Network Packet Analysis

Network Packet Analysis

Ahmad Muammar W.K. OSCP

Technical Workshop (21 Desember 2012)

Tuesday, January 22, 13

Agenda

• Play with Captured Network File

• Wireshark Feature

• Packet Analysis Case Study

• Another Packet Analysis Tools

• Create Wireshark Dissector

Network Packet Analysis - Ahmad Muammar W.K. OSCPTuesday, January 22, 13

• Analyze fileds within protocols

• Analyze Protocols within packets

• Analyze Packets within streams

• Reconstruct higher-layer protocols

Packet Analysis


Wireshark StatisticsUsefull Feature for Analysis


• Show Information About Data Capture

• Contain: File Information, Time package captured, Capture Information, Display Filter used, Traffic Summary, show Captured, Displayed (if display filter is set) and Marked.

Summary


• Display a hierarchical tree of protocol statistics

• Tree of all protocols captured, able to expand and collapse the subtree.

• We are able to get info about what is the most protocol in a network captured file and will be our hint.

Protocol Hierarchy


• Display a list of conversations (traffic between two endpoints)

• Support: Protocol Specific Windows, Name Resolution and Limit to Display Filter

Conversations


• Display user specified graphs (e.g number of pakets in the course of time)

• Support: 5 differently colored graphs base on Display filter.

IO Graphs


Wireshark CASE FILE : SATU


Wireshark CASE FILE : DUA


Use Wireshark Analysisplease :)


Network Packet Analysis - Ahmad Muammar W.K. OSCPNetwork Packet Analysis - Ahmad Muammar W.K. OSCPTuesday, January 22, 13

Let the packet tell the truths

Network Packet Analysis - Ahmad Muammar W.K. OSCP

CASE FILE : TIGAReference: Practical Packet Analysis

http://chrissanders.org/captures/aurora.pcap




Summary

• Victims received a targeted email from the attacker that appears to be legitimate, clicks a link within it, and sends a GET request to the attacke’s malicious site.

• The attacker’s web server issues 302 redirection to the victim, and the victim’s browser issues a GET request to the redirected URL.

Network Packet Analysis - Ahmad Muammar W.K. OSCPhttp://chrissanders.org/captures/aurora.pcap




Summary

• The Attacker’s Web Server transmits a web page containing obfuscated JavaScript code to the client that includes a vulnerability exploit and an iframe containing a link to a malicious GIF Image

• The victim issues a GET Requests for the malicious image and downloads it from server





Summary

• The javascript code transmitted earlier is deobfuscated using the malicious GIF, and the code executes on the victim’s machine, exploiting a vulnerability in Internet Explorer

• Once it exploited, the payload hidden within the obfuscated code is executed, opening a new session from the victim to the attacker on port 4321





Summary

• A command Shell is spawned from the payload and shoveled back to the attacker.

• And its called “Operation Aurora”.





Another toolsfor packet analysis


XPLICO

• Xplico is an open source Network Forensic Analysis Tool (NFAT).

• Extract from an internet traffic capture the applications data contained. From a pcap file to extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, etc.

• xplico.org


Network Miner

• NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows (but also works in Linux / Mac OS X / FreeBSD)

• NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc

• netresec.com


PCAP Sample

• http://wiki.wireshark.org/SampleCaptures


http://wiki.wireshark.org/SampleCaptures

http://wiki.wireshark.org/SampleCaptures

Packet AnalysisCreating Own Wireshark Dissector for Own/Others

protocol


Wireshark Dissector

• Allow Wireshark to automatically break down into various section so that it can be analyzed

• Translator, decoder

• Not work for non-standard/default port.

• Creating With LUA


LUA

• "Lua" (pronounced LOO-ah) means "Moon" in Portuguese

• Lua is a powerful, fast, lightweight, embeddable scripting language.

• Lua combines simple procedural syntax with powerful data description constructs based on associative arrays and extensible semantics


Download LUA

• LUA for Windows

• http://luaforwindows.luaforge.net/

• Install LUA


http://luaforwindows.luaforge.net

http://luaforwindows.luaforge.net

Simple LUA

• code it:

• echo “print("Hello World")” > hello.lua

• run it:

• prompt> lua hello.lua


Wireshark + LUACheck support and compatibility


Reference

• Lua Support In Wireshark - http://www.wireshark.org/docs/wsug_html_chunked/wsluarm.html

• http://wiki.wireshark.org/Lua


http://www.wireshark.org/docs/wsug_html_chunked/wsluarm.html






http://wiki.wireshark.org/Lua




Network Packet Analysis

Ahmad Muammar W.K. OSCP

Technical Workshop (21 Desember 2012)


Network Packet Analysis

Technology

Transcript of Network Packet Analysis