Now I'll have the commands listed below this video for us, but I wanted to jump
right into
the ADEP lab and touch on TCP replay. We've already discussed and utilized its
counterpart
TCP dump. TCP dump allows us to be able to go through and copy traffic from a
specified interface,
and it doesn't really matter if we're in promiscuous mode or not, we have to
assign that to the actual
interface manually. Now just to refresh, we're inside of our eternal inside of
Cali, and we're
going to do an IFCN FEG real quick. And we can see here that we have two
interfaces,
ETH zero and ETH one. I'm kind of ignoring local loopback for a minute, but it
will actually
come up later in the skill. In ETH zero, we can see that we don't have, let me
pop out and zoom in
for you real quick. We don't have an IP address assigned to it, be it IPV4 or
IPV6, but we can see
very clearly on ETH one that we have that IP address. Now I want to jump out of
this real quick and
go back into the Hyper-V Manager and expand on something that we talked about
previously as well,
and that is the source and destination of monitoring and mirroring traffic.
Now our Cali box, if we right click and go into settings, is going to have two
nicks assigned to
it. And we can see that on Nick number two, it's set as destination. There we
go for port mirroring
and mirroring mode. The reason that we don't assign an IP address to it is
because just in case,
let's say for instance, that there is a subnet packet that's coming through. It
's addressing the
entirety of the actual subnet itself, or let's say like an ICMP packet or some
more of those ones.
If we have an IP address assigned to the interface inside of Cali on ETH zero,
that interface is going to pick up that packet along with picking it up again
if we have a set
in Pro Masking we're monitoring on that actual interface. So we'd be picking it
up twice. And
when we take a look at actual copy and traffic and mirroring it and wanting to
have accuracy,
this plays with our results a little bit and can skew or even fool us a little
bit because it
makes it seem like that there's somebody out there sending multiple packets
when they're really not.
And that's why whenever you have a promiscuous interface, you kind of want to
lead an IP address
out of it. Now that being said, we're going to go through and sign real quick
on pseudo IF config
-a, e, zero, and to promiscua. And type in our pseudo password. And when we do
another IF config,
we can vary. I'm going to highlight it then zoom in for you real quick. We can
see that we have
Pro Misk back on, please ignore the file system that I hovered over to get back
over here.
And you can also see right below that where it has the actual details for it,
meaning the
received packets and bytes. And you should notice that there's no transmitting
happening whatsoever.
That's another reason we don't want to put an IP address on this interface is
because this could
also cause the interface to send a I'm alive packet to the network and cause a
transmit happening.
And whenever we're doing promiscuous captures or network mirroring and
monitoring, we want to
be as quiet as possible. Sending out packets that have an IP address on them
will allow the
blue team or IDS and IP systems to have something to look back to to see where
who's actually
monitoring. And we cross that threshold from going from passive to actually
active accidentally
when we're trying to do our very stealthy monitoring. Now that being said, we
know that we can go inside
of terminal and say pseudo TCP dump and then assign an interface and go ahead
and start capturing.
And just like that, my OBS glitched, I apologize. We're capturing using TCP
dump on
e0, which is our promiscuous port. And it's going to capture dot PCAP. Now this
PCAP is very important
because in TCP dump, and this is going to become evident when we get into it in
one of our tools,
that PCAP is the baseline file formatting for network captures. There are
others out there
like wire shard that have their own flavor of default saving. And it doesn't
necessarily
add anything to the file overall. It just stamps it with the magic number in
the file header,
that it belongs to wire shard. And it has that little bit of extra spice to it.
And it messes with
one of the tools that we're going to be using only because we're going to be
using the free
version of it. So now that we've gone ahead and done a capture a little bit, I
'm just going to
hit control C and we've captured 36 packets. And you see it pop up on the
desktop and it is
saved as an actual PCAP file. And if we open it up inside of wire shard, you're
going to see those
36 packets. There they are. And you can see that they are pretty self
explanatory, ICMP, IDMP, DNS,
the basics. Now there are times when we use TCP dump to be able to do captures
while we're not
necessarily in the office or directly doing any of our pentesting routines. And
that's why passive
monitoring like this comes in really handy. Let's say you're wanting to capture
traffic during
off hours, but you don't necessarily want to be there during off hours. As long
as you've got your
network taps and your monitors in place, you can run commands like TCP dump as
long as you have
access to that network settlement and start going through and doing your
monitoring as needed.
Now, what happens when you come back to the office and you want to be able to
parse through or
see how that traffic actually played? Well, that's where we're getting into TCP
replay.
Now for just a second, entertain me if you will. I'm going to clear this and I
'm going to do a
capture on wire shard going on local loopback. And I'm going to make sure, I
don't know why none
of the interfaces are killing. And I had to restart wire shard. Sometimes it
happens.
But I'm going to select local loopback. And the reason for this is, is because
I'm going to replay
using TCP replay that capture.pcap that we just did and show you that it will
play back inside of
wire shard because I'm going to send it straight to the actual local loopback
interface, even though
we captured on zero. So to do this, we're going to type in pseudo TCP replay.
And we're going to
assign the interface dash i of l o, because if you remember and look right up
in here,
benefit don't pop the amount for or zoom in for you real quick, our interface
right here is l o
for local loopback. And we're going to say dash i l o and then capture dot pcap
. And you can see
right there that it replay the entirety of the capture and wire shard listen to
every single
bit of it. And that's because wire shark was listening to the local loopback
interface to be
able to pick up all of that passive traffic from the capture that we did. Now
this is really handy,
because now you can see the traffic as it was actually happening on the network
itself,
while you were out doing whatever it is that you were doing. And we don't have
to be there 24/7
to be able to see how that traffic actually happened. There may have been a
delay between one packet
or the other. When you're just looking at it inside of wire shark, it's a
little bit difficult
to be able to tell that without having to stopwatch and advocates and counting
all the actual time
stamps on here. So it's good to be able to visually see it and also replay it
as is, because let's say,
for instance, do you want it to not only replay it, but replay it inside of a
network to where you
can actually listen to that traffic more in depth. Let's say you have Nessus
running,
and you want to use the Nessus network management snap-in, basically the old
PBS passive vulnerability
scanner. Now the reason we didn't touch into that is because it's very
expensive and there's no trial
software with it. But that specific software listens to the traffic and goes
into more details,
using the same rules that we went through in Nessus. And we'll get to basically
diet Nessus as we go
through this skill. Now the last thing I want to show you real quick is I'm
going to go ahead
and clear this out and start my listening on local loop back over again. And
the reason I'm doing
this is because now I'm going to run the exact same command, except on the end
of it, I'm going
to type - -pps equals 10. And what this is doing is throttling. Sorry I had to
command backwards,
trust me, it'll be right below in the correct form. File is always supposed to
go at the end.
Now what this is doing is it's throttling the actual capture replay that we
just did. You'll
notice that it went through a whole lot slower. And that's because that pps
command on the end of it
is actually taken through and slowing it down at 10 packets per second. Now you
can suck this at
whatever you would like. But the reason that you might want to do this is that
let's say you have
a vulnerability scanner or IDS IPS that you're running all this traffic through
. And it's not
really up to snuff on resources. That's okay because now you can throttle back
using TCP replay that
playback so that way you can analyze the traffic even more. And it may take
more time on your
on the back end, but that's okay because now you know that it's going to be
able to check every single