Table Of ContentTable of Contents
Cover
Title Page
Introduction
Overview of the Book and Technology
How This Book Is Organized
Who Should Read This Book
Tools You Will Need
What’s on the Website
Summary
Chapter 1: Introducing Wireshark
What Is Wireshark?
The Wireshark User Interface
Filters
Summary
Exercises
Chapter 2: Setting Up the Lab
Kali Linux
Virtualization
VirtualBox
The W4SP Lab
Summary
Exercises
Chapter 3: The Fundamentals
Networking
Security
Packet and Protocol Analysis
Summary
Exercises
Chapter 4: Capturing Packets
Sniffing
Dealing with the Network
Loading and Saving Capture Files
Dissectors
Viewing Someone Else’s Captures
Summary
Exercises
Chapter 5: Diagnosing Attacks
Attack Type: Man-in-the-Middle
Attack Type: Denial of Service
Attack Type: Advanced Persistent Threat
Summary
Exercises
Chapter 6: Offensive Wireshark
Attack Methodology
Reconnaissance Using Wireshark
Evading IPS/IDS
Exploitation
Remote Capture over SSH
Summary
Exercises
Chapter 7: Decrypting TLS, Capturing USB, Keyloggers, and Network
Graphing
Decrypting SSL/TLS
USB and Wireshark
Graphing the Network
Summary
Exercises
Chapter 8: Scripting with Lua
Why Lua?
Scripting Basics
Setup
Tools
Creating Dissectors for Wireshark
Extending Wireshark
Summary
End User License Agreement
List of Illustrations
Chapter 1: Introducing Wireshark
Figure 1-1: The Wireshark home screen
Figure 1-2: The Packet List pane
Figure 1-3: The Packet Details pane
Figure 1-4: Field information in the status bar
Figure 1-5: ARP packet Opcode
Figure 1-6: Filter results of ARP from a source address
Figure 1-7: Complex display filter example
Chapter 2: Setting Up the Lab
Figure 2-1: Getting SHA-256 file hash in PowerShell
Figure 2-2: VirtualBox SHA-256 checksums
Figure 2-3: VirtualBox installation window
Figure 2-4: VirtualBox feature selection
Figure 2-5: VirtualBox shortcut creation
Figure 2-6: VirtualBox networking warning
Figure 2-7: VirtualBox installation window
Figure 2-8: VirtualBox installation status
Figure 2-9: VirtualBox driver installation prompt
Figure 2-10: VirtualBox installation finished
Figure 2-11: VirtualBox GUI and restart window
Figure 2-12: VirtualBox Extension Pack download
Figure 2-13: VirtualBox Extension Pack preferences
Figure 2-14: VirtualBox Extension Pack installation
Figure 2-15: Successful VirtualBox Extension Pack installation
Figure 2-16: Kali download web page
Figure 2-17: Creating a new virtual machine
Figure 2-18: Selecting virtual machine memory
Figure 2-19: Creating virtual disk
Figure 2-20: Selecting virtual disk type
Figure 2-21: Storage on physical disk
Figure 2-22: Virtual disk size
Figure 2-23: Enabling PAE
Figure 2-24: Selecting start-up disk
Figure 2-25: Kali boot menu
Figure 2-26: Possible temporary error
Figure 2-27: Entering a hostname
Figure 2-28: Skipping the domain
Figure 2-29: Entering a root password
Figure 2-30: Partitioning the disk
Figure 2-31: Confirming the disk
Figure 2-32: Confirming a single partition
Figure 2-33: Writing changes to the disk
Figure 2-34: Confirming disk changes
Figure 2-35: The installation progress bar
Figure 2-36: The option for a network mirror
Figure 2-37: Network connection proxy
Figure 2-38: GRUB boot loader
Figure 2-39: Installation is complete
Figure 2-40: System settings
Figure 2-41: New user w4sp-lab
Figure 2-42: Firefox to GitHub
Figure 2-43: Saving the W4SP Lab file
Figure 2-44: Opening Terminal
Figure 2-45: Unzipping the W4SP Lab
Figure 2-46: Running the W4SP Lab installation script
Figure 2-47: Running the W4SP Lab setup
Figure 2-48: The full W4SP Lab network
Chapter 3: The Fundamentals
Figure 3-1: OSI layers in Wireshark
Figure 3-2: VirtualBox networking options
Figure 3-3: Malware signature code
Figure 3-4: Small Incoming Layer 2 frame
Figure 3-5: Smaller outgoing Layer 2 frame
Figure 3-6: Gratuitous ARP
Figure 3-7: TCP’s 3-way handshake
Chapter 4: Capturing Packets
Figure 4-1: The Capture interfaces list
Figure 4-2: Superuser warning
Figure 4-3: New traffic
Figure 4-4: Renaming a network interface
Figure 4-5: Sample localhost ICMP traffic
Figure 4-6: Installing the loopback adapter on Windows
Figure 4-7: RawCap loopback sniffing
Figure 4-8: RawCap pcap in Wireshark
Figure 4-9: VirtualBox bridging
Figure 4-10: Wireshark sniffing bridged network
Figure 4-11: Capturing packets with a hub
Figure 4-12: Traffic when sniffing on a hub
Figure 4-13: SPAN sniffing connections
Figure 4-14: Throwing star LAN tap
Figure 4-15: Traffic flow when sniffing a Linux bridge
Figure 4-16: Raw wireless packets in Wireshark
Figure 4-17: The File Save dialog box
Figure 4-18: Properties of a capture file
Figure 4-19: Multiple file settings
Figure 4-20: Stop capture options
Figure 4-21: Setting multiple files and ring buffer
Figure 4-22: Resultant ring buffer files
Figure 4-23: Mergecap verbose
Figure 4-24: Mergecap complete
Figure 4-25: Clearing recent files
Figure 4-26: Changing the number of recent files shown
Figure 4-27: Wireshark’s Decode As window
Figure 4-28: Wireshark’s Decode As window
Figure 4-29: Packet list filtering for SMB
Figure 4-30: SMB packets referencing a file
Figure 4-31: Packet list filtered for NT Create calls
Figure 4-32: Adjusting packet colors
Figure 4-33: Colorizing conversations
Chapter 5: Diagnosing Attacks
Figure 5-1: Man-in-the-middle position
Figure 5-2: Ping and ARP transaction
Figure 5-3: W4SP Lab network
Figure 5-4: W4SP’s vic1
Figure 5-5: LOCALSIP
Figure 5-6: Exploit in progress
Figure 5-7: ARP packets fly
Figure 5-8: FTP credentials to attacker
Figure 5-9: Expert information
Figure 5-10: Noting your IP address
Figure 5-11: DHCP module options
Figure 5-12: DHCP running
Figure 5-13: DNS settings done
Figure 5-14: DNS queries
Figure 5-15: Quieter fake DNS
Figure 5-16: FTP capturing
Figure 5-17: Mirai password list
Figure 5-18: Pingbed
Figure 5-19: Gh0st
Figure 5-20: Xinmic
Figure 5-21: Malware analysis practice
Chapter 6: Offensive Wireshark
Figure 6-1: W4SP Lab network
Figure 6-2: Nmap port scan
Figure 6-3: Nmap port scan in Wireshark
Figure 6-4: Open port in Wireshark
Figure 6-5: Metasploitable and its IP
Figure 6-6: Searching for the VSFTPD exploit
Figure 6-7: Exploit success but no shell
Figure 6-8: Exploit attempt in Wireshark
Figure 6-9: Exploit success with shell
Figure 6-10: Root shell command WHOAMI
Figure 6-11: Root in packet bytes
Figure 6-12: Metasploit RMI data
Figure 6-13: Metasploit HTTP JAR data
Figure 6-14: Metasploit hex dump
Figure 6-15: Unanswered SYNs
Figure 6-16: Filter for tcp/4444
Figure 6-17: Encrypted traffic
Figure 6-18: ELK
Figure 6-19: Time-field name
Figure 6-20: SSHdump install
Chapter 7: Decrypting TLS, Capturing USB, Keyloggers, and Network
Graphing
Figure 7-1: Browsing to ftp1.labs
Figure 7-2: Follow TCP stream on SSL/TLS traffic
Figure 7-3: Wireshark SSL/TLS protocol options
Figure 7-4: Setting up SSL/TLS decryption
Figure 7-5: Decrypting TLS traffic in Wireshark
Figure 7-6: Adding SSLKEYLOGFILE
Figure 7-7: Decrypted SSL/TLS data
Figure 7-8: USB device overview
Figure 7-9: usbmon interfaces
Figure 7-10: Connecting USB device to Kali VM
Figure 7-11: Wireshark usbmon error
Figure 7-12: Capturing on usbmon2
Figure 7-13: USBPcap device list
Figure 7-14: USBPcap running a capture
Figure 7-15: Filtering USB traffic to host
Figure 7-16: HID key codes
Figure 7-17: TShark key sniffer
Figure 7-18: TShark-generated network graph
Chapter 8: Scripting with Lua
Figure 8-1: Lua Interactive Interpreter
Figure 8-2: Wireshark About page
Figure 8-3: Lua in Tools menu
Figure 8-4: Lua Console in Wireshark
Figure 8-5: Wireshark Evaluate Lua
Figure 8-6: Wireshark without a dissector
Figure 8-7: Our protocol fields
Figure 8-8: Sample protocol hexdump
Figure 8-9: Tree items in Wireshark
Figure 8-10: Running direction script
Figure 8-11: Finding a suspicious packet
List of Tables
Chapter 1: Introducing Wireshark
Table 1-1: Comparison Operators
Table 1-2: Logical Operators
Chapter 4: Capturing Packets
Table 4-1: Common Wireshark Capture File Formats
