As we begin our dive into passively scanning our network,
we need to keep in mind what our network actually looks like.
Now, this can be done in the reconnaissance phase
of our Pintesting lifecycle.
But to get a little bit further, we
need to be able to passively monitor this network.
Now, we've done a skill previously in PIN 103,
to which I have a link below.
And also, the demo file that I built out in Packet Tracer
below as well, too, just in case you
want to stay in this course.
But I would definitely encourage you
to check out the Monitoring with Cali skill,
and also the entirety of the PIN 103 course.
What we're going to be doing is taking a look inside of our lab
environment to get an idea of our actual setup,
and if we can.
But if we can set up passive network monitoring
for those different network segments.
So let's take a look at one method of being able to do this.
Now, as you can see here, what I'm taking a look at
is our actual virtual lab.
Remember that the background is going to be a little bit
different because I'm using Remote Desktop,
and I haven't published this lab yet.
So I have Cali open already, but I also
want to slip on over and show you the Hyper-V virtual manager
that's running all the virtual machines in the background.
Now, this is key because this is going to mimic our ability
to passively monitor the network as we did in that monitoring
with Cali skill.
Now, for this, if you're in that Hyper-V environment,
you would definitely want to take a look at right-clicking
on one of your systems, for instance.
Not the Cali box.
We'll come back to that in a second.
And if you go into Settings, to which I am clicking on now,
and then I'm going to enable my Zoom-It,
you could see here that I have the settings pulled up
for our OomBoon2 Desktop.
Now, I have the network adapter selected,
and you'll notice that there is an advanced feature options
right below that network adapter.
I'm going to select it and then scroll down a little bit
to what I'm talking about so that way we can do the Zoom-It
again.
And you'll notice that there's an option in there for Port
Mirroring.
Now, you'll notice that there is a marine mode dropdown.
And I'm going to show you the options as we explained
why we selected a source in this particular option.
There we go.
First of all, there's none.
So what this does is it leaves the network adapter alone,
does not copy or send traffic to that interface.
And you'll notice that I have source selected.
Well, what it's going to do is use this network interface
on that virtual machine as a selected source.
So it's going to start copying all that traffic.
And the destination is the interface
that we're going to configure here in just a second
to be able to send all that traffic to.
Now, I have the OomBoon2 and the Windows system
in this lab environment set up for source
on that one network adapter configured for them.
And if I go on over to the Kelly box,
go to me close this and select Kelly here for a second
and go to Settings.
Where is it?
I can find it.
There it is.
You'll notice that I have two network adapters.
Now, you don't necessarily need two,
but I did it in this particular instance
to be able to split and identify what traffic is coming from where.
If we go to network adapter one and expand it
and go into advanced options,
you'll notice that I have a destination set up.
And the second adapter, if I go into advanced features,
I have a destination set up.
So I need to fix that because the reason is
is because one adapter is going to be able to reach out
for our network activity for everyday traffic,
being able to get updates, going through it,
downloading tools, whatever the case may be.
But the second adapter is going to be the receiver
of all that traffic that's being sourced
from the other virtual machines.
And we don't want to be able to cross those together
because we may get misinterpreted findings.
So what I'm going to do is select the first network adapter
and I'm going to memorize off screen.
The MAC address for this,
because that's going to be the one that has my IP address
and the other one is going to have no IP address
and be set up into destination mode within Hyper-V Manager.
So let me select the second NIC that ends in 0408
and change that to make sure this destination
and change the first one to nine.
Now I'm going to make sure it didn't change the second one
for whatever reason, click okay
and hop on over to my CaliBox, which is here.
Now as we go into Cali, I can right click
and go into Open Terminal here and do an IF config
to show us all of our interfaces.
Now I'm going to pop out and zoom in real quick
and show us what we're talking about here.
Right here, we need to make sure that ETH 00406
is set up as the source in ETH 1,
which has the IP address for everyday traffic,
is set up as none.
Because if we monitor on our wire shark
or whatever tool that we use to pick up all that coffee
to traffic from network monitoring,
it's going to blend in that regular IP traffic
if we don't set it up correctly.
So our IP address is 0.53 on ETH 1
and the 0408 is actually ETH 1, so I had them backwards.
So let me go ahead and go into my Hyper-V,
go back into Settings and reverse that.
There is, if I expand and go into Advanced Features 0408,
I'm going to change that to none,
go into the other network adapter 0406
and change that to Destination.
Now I showed you the mistakes on purpose
because this happens a lot by simply overlooking
and I don't want you to make the same mistakes
that I make or any of those other common mistakes.
So now if we go back into our Kali box,
we can see that the ethernet adapters
don't really need anything changed on them.
So what's next?
Well, we know that packets are going to go
to the ethernet interface that they're addressed to,
either through layer one, two or three.
And if the addressing is not correct,
generally the ethernet adapter,
we'll drop that packet unless we have promiscuous mode enabled.
And ETH zero is going to be our promiscuous listener
for all that destination sourced traffic
that we're copying through our Hyper-V setup.
So let's go ahead and go into pseudo IF config-A
to identify the actual interface ETH zero
and do a promisc.
And it's going to ask for our password and that's Kali.
Now if I do an IF config again,
I can scroll up and see and I'm going to highlight it
and then zoom in for you,
that promisc has been enabled on ETH zero.
Now, if we did this correctly, which we did for this lab,
we're going to pop out and open up our wire shark
inside of Kali.
And we're using wire shark to provide us a graphical
representation of what's actually going on.
Later on, we're going to be introducing tools like a TCP dump.
So that way we can use less overhead.
Now remember, ETH zero is our promisc
and no IP address assigned to it.
And it's receiving as destination all the copy traffic
through our Hyper-V manager setup
from the windows in Ubuntu.
ETH one is our regular internet traffic.
And if we go double click on ETH zero,
we can see that it's already starting to receive packets
from network addressing and overall subnet mask addressing
as well.
So I'm going to move this over to the left.
I'm going to open up my Windows virtual machine,
move this over to the right.
And I'm going to start doing just a little bit of traffic
on here.
I'm going to open up edge real quick.
And just by simply opening up edge,
you can see that we're recovering a lot of traffic
from that Windows system.
Now you may be wondering how do I know it's that Windows system?
I'm glad you asked.
We can identify this real quick.
So let me go ahead and move this over real quick,
close out or just minimize edge for a second
and open up a command prompt to give us an IP config.
And we can see that our IP address is 192.168.0.51.
So let's hop on over to our Kali box
and stop our actual wire shark here real quick
and notice that one of the sources that we have
as I zoom in for you is 192.168.0.51.
Now we know that this is the Windows box.
We just verified the IP address for it
and we can verify that our promiscuous mode is working.
We've configured the interface,
configured the Hyper-V network
and have started picking up traffic
by promiscuously listening passively to that network.
This ties into the PEND 103 course that I linked below
because this allows us to be able to go through
and configure not only in this Hyper-V setup,
but maybe some other network that we have at home
or whatever we're pen testing on with proper permission.