I'm going to take a slightly different approach and introduce our rehash a tool
that we've
used previously and skills and courses together.
But I didn't really have a place to fit it in in the skill, but I still want to
touch
on it.
So I've led you into a trap and we're taking a look at the Cali box here in our
lab environment.
And first thing I want to do is make sure that I'm in promised mode on my e
zero because
we've seen throughout this skill, that's where my promiscuous mode and where
all my packets
are going to be sent to for destination.
So first I have config.
Let me pop back in the lab.
I have config.
And we can see that it is zero if I pop out and zoom in for us real quick is in
promised
mode, which is very good.
So now I'm going to be doing a pseudo TCP dump.
And you could see that I've set a couple of flags to it and I will put this
command below
the solution in this portion of the skill.
I'm doing a TCP dump specifically targeting the interface of e zero, which is
why I had
to make sure it was in promised mode because in wire shark, you can set that or
check that
box in TCP dump.
It is as it is per the interface.
And then the dash W sending it to test dot PCAP.
So be it that I'm in a desktop terminal.
This is going to save the test dot PCAP to the actual desktop itself.
So I'm going to go ahead and run this type in my Kelly password and I'm just
going to
listen for a couple of moments.
Maybe open up my own Ubuntu real quick and do it ping or two.
Like an end real quick, open it up the terminal and ping Google dot com.
And I'm going to let that run for just a second.
And that's long enough.
I'm going to go ahead and close it and close out my own Ubuntu desktop.
Then I'm going to go and hit control C to close out that PCAP that I'm running
at TCP
dump.
And at this point, you can actually double click the test dot PCAP and see it
right there
inside of wire shark.
And you can see where there's a lot of ICMP traffic.
Not too many packets.
I wasn't doing a lot of stuff in the background, but there's the purpose behind
that is to
make sure that we can run Sir caught a little bit faster.
Now I'm going to open up my Sir caught a folder and I'm going to delete my
previous
session of Sir caught up.
And I'm going to drag in test dot PCAP and then go up and we can see that I'm
changing the command for Sir caught just to include the actual test dot PCAP
file name.
And I still want to point to the proper yaml to make sure that the rules are in
place for
those snort rule sets or short rule sets.
After this, I'm going to go ahead and hit a question mark because it says PCAP
file test
dot PCAP no such file or directory.
Did I save it correctly?
I did.
So let's type it in manually pseudo through a car of dash R test.
Oh, because I'm still in the desktop terminal.
That's why I'm not in the actual working directory of it.
I can know that by type in PWD and yep slash home slash galley slash desktop.
So let's open up a terminal inside the Sir caught a folder.
Call myself there.
Yes, pseudo Sir caught up.
Let me back up and type in the the actual test dot in PCAP for us.
Test dot PCAP and we'll go ahead and type in the Cali password and let it parse
and
you can see that the folder right behind it just populated and leave those four
files
showing and you could see that Sir caught is running and parsing the
information already.
Now this may take just a second shouldn't take too terribly long because we are
doing
maybe what 50 packets if that whereas the previous one had a much more 20
packets because
it just completed and we can see if we go into the fast dot log and let that
open up.
We've really popped up note in the Sir caught a log and the reason nothing
popped up in
fast.log is because we're applying that rule set and nothing alerted based on
the snort
rules.
But we can see that we did have a successful run of Sir caught up and if we
close this
and open up the eve dot Jason, there is data in there meaning that it did
collect data.
So just out of sure curiosity, I'm going to open up my commands document where
I have
all the commands in there for you in this lab.
And I want to do a JQ query essentially to make sure that I have IP showing up
and I'm
running the find all source IP commands on this.
I'm just going to paste it in there and you can examine that yourself and you
could see
right there that we did have one pop up as a source IP address and that is 192.
168.0.52.
And that is the IP address to that Ubuntu box.
And just like that, you can see that it's very easy to capture traffic promisc
uously and
also very quietly.
But there are pros and cons in this particular case so far in our skill.
We don't necessarily have too much information pertaining to the system itself,
just the
IP address, some services that it may or may not be running and some other
information
inside of those packets that we'll definitely dive into later on.
We're just scratching the surface on scanning and getting to know that system
or network
a little bit more.
I just wanted to introduce you to the idea of passive scanning and a tool like
Sir
Kata so that way later on it's not a surprise out of nowhere thing.
I hope this has been a forwarder for you and I'd like to thank you for viewing.
[BLANK_AUDIO]