Forensic Investigation Tools
Wireshark Tutorial
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
- Introduction to Wireshark
- Windows Command Line
- Filtering traffic using wireshark
- Display Filters in wireshark
- A bit of name resolution
- Hex values for understanding traffic
wireshark introduction
Wireshark is a popular open-source network protocol analyzer used for network troubleshooting, analysis, software and communications protocol development, and education. It allows users to capture and examine the data traveling back and forth on a computer network in real-time. Originally known as Ethereal, Wireshark is available for various operating systems, including Windows, macOS, and Linux.
It is available as a wireshark portable or installer. On Kali, Linux, it should be already installed but you can download wireshark on this link Download Wireshark. Get the installer and install it normally just like any other program or download wireshark portable and just run it on your OS. If you want to capture packets through a USB port, make sure to install the USBPcap as well.
How to use wireshark
Capture Traffic Using Wireshark GUI
Start wireshark from your menu in your OS. There are a number of interfaces that we can listen on. I will be using the wireless interface to capture data. So I clicked on it and then clicked on the "capture" button to start capturing traffic. You should be able to see at least some of the following;
- Wi-Fi - For wireless interfaces
- loopback adapter - for localhost traffic
- Local Area Connection X - For ethernet connections.
- bridge - for a network bridge
- bluetooth
- and many more, some of which could be virtual.
For this tutorial, am capturing traffic coming through my wireless interface so I selected the Wi-Fi option since that is where I am connected.
Something that most people are using is the delta time column. We shall add the coloumn to our window by clicking on Edit->Preferences->Columns. Once on columns, click the "+" button and name it to "Delta". You should also change the type to "Delta Time Displayed". Drag the new "Delta" column just underneath the Time column. This will enable us to view the difference in time between packets which might be useful in forensic investigations.
For forensic analysis, we might also want to know the specific time that the packets were captured not just the difference between packets, so we will also change the time column to be using a UTC format. This will help us know exactly when packets were captured which can correlate with perhaps when an intrusion occured.
To stop capturing, you can click on the RED button on the top left that says stop capturing.
Adding command line tools of wireshark in a Windows OS
We will also show how to capture with the command line and using dumpcap. If you are on windows, you might have to add the command line tools to the environment variables. Since I installed the x64 version, I can find the command line tools in "C:\Program Files\Wireshark" but a 32bit installation should be in"C:\Program Files (x86)\Wireshark". Click on your start menu and search for "environment variables". Click on the result and then go to "environment variables"Click on Path->New->Browse. Navigate to the installation directory of your wireshark depending on whether it is 32bit or 64bit. You can click OK on all the windows to save the entry. You might have to restart for changes to take effect. Kali Linux machines should already be able to use the command line utilities.
After restarting your system go to the command line and type the following command
dumpcap -D
This will list the interfaces that are available on your machine.
To select an interface, pick the interface number. For example, my Wi-Fi interface is on number 4 so I can select it like this;
dumpcap -i 4
This should start capturing and should be able to show you that it is recieving packets. For now, we will close this by using Control+C.
We can also choose where to save the captured traffic on our machine. In this case I will choose my Documents folder for this user account.
dumpcap -i 4 -w /users/sweshi/Documents/wifi.pcapng
You can replace the directory with your own. If you navigate to your directory, you will be able to see the capture packet. Control + C to stop the capture.
We can use ring buffers to limit the file sizes for each packet we capture. This can limit how much traffic is captured per packet which is useful if the system is capturing traffic for a very long time. \ For this example, we will limit the sizes to only 80kilobyte sizes using the "filesize:80".
dumpcap -i 4 -w /users/sweshi/Documents/wifi.pcapng -b filesize:80
This is an extremely small size so it will be splitting the pcap files by 80 KBs. You will see that there will be a PCAP files of 80KB in the directory you are saving the capture. In practice, you are more likely to make a size that is much larger such as 250MB or even much more.
We can also limit how many PCAP files it should generate such that if we say 5 PCAP files as the total and we exhaust the 5 files, it can begin to overwrite the PCAPs you captured in the first instance. The "files:5" options will make sure that our directory only has 5 PCAP files at the most.
dumpcap -i 4 -w /users/sweshi/Documents/wifi.pcapng -b filesize:80 files:5
How to filter packets using Wireshark
Capture Filters in Wireshark
We can filter based on display or capture. Capture filters limit what type of packets we recieve such as limiting Wireshark to only capture IPv6 traffic or DNS traffic. Display filters work on captured traffic. They can be used to limit what we want to see from all of the captured traffic. It is not recommended to be very specific with capture filters simply because you can miss some things when trying to displaying them.
We can limit Wireshark to only capture certain packets using the fllowing syntax on the opening window. For most of these filters, you will get suggestions on how to complete them.
tcp
Display filter
Delete any capture filters on the opening window and start capturing on your selected interface. There are a number of display filters that can allow us to view certain things more clearly and remove any other distractions. If you have started capturing, try the following filters. In the window that is showing you the captured packets, insert the filters in the area highlighted with the red arrow. you can press enter when you insert a filter and you can press the "X" button at the end of the filter bar to clear the filter.
A bit of Name Resolution in wireshark
Name resolution can help us with how we view the information from the captured packets. The first thing we will do is enable transport protocol name resolution. This will enable most of the well known ports to be labelled with their service names. Go to edit->preferences->Name Resolution.
You might want to also resolve the IP addresses to the domain names for the IP addresses in the captured file. In that case check the next option as shown in the figure.
Examples of resolved IP addresses on the source and destination as well as resolved network services such as HTTP for port 80.
Click on one packet, prefereably on one with an application layer protocol such as HTTP traffice. The bottom section of the shows the content starting from the link layer up the network layer, the transport layer and even application layer protocols such as HTTP, DHCP and more. From this view you can open one lets say IPv4 and see the contents of the IP packet. You are also able to view the hex values on the right side which could come in handy for steganalysis. If traffic is not encrypted, this is where you would see content that the user or server sent.
Viewing unencrypted data with wireshark
if the traffic is sent using unencrypted channels, this can be very dangerous as someone sniffing traffic could see the content of the packets. To demonstrate this, go to any website that uses http rather than https. It is difficult to come across these today so I am testing using my webserver in my network. The concept can be used on any protocol that does not have encryption such as FTP, Telnet, SMTP and many more. Here I test using HTTP.
I started captruing on my interface and then went to my local web server and accessed a web page. This local web server does not have HTTPS configured so it is plain HTTP used and that is the vulnerability we shall use. I went to the login page as shown in the figure. I typed some email address and password combination.
I then went to wireshark and filted based on the password being the name of the item in the packed. So I used the following filter
frame contains "password"
I chose password because I know the HTML document probably named the password field with password and the email field with email. So the Get variable is likely to be named as such. Instead of searching for a get variable, you can also search for actual text that could be in the packet. From my results, I was able to see the login.php form and I clicked on it and went below to view the contents.
I went to the bottom of the packet just under Hypertext Transfer Protocol and opened the HTML Form URL Encoded and saw the form items as shown in the figure below. Other protocols might have different names for the actual protocol content but it will most likely be at the bottom of every other protocol. Try finding data in other protocols that use plain text.
Using statistics in wireshark
Statistics can help to show activity on the network that could be considered unusual. It could help know if there are some vulnerabilities or if there is even an attack or leakage of data. I encourage you to view a lot of statitics in your network analysis. Here, I will show a few of my favourites.
Protocol hierarchy : How wireshark can help us spot unencrypted traffic
Click on Statistics->Protocol Hierarchy.
This can be used to see what protocols have been used and to what degree. Importantly for network security, we can see if there is any "data" as shown at the bottom of the figure above. Data in this sense means the actual content of packets.We can be interested in investigating this because it can leak information. If traffic is encrypted, you wont be able to see the actual content in the "Data" but for unencrypted protocols, you will.
Conversations : How wireshark can help us with network forensics
Click on Statistics->Conversations
This can help us spot the nature of communcation between different hosts using IP address, port numbers and mac addresses. For example, we can see that we are under a DOS attack from a single machine by checking the IP addresses communicating, looking at the machines sending a lot of traffic to our IP address in a short space of time. We can combine the Address sections, the packets sections and the duration. If we are analysing this after the attack, this would clearly show who was attacking us. Multiple IP addresses could be involved in the case of a DDOS attack.
We can also use the TCP or UDP tabs to see if there is a port scan by check which IP addresses are sending traffic on many ports. We can tell if they are trying to do host discovery by seeing IP addresses that attempt to communicate with every machine in our network.
IO Graph : Visualising data
Click on Statistics->IO Graph
The IO Graph can visualise our data. You can click on the + button to add a new graph to the existing ones. You can use the same display filters to get specific traffic. In this case I inserted "http" and put a "50 SMA" to smooth the data for HTTP and for all packets. This can help me compare the amount of HTTP traffic in relation to everything else.
Extracting Files from captured network traffic in Wireshark
Network Security professionals are also likely to capture data and in the case of unencrypted traffic, might want to extract the file from the data or in the case of encrypted traffic, might want to captured the ciphertext. Wireshark supports saving some standard file types. You can first start by filtering the data as close to the actual data as possible. In this case I am using http to get HTTP data so that I see if I can get HTML files to rebuild. Click on File->Export Objects->HTTP. The export objects section has a few options and I choose HTTP because of the nature of my data.
From the window that opens, I search for PNG in hopes of finding a picture. Because I am searching from an unencrypted capture, this is easy to find. I click on one picture and go to save as. I then save the picture to my preferred directory. You could try searching for txt, html, pdf and anything that you think could have been captured.
In the case that we dont actually know what we are looking at, we can also follow TCP streams. Look for protocol communication that can indicate file transfers. In my case with an http display filter, I know that GET and POST requests have some data so I right click and say "Follow TCP Stream".
The HTML page is shown. This is shown in ASCII but if you dont know what you are looking for, you can convert to a hex dump and see if you can recognise the file. You can use the starting hex values to determine the file type such as the following;
| File Type | Hex Code |
|---|---|
| JPEG (Joint Photographic Experts Group) | FF D8 FF |
| PNG (Portable Network Graphics) | 89 50 4E 47 0D 0A 1A 0A |
| GIF (Graphics Interchange Format) | 47 49 46 38 |
| PDF (Portable Document Format) | 25 50 44 46 |
| ZIP (Compressed Archive) | 50 4B 03 04 |
| MP3 (MPEG Audio Layer III) | FF FB |
| MP4 (MPEG-4 Part 14) | 66 74 79 70 |
| EXE (Executable File) | 4D 5A |
| DOCX (Microsoft Word Document) | 50 4B 03 04 |
| XLSX (Microsoft Excel Spreadsheet) | 50 4B 03 04 |
| AVI (Audio Video Interleave) | 52 49 46 46 |
| WAV (Waveform Audio File Format) | 52 49 46 46 |
| MPG (MPEG Video) | 00 00 01 B3 |
| TXT (Plain Text) | No specific hex code (varies based on encoding) |
You can simply search for the hex value you get and see the file type. Then you can save the file using the appropriate extension.
Just by looking at the ASCII values I could see the HTML code and so I saw the HTML page and saved it as such.