Original subtitles

1 1

Now in this lecture, 2

2

I wanna show you how to use Wireshark 3

3

to discover data sent through forms, 4

4

whenever someone fills up a form. 5

5

And obviously, this will allow us 6

6

to get usernames and passwords 7

7

if people log in to their accounts. 8

8

So, I'm already running BetterCAP, 9

9

so I'm already the man in the middle. 10

10

And in Wireshark here, I'm just gonna start a new capture. 11

11

So I'm gonna continue without saving this one. 12

12

The filter is already set to HTTP 13

13

so it's only gonna show me HTTP packets in here. 14

14

And I'm gonna go to a target website in here, 15

15

so let's go to vulnweb.com. 16

16

Now keep in mind, like I said, 17

17

you have to be loggin' in to a HTTP page, 18

18

but that's fine because we already learned 19

19

how to bypass HTTPS, and even partially bypass HSTS. 20

20

So, I'm gonna be logging into a website 21

21

that just uses HTTP here, because it's just simpler, 22

22

and we've already learned how to bypass HTTPS and HSTS, 23

23

so there's no point of repeating that. 24

24

We're logging in with a username that is set to admin. 25

25

I'm gonna get the password to 123abc. 26

26

I'm gonna click on Login, 27

27

and this should have been captured by Wireshark. 28

28

Now let's go ahead and actually try this 29

29

with a website that uses HTTPS. 30

30

So let's go to stackoverflow.com. 31

31

Again, as you can see, 32

32

as long as the website gets downgraded to normal HTTP, 33

33

then we'll be able to capture the data sent 34

34

to and from this website. 35

35

So, we're just going to log in. 36

36

Put the username, we'll put it to zaid@zedsecurity.org, 37

37

and then we're gonna put the password. 38

38

So we'll just do 123123abc. 39

39

And let's go back to Wireshark, 40

40

and see how we can discover the username and the password. 41

41

So first of all, I'm gonna stop the capture. 42

42

And what we wanna look for is POST requests. 43

43

So you see in here this request right here was POST, 44

44

for example, and here it was GET. 45

45

Now forms are usually sent over POST, 46

46

especially login forms. 47

47

So if you're looking for login information, 48

48

you wanna look for POST in here. 49

49

So, going down we can see we have a POST request in here. 50

50

Now I'm gonna click here to actually show less information, 51

51

so it's easier for us to see. 52

52

So we can see this POST was sent to Google. 53

53

We're not interested in that, 54

54

we're looking for stuff that was sent to Vulnweb. 55

55

So I'm gonna keep going. 56

56

We can see we have a POST request here 57

57

to a login page, so this is definitely interesting. 58

58

Now, if we look down, let me just make this smaller. 59

59

So if we look down here, and look at the HTML form data, 60

60

you can see that we have a username here, 61

61

submitted to testhtml5.vulnweb.com. 62

62

The username is admin, and the password is 123abc. 63

63

Now if we scroll down again looking for POST requests, 64

64

you can see we have a POST request 65

65

for a page called users login. 66

66

So again, very, very interesting. 67

67

If we click on this, you'll see, if we scroll down, 68

68

you'll see we have the email, zaid@zedsecurity.org, 69

69

and the password 123123abc. 70

70

Again, this just goes to show you 71

71

that with Wireshark, you'll be able to capture everything. 72

72

Now this can actually be very, very useful, 73

73

because I noticed that BetterCAP is great 74

74

at sniffin' passwords. 75

75

And it pretty much gets you the passwords all the time, 76

76

but in the odd cases, sometimes it was failing 77

77

to filter the username and the password for me. 78

78

So, with Wireshark you'll actually be able to get everything 79

79

that passes through your interface. 80

80

So what you could actually do is you can just go 81

81

to your caplet that we always use, the spoof caplet. 82

82

This one right here. 83

83

Open it with the Text Editor. 84

84

And as you know, in this caplet, 85

85

we turn on our sniffer in here, 86

86

so we set the sniff.local to true, 87

87

and then we turn it on. 88

88

But before turning it on, 89

89

you can actually set the net.sniff.output 90

90

to a location for a file that'll contain everything 91

91

that BetterCAP captures. 92

92

So you won't actually have to start Wireshark 93

93

while BetterCAP is working. 94

94

You can just, in here, specify a place. 95

95

So for example, let's say root/capturefile.cap. 96

96

And then, when you run your spoof caplet, 97

97

it'll turn on the probe, turn on the recon, 98

98

run your spoofing attack, 99

99

putting you in the middle of the connection. 100

100

It'll run the sniffer as well, 101

101

and it'll store everything that BetterCAP captures 102

102

in a capture file. 103

103

Then, all you'll have to do is come here, 104

104

go to File, Open, and open the file that you captured, 105

105

and analyze it, as I'm doing right now. 106

106

So this can be very, very useful also 107

107

if you don't have a lot of resources on your computer, 108

108

or if you have a small laptop, or even a phone. 109

109

And you capture data with it, 110

110

store everything in a capture file, 111

111

and then just open it in here in Wireshark and analyze it. 112

112

Now finally, before I finish this lecture, 113

113

because all we're talkin' about right now is filtering data, 114

114

a really, really useful feature when filtering data 115

115

is the Ctrl+F feature, the Find. 116

116

So you can just press Ctrl+F from your keyboard, 117

117

this'll open this bar right here, this search bar, 118

118

which you can use to find anything 119

119

within the captured packets. 120

120

So, first of all, I'm gonna set the search 121

121

to search within the packet details. 122

122

I'm gonna keep this to Narrow & Wide. 123

123

In here, I'm gonna set this to Strings, 124

124

so that it looks for normal text. 125

125

And for example, let's say I'm looking for logins 126

126

that a person named Zaid has attempted, 127

127

all I have to do is just type Zaid. 128

128

And if I hit Enter. 129

129

And as you can see, it's taken us to the login attempt 130

130

when I logged in to Stack Overflow. 131

131

Or let's say you're looking for login attempts 132

132

by a person named admin or for a user named admin. 133

133

Again, if I hit Enter, it's gonna take me to the first time 134

134

an occurrence of the word admin happened, 135

135

which is in here. 136

136

It doesn't really contain any useful information, 137

137

but I can just click on Find to find the next packet 138

138

that contained the word admin. 139

139

Again, this packet doesn't really contain anything useful. 140

140

We can go next. 141

141

We'll actually have to go to the end of the file and go up, 142

142

because that was the first thing that we logged in, 143

143

so I'm just gonna keep clicking on next. 144

144

And right here we have the POST request for the admin. 145

145

And if we go down again, as you can see, 146

146

we have the username as admin and the password as 123abc. 147

147

So this feature can be very, very useful 148

148

to help you find what you're looking for. 149

149

Whether you're looking for a specific login name. 150

150

Whether you're looking for a specific tag, 151

151

a specific file, and so on.