 0:05:16.480000 --> 0:05:23.820000 scanned. And we can easily filter the traffic and look for segments either 0:05:23.820000 --> 0:05:27.760000 going or coming from a certain port and examine how the port was scanned. 0:05:27.760000 --> 0:05:32.460000 So, a great port to start with, you know, is going to be something like 0:05:32.460000 --> 0:05:36.140000 TCP port 80, right? 0:05:36.140000 --> 0:05:38.900000 That's usually a port that scanned. 0:05:38.900000 --> 0:05:44.800000 So here we can see just based on the TCP flags being sent by the attacker 0:05:44.800000 --> 0:05:47.020000 whose IP we've identified here. 0:05:47.020000 --> 0:05:52.900000 So we have a SIN and then a SIN ACK and then an ACK. 0:05:52.900000 --> 0:05:56.700000 So the full TCP through a handshake has been completed here. 0:05:56.700000 --> 0:06:02.180000 So we know that because it's, we have a SIN SIN ACK and then an ACK and 0:06:02.180000 --> 0:06:05.520000 then the attacker sends back a reset, okay? 0:06:05.520000 --> 0:06:10.740000 So in this particular case, you know, this means we're dealing with a 0:06:10.740000 --> 0:06:15.840000 full TCP scan or in N-Map it would be a TCP connect scan. 0:06:15.840000 --> 0:06:21.220000 So based on the responses that the attacker got or, you know, the fact 0:06:21.220000 --> 0:06:26.920000 that the target responded with a SIN ACK, it means that the port 80 is 0:06:26.920000 --> 0:06:31.580000 most likely open, okay? 0:06:31.580000 --> 0:06:36.660000 So you know, that's fairly easy to deduce if you're familiar with N-Map 0:06:36.660000 --> 0:06:41.100000 and, you know, even in an offensive context or a defensive context, then 0:06:41.100000 --> 0:06:43.280000 this would not be new to you now. 0:06:43.280000 --> 0:06:48.400000 If we wanted to identify, you know, which ports were open, you know, in 0:06:48.400000 --> 0:06:52.700000 terms of what the attacker was able to find, we can actually look for 0:06:52.700000 --> 0:06:57.160000 SIN ACK messages which originated from the victim machine because now 0:06:57.160000 --> 0:07:02.620000 we know that if the port is open, it'll, you know, the target will respond 0:07:02.620000 --> 0:07:04.980000 with SIN ACK, okay? 0:07:04.980000 --> 0:07:08.400000 So in order to do this, we would need to use a display filter. 0:07:08.400000 --> 0:07:10.060000 Let me just clear that one. 0:07:10.060000 --> 0:07:14.040000 Like, for example, I want to combine two operations here so we can say, 0:07:14.040000 --> 0:07:14.780000 oh, three, sorry. 0:07:14.780000 --> 0:07:18.820000 So we can say TCP dot ACK. 0:07:18.820000 --> 0:07:22.740000 You can see the ACK flag has a value of one. 0:07:22.740000 --> 0:07:29.720000 So that's going to be equal to one and TCP dot flags dot SIN is also going 0:07:29.720000 --> 0:07:31.560000 to be equal to one. 0:07:31.560000 --> 0:07:35.940000 And then we can combine this and say, and the source IP. 0:07:35.940000 --> 0:07:38.920000 Remember what we did in the first video in this section. 0:07:38.920000 --> 0:07:42.900000 Source IP is going to be equal to the IP address that we're fairly confident 0:07:42.900000 --> 0:07:45.080000 is the attacker's IP. 0:07:45.080000 --> 0:07:50.740000 So one into 168.153, 133. 0:07:50.740000 --> 0:07:55.760000 So 153, 133. So we hit enter. 0:07:55.760000 --> 0:08:01.860000 Also, sorry, the source needs to be coming from the victim. 0:08:01.860000 --> 0:08:03.640000 So we hit enter my bad. 0:08:03.640000 --> 0:08:06.160000 And now we can see the ports in question. 0:08:06.160000 --> 0:08:08.840000 So we can see that port 445 is open. 0:08:08.840000 --> 0:08:13.140000 338.9 already. We know that the victim was is a Windows system. 0:08:13.140000 --> 0:08:20.580000 We also have SMTP 25 port 80, 139 net bios, 135, and then a couple of 0:08:20.580000 --> 0:08:22.940000 other ports right over here. 0:08:22.940000 --> 0:08:25.960000 So these are the ports that are open. 0:08:25.960000 --> 0:08:30.440000 And of course, you can sort of invert this. 0:08:30.440000 --> 0:08:35.560000 You can invert this display filter to find the ones that were closed. 0:08:35.560000 --> 0:08:39.840000 But based on this, you know, we've sort of validated the information that 0:08:39.840000 --> 0:08:43.020000 we were asked to validate in task one, which is who is the attacker and 0:08:43.020000 --> 0:08:43.920000 who is the victim. 0:08:43.920000 --> 0:08:49.400000 So the attacker is 192.168 or 153.133. 0:08:49.400000 --> 0:08:54.080000 The victim is 192.168.153.130. 0:08:54.080000 --> 0:08:55.740000 What type of scan is being conducted? 0:08:55.740000 --> 0:09:00.720000 It's a TCP connect scan or a full TCP scan. 0:09:00.720000 --> 0:09:05.260000 And then the two open ports and the two closed ones, we only found the 0:09:05.260000 --> 0:09:12.600000 the ones that were open over here. 0:09:12.600000 --> 0:09:17.840000 We can actually go ahead and so let's get rid of this here. 0:09:17.840000 --> 0:09:23.440000 And now if we take a look at the ones with the reset, we can see right 0:09:23.440000 --> 0:09:24.600000 over here. Hold on. 0:09:24.600000 --> 0:09:27.580000 So that's the victim there. 0:09:27.580000 --> 0:09:30.180000 So one second syn, syn, ACK. 0:09:30.180000 --> 0:09:32.420000 Let's go to the very top here. 0:09:32.420000 --> 0:09:38.540000 So wherever we see a reset port 8080 is closed, which other one is closed 0:09:38.540000 --> 0:09:42.500000 port. No one second. 0:09:42.500000 --> 0:09:46.980000 So reset ACK that is coming from 130. 0:09:46.980000 --> 0:09:48.180000 So from the victim. 0:09:48.180000 --> 0:09:50.380000 And then over here. 0:09:50.380000 --> 0:09:58.180000 23 reset ACK right over here. 0:09:58.180000 --> 0:10:02.300000 One, no, that's not the one there. 0:10:02.300000 --> 0:10:04.420000 Just hold on a second. 0:10:04.420000 --> 0:10:08.980000 So actually quite a few ports were closed here based on this. 0:10:08.980000 --> 0:10:14.240000 There's just more than we're only supposed to identify two open and two 0:10:14.240000 --> 0:10:19.620000 close. So all of the ones where you see an RST, ACK would be the ones 0:10:19.620000 --> 0:10:20.540000 that are closed. 0:10:20.540000 --> 0:10:22.320000 So we found more than just two. 0:10:22.320000 --> 0:10:28.460000 Anyway, the next task is will require us to examine the second PCAP called 0:10:28.460000 --> 0:10:31.300000 two dot PCAP NG. 0:10:31.300000 --> 0:10:38.960000 And we are to identify the type of scan being conducted and identify the 0:10:38.960000 --> 0:10:44.140000 difference between that scan and this one here in one dot PCAP NG. 0:10:44.140000 --> 0:10:48.680000 In any case, let's go ahead and close this and we'll open up two dot PCAP 0:10:48.680000 --> 0:10:51.000000 NG right over here. 0:10:51.000000 --> 0:10:55.320000 And we then have, I think, two more tasks. 0:10:55.320000 --> 0:11:02.960000 So task two. Let's see what is going on here. 0:11:02.960000 --> 0:11:10.460000 So we can see a lot of, so we have ARP or ARP packets, TCP, NBNS, Net 0:11:10.460000 --> 0:11:12.660000 Byers name service. 0:11:12.660000 --> 0:11:21.800000 Let us take a look at, for example, this looks interesting because taking 0:11:21.800000 --> 0:11:26.340000 a look at this now, we can see that we have a few sins for the following 0:11:26.340000 --> 0:11:33.280000 ports. Okay, and then we see an RST ACK, but I'm looking for one second. 0:11:33.280000 --> 0:11:37.520000 So sin, let's see, do we have a sin ACK here? 0:11:37.520000 --> 0:11:43.700000 Let's see, do we have a, there we are. 0:11:43.700000 --> 0:11:46.500000 So we can see that here. 0:11:46.500000 --> 0:11:55.060000 So 25 RST. Okay, so basically, let's take, hold on a second. 0:11:55.060000 --> 0:11:59.260000 Let me just check, because I think I'd seen something similar for port, 0:11:59.260000 --> 0:12:04.080000 or five here. So just a second. 0:12:04.080000 --> 0:12:09.380000 What we're looking for is a reset. 0:12:09.380000 --> 0:12:14.480000 Just a second. Let me see, and then I miss anything that we are. 0:12:14.480000 --> 0:12:15.860000 So there we are reset. 0:12:15.860000 --> 0:12:18.900000 So again, the IPs are still the same here. 0:12:18.900000 --> 0:12:26.980000 So actually, let's, let's say TCP port, we'll just use it as an example 0:12:26.980000 --> 0:12:31.020000 here. TCP port is equal to 445. 0:12:31.020000 --> 0:12:33.440000 And I'm just going to hit enter. 0:12:33.440000 --> 0:12:36.660000 So we can see that the attacker sends a sin. 0:12:36.660000 --> 0:12:39.600000 There's a sin ACK from the target. 0:12:39.600000 --> 0:12:41.180000 So that means the port is open. 0:12:41.180000 --> 0:12:45.120000 But now the attacker, instead of completing the three way handshake, sends 0:12:45.120000 --> 0:12:47.820000 a reset. Okay, so this means we're dealing. 0:12:47.820000 --> 0:12:52.700000 This is a half open scan. 0:12:52.700000 --> 0:12:57.860000 In Nmap, it would be, I believe the, it's just the sin scan. 0:12:57.860000 --> 0:13:02.340000 SS, I believe, is the scan option to facilitate it. 0:13:02.340000 --> 0:13:08.340000 So now we are supposed to identify, you know, we can identify the ports 0:13:08.340000 --> 0:13:14.440000 that are open. And yeah, by simply filtering the messages or the packets 0:13:14.440000 --> 0:13:18.580000 that originated from the server. 0:13:18.580000 --> 0:13:21.660000 And both have the sin and ACK flag set. 0:13:21.660000 --> 0:13:25.540000 So we can essentially say, let me clear that out. 0:13:25.540000 --> 0:13:30.660000 We can say TCP dot flags dot sin. 0:13:30.660000 --> 0:13:32.920000 This is going to be equal to one. 0:13:32.920000 --> 0:13:39.100000 And we can then say TCP dot flags dot ACK. 0:13:39.100000 --> 0:13:40.860000 That's going to be equal to one. 0:13:40.860000 --> 0:13:46.540000 And then the source IP dot source is going to be the victim. 0:13:46.540000 --> 0:13:52.360000 So in this case, we've already identified the victim as 192.168. 0:13:52.360000 --> 0:13:59.460000 153. 130. So here now we can see sin, sin ACK. 0:13:59.460000 --> 0:14:00.960000 Yeah, that's what we wanted. 0:14:00.960000 --> 0:14:06.820000 So we can see the ports that are open right over here. 0:14:06.820000 --> 0:14:11.560000 The ones that would respond with the reset, you know, would be closed. 0:14:11.560000 --> 0:14:17.200000 So I believe that's it for task two. 0:14:17.200000 --> 0:14:22.180000 And now of course we can get into task three. 0:14:22.180000 --> 0:14:33.400000 So task three involves examining a third PCAP called idle dot PCAP NG. 0:14:33.400000 --> 0:14:38.880000 So we need to identify what type of scan is being conducted this time. 0:14:38.880000 --> 0:14:44.400000 The IP address of the attacker and the ports that are being scanned. 0:14:44.400000 --> 0:14:51.000000 So let's go ahead and open up idle dot PCAP NG like so. 0:14:51.000000 --> 0:14:55.780000 Okay. And now let's see. 0:14:55.780000 --> 0:14:58.500000 We have different protocols now in here. 0:14:58.500000 --> 0:15:01.920000 Very, very interesting. 0:15:01.920000 --> 0:15:05.120000 So let's take a look at this. 0:15:05.120000 --> 0:15:08.820000 So we have, let's go to this. 0:15:08.820000 --> 0:15:11.640000 So we have a sin, sin ACK hold on a second. 0:15:11.640000 --> 0:15:17.460000 So now we have a sin ACK and then reset, sin ACK reset. 0:15:17.460000 --> 0:15:24.680000 Okay. And then sin, yeah, sin ACK reset, reset. 0:15:24.680000 --> 0:15:26.780000 Very, very interesting. 0:15:26.780000 --> 0:15:32.840000 But now we have a different IP here and just a second. 0:15:32.840000 --> 0:15:40.260000 So the attacker, let's see, hold on a second. 0:15:40.260000 --> 0:15:41.700000 So where is the stuff coming? 0:15:41.700000 --> 0:15:44.720000 So sin ACK is being sent. 0:15:44.720000 --> 0:15:49.940000 Let's see. So that's 133. 0:15:49.940000 --> 0:15:54.920000 And then we have, this is very, very interesting. 0:15:54.920000 --> 0:16:04.420000 Let us try and, let's try and see what sin segments are being sent. 0:16:04.420000 --> 0:16:12.040000 So I'm going to say TCP dot flags dot sin is going to be, and then we 0:16:12.040000 --> 0:16:17.980000 say TCP dot flags dot ACK because I'm not seeing any X here. 0:16:17.980000 --> 0:16:20.040000 So we'll say zero. 0:16:20.040000 --> 0:16:27.200000 Okay. So we can see that now these are coming from 140. 0:16:27.200000 --> 0:16:34.160000 So this new address 192.168.153.140 and the target is still 130 here, 0:16:34.160000 --> 0:16:37.000000 192.168.153.130. 0:16:37.000000 --> 0:16:41.220000 So they're selling, sorry, pardon me, they're sending sins. 0:16:41.220000 --> 0:16:56.760000 Okay. This looks like again still, yeah, this looks like a half open scan. 0:16:56.760000 --> 0:17:05.600000 And the open ports are replying, let's say ICMP, yeah, ACK flags, the 0:17:05.600000 --> 0:17:18.080000 open would be responding with a, let me say, so the open ones would respond 0:17:18.080000 --> 0:17:19.280000 with the sin ACK. 0:17:19.280000 --> 0:17:23.360000 So let's say sin right over here, one second. 0:17:23.360000 --> 0:17:27.040000 So TCP flags sin, yeah, one second. 0:17:27.040000 --> 0:17:33.100000 Yeah. So this is coming from, do we have any from 130? 0:17:33.100000 --> 0:17:36.240000 Yeah. Okay. So that is correct. 0:17:36.240000 --> 0:17:41.600000 So we can pretty much now say TCP flag sin is equal to one. 0:17:41.600000 --> 0:17:51.680000 And then TCP, lines dot ACK would be equal to, that would be equal to 0:17:51.680000 --> 0:17:57.480000 one as well. And then we can say IP dot source, the victim address or 0:17:57.480000 --> 0:18:05.360000 the target. So that's going to be 198.168.153.130. 0:18:05.360000 --> 0:18:08.860000 It's going to enter here. 0:18:08.860000 --> 0:18:14.060000 And now we can see right over here, one second. 0:18:14.060000 --> 0:18:16.420000 So sin ACK sin ACK, yeah. 0:18:16.420000 --> 0:18:21.600000 So these are going to be the open ports. 0:18:21.600000 --> 0:18:25.520000 So yeah, I think we completed that. 0:18:25.520000 --> 0:18:31.360000 And yeah, there is a final task in this lab task four, which I'm going 0:18:31.360000 --> 0:18:34.240000 to leave to you to actually solve it. 0:18:34.240000 --> 0:18:39.380000 This is already documented in the solutions tab of the lab. 0:18:39.380000 --> 0:18:45.180000 But hopefully you now have a better idea of how you can utilize wire shock 0:18:45.180000 --> 0:18:49.280000 to analyze, you know, PCAPs in this case, a, you know, a network traffic 0:18:49.280000 --> 0:18:52.720000 pertinent to network scanning. 0:18:52.720000 --> 0:18:56.340000 So with that being said, that brings us to the end of the practical demonstration 0:18:56.340000 --> 0:18:58.580000 section of this video. 0:18:58.580000 --> 0:19:04.000000 All right. So that was the process of investigating network scans with 0:19:04.000000 --> 0:19:09.760000 wire shock. Hopefully you found that useful or illuminating, but that 0:19:09.760000 --> 0:19:12.440000 brings us to the end of this video. 0:19:12.440000 --> 0:19:16.480000 And with that being said, I will be seeing you in the next video.