Now you may be asking yourself, what do we do with all of this traffic once we
've captured it and can even look at it inside of things like wire shark?
Well, I'm glad you asked because in this portion of the skill, we're going to
introduce ourselves to a tool called Surakata.
Now, Surakata does a lot of wonderful things and I have a blurb about it right
below this video along with a couple of different links that you'll be able to
go to and get a feel for as we start to explain in a cover.
What's all inside of this handy dandy package?
But essentially, think of Surakata as a way for us to be able to analyze PCAPs
in the form of, let's say, like an IDS or IPS would.
We can analyze it, we can parse it, we can cut it open, we can look at the
individual packets and we can parse out different pieces of information based
on different types of search criteria.
Now, without further ado, let's go ahead and jump on over to our lab here and
you'll notice the inside of the Kali box now that there is a folder on the
desktop called Surakata.
Now, I have below how to go ahead and install it, or excuse me, or I'll add
that here in just a second.
But Surakata is already pre-installed on this version of Kali, so if you want
to go back into the previous lab and practice it, it's pretty easy, a pseudo
apt install Surakata.
And when we take a look at different types of data points that we can use,
there's a lot of different commands.
Now, there are many different applications you can lay on top of Surakata,
where we're going to avoid those and just simply use JQ as our query method for
being able to parse through this information.
Inside of the folder, I have a PCAP here that I did behind the scenes for all
the different systems, along with a commands file, because there's a lot of
different commands that are going to be utilized and different ways to be able
to parse those commands.
Now, before we start going through and doing these different commands, let's
open up this PCAP and take a look at it inside of Wireshark.
You can see that we have thousands of different packets inside of this
different capture.
And this was done by using Kali as our destination for all of those session
monitors as the, the other ones that we're going to use.
As the, the Ubuntu and Windows and Mystery Box went through and conducted their
traffic. I did things like updates and the pings and websites and things like
that inside of this whole capture.
And instead of going through and doing different Wireshark filters to be able
to find different things, we can actually use some of these commands.
So let's go ahead and right click inside of this folder of Surakata and go to
Open Terminal here.
Now, first, I'm going to copy the very first command and just show you a, a
right here in this line one and line two. That's how to utilize Surakata for
the PCAP, which is part one of what we're doing here.
I'm glad I keep notes like this.
We have to have Surakata analyze the PCAP and examine what all's in it.
In order for us to do that, we have to take the PCAP and run it against the
actual program itself.
Now here you'll notice we're just doing a very basic Surakata dash R and the
name of the PCAP file.
Here in a little bit, we're going to be incorporating rules because there are
different yamels or rules out there that allow us to be able to further analyze
a PCAP.
Basically, under different lenses, this is just looking at it straight forward.
Different rules allow us to be able to go through and do different things as
far as like testing the traffic against a source, testing the traffic against a
known ID of some type.
Now, when we run this initially and press enter, it's going to ask us for our
pseudo password. We'll go ahead and type enter on that.
You'll see that Surakata is running in user mode.
Depending on when you take the skill, I'm using 7.0.10.
There may be newer ones out there later on.
If I hop on over to the folder, you'll see that it's starting to populate some
different files in here.
Now, there's the log which goes through and tells us it ran.
Let me see if that, yep, it completed.
It'll tell us how many packets it did and how many files it read through.
The log just basically tells us that there are any errors or not.
If we open up fast, now you'll get this error because it's a text document that
's pretty over two bags, so that's okay.
This is just the brief synopsis of each packet.
You'll see that there's a 2 and from and just standard basic information, tim
estamps, packet numbers, all that great stuff.
I'm going to close that for a second and I'm going to go and show you the e.
json.
If I double click on this, you'll notice that there's a bunch of different
information in here.
None of it really makes sense and that's where we're using JQ to be able to go
through and try those different commands out.
Like I said, we have JQ already opened up and I have some basic commands in
there for you.
I'm going to be running this against the e.json file inside the Suracotta
folder, which is also partly why we opened up a terminal in that folder.
The first one that I want to paste here is the JQ-R and that's our criteria
inside the quotation marks and then the e.json.
You'll notice I have a sort dash u on the end of it. That's for unique.
When I run this, you'll see that a list of IP addresses have come up.
That's because inside of our search criteria is I pop out and zoom in for you.
You'll see that we have select IP or select source IP and then pipe source IP
and then e.json is our file that we're looking at and sort by unique.
Now this isn't really any kind of order other than Miracle. That's why you have
like a 20.189 followed by 20.42. It's not in true numerical order.
It's basically sorted by the first number in the first octet.
You have all these different IP addresses and what this here is telling us is
that these are all the unique IPv4 addresses that have popped up in our passive
capture that was saved inside the PCAP file, be it through Wireshark or TCP
dump.
As you go through these different commands, you'll notice that I've sorted them
out based on adding to that base command, such as the next one showing all the
destination IP addresses. Our first one was the sources.
Right click and go ahead and paste selection in there and you can see those are
all our destination IP addresses. If you compare the two, they would be
different.
But what if you wanted to see the IP and protocol? Well, I have those commands
in there as well, all the way down to the actually finding all the destination
IP addresses, the protocol, source IPs and the timestamps.
And I'll show you what that looks like here. Go ahead and right click, paste
selection.
And you can see here, now I know this is kind of blocky. There you go. Full
screen, it takes up the whole screen.
You can see that based on the timestamps, you have a from and to IP address.
And you'll notice that it says either TCP UDP or ICMP plus the FQDN.
Now, I have a setup to where if the FQDN doesn't is not present, then it just
shows it in a.
You can see that right here as the options. Oops. Sorry.
Go back to it and I will zoom in for you. Here, you can see I have protocol,
which is that TCP UDP ICMP followed by FQDN DNS R name or HTTP host name or in
a if there's nothing there available.
And then it's still sorting out of that eve dot JSON file. Well, this is really
good to know as far as being able to parse through it. But what about the rules
?