CYBERSECURITY. KALI/LINUX/META AND WIN 7. 2HRS

Overview The​ ​following ​ ​lab​ ​will ​ ​require​ ​the​ ​use​ ​of ​ ​wireshark ​ ​to​ ​show​ ​proficiency ​ ​in​ ​network traffic​ ​analysis.​ ​Document​ ​the​ ​instructions​ ​and​ ​analysis​ ​outlined​ ​below.​ ​Complete​ ​all tasks​ ​below, ​ ​provide ​ ​explanation ​ ​on​ ​how​ ​you​ ​identified​ ​your​ ​answers.

You​ ​should​ ​write​ ​a​ ​report​ ​responding ​ ​and​ ​explain ​ ​all​ ​questions​ ​and​ ​points​ ​outlined below.​ ​Screenshots​ ​should​ ​be​ ​used​ ​but​ ​sparingly​ ​and​ ​only​ ​of ​ ​the​ ​relevant information​ ​not​ ​your ​ ​whole​ ​desktop.

Accessing​ ​wireshark ​ ​in​ ​SecOnion​ ​-​ ​Terminal​ ​​wireshark

Task​ ​1: Instructions

● Start​ ​a​ ​wireshark ​ ​capture ● Navigate​ ​to​ ​an​ ​HTTP​ ​Site​ ​(non​ ​HTTPS) ● Stop​ ​the​ ​capture

Analysis ● Create​ ​a​ ​filter​ ​for ​ ​all​ ​HTTP ​ ​Traffic

○ What ​ ​is​ ​the​ ​user​ ​agent ​ ​string​ ​used? ○ Was​ ​TCP​ ​or ​ ​UDP ​ ​used​ ​to​ ​communicate​ ​to​ ​google? ○ What ​ ​HTTP ​ ​methods​ ​were​ ​used ​ ​in​ ​the​ ​traffic? ○ Use ​ ​a​ ​TCP ​ ​stream​ ​to​ ​view​ ​the​ ​images​ ​transferred

● Create​ ​a​ ​filter​ ​for ​ ​all​ ​DNS ​ ​Traffic ○ Provide ​ ​a​ ​screenshot ​ ​of​ ​the​ ​response ​ ​for ​ ​the​ ​DNS ​ ​request ○ Was​ ​TCP​ ​or ​ ​UDP ​ ​used​ ​to​ ​communicate​ ​to​ ​google? ○ What ​ ​was​ ​the​ ​DNS​ ​server ​ ​that​ ​was​ ​queried?

● Create​ ​a​ ​filter​ ​for ​ ​ARP​ ​Traffic ○ Why​ ​did ​ ​this​ ​occur?

● Identify​ ​the​ ​three​ ​way​ ​handshake ○ Show​ ​which​ ​TCP ​ ​flags​ ​were​ ​used

Task​ ​2: Instructions

● Start​ ​a​ ​wireshark ​ ​capture ● run​ ​the​ ​ping​ ​command​ ​to​ ​yahoo.com ● Stop​ ​the​ ​capture

Analysis ● Create​ ​a​ ​filter​ ​to​ ​display​ ​ICMP​ ​traffic ● What ​ ​ICMP​ ​codes ​ ​were​ ​used?

Task​ ​3: This​ ​is​ ​a​ ​capture​ ​of​ ​a​ ​client​ ​connecting​ ​to​ ​a​ ​simple​ ​HTTP​ ​webpage. Instructions

● Open​ ​the​ ​BasicHTTPTraffic.pcap​ ​into​ ​wireshark Analysis

● What​ ​is​ ​the​ ​OS​ ​and​ ​Web​ ​architecture​ ​used​ ​on​ ​the​ ​server? ● Follow​ ​the​ ​HTTP​ ​Stream

○ What​ ​is​ ​the​ ​title​ ​of​ ​the​ ​page​ ​that​ ​was​ ​visited? ● Why​ ​doesn't​ ​this​ ​capture​ ​have​ ​any​ ​ARP​ ​Packets?

Task​ ​4: This​ ​is​ ​a​ ​capture​ ​of​ ​a​ ​telnet​ ​communication​ ​to​ ​a​ ​server Instructions

● Open​ ​the​ ​telnet-raw.pcap​ ​into​ ​wireshark ● Filter​ ​on​ ​telnet ● Follow​ ​the​ ​TCP​ ​stream

Analysis

● What​ ​is​ ​the​ ​login​ ​username? ● What​ ​is​ ​the​ ​password? ● What​ ​Warning​ ​was​ ​issued? ● What​ ​OS​ ​is​ ​the​ ​server? ● When​ ​was​ ​the​ ​last​ ​login? ● What​ ​site​ ​was​ ​pinged? ● How​ ​many​ ​packets​ ​were​ ​transmitted​ ​in​ ​the​ ​ping?