Now that is a lot of traffic to be keeping an eye on and it's not always
feasible to be able to go
through Wireshark and try to figure out which packet goes where. So there's
usually a question
and response for most packets, especially when we start getting into TCP
because that the three-way
handshake where you have Syn, Synac and ACK and you're starting to look through
those TCP packets
for sequence numbers and all sorts of different things. Well, there's a way for
us to be able to
replay the traffic which we just learned and be able to visualize outside of W
ireshark to see what's
actually happening in real time. So let's take a look real quick at a tool
called E3. Now this
may or may not be default installed on your version of Cali depending on which
version of Cali that
you download and use at home. But I can tell you that in the ADEP lab, E3.8 is
installed. So you can
click on the top left and just start typing in E3 and see if there and you can
see that you don't
have permission to perform this capture on that device operation I've permitted
. It's because we
didn't run it in pseudo and just letting you know. So inside of our terminal,
type in pseudo, E3.
And when you crank up, you'll see that you come up to a very basic window here.
just taking a look at
Now there's a
couple of things to remember first is that in capture, you can go into the
interfaces and you
can see that I have E3 selected. And on top of that, it's already starting to
read traffic from
this real quick, we're going to look at this as an example before we actually
replay traffic.
You can see that it's starting to make those connections and identify protocols
and services
that are being used between point A and point B. For instance, we have IDMP.
And this is in yellow.
So all traffic that you see in yellow mean, let me pop out and zoom in for you
real quick.
This line over here 224 2022 is IDMP traffic. And you can see the MDNS is in
green coming over
here. It's going to an IVP 6 IPV 6 address, harder than I thought. And then you
have IP
unknown, UDP unknown. But as the traffic starts actually getting captured and
on this per misuse
interface, you'll start to see this map out a whole lot more. Well, we can
actually use our replay
knowledge that we just learned and actually go through and play it back so that
E3 can make those
maps for us. So just as an example, and I'm going to minimize and show you real
quick,
the demo that we have that we've been using for a few skills now is still in
the desktop.
It's called network monitoring practice dot keycap ng. So let's open back up E3
real quick. And
you're going to go back into capture and select in interfaces L O. Now the
reason we're doing this
is because we're using the local loopback interface to be our reference point.
That way,
we don't pollute the actual capture with any results that may or may not be
from the actual
system itself. Let's say like, eat one, for instance, for whatever reason. Now
I'm going to open up a
second terminal real quick on the desktop. And I'm going to type in pseudo TCP
replay.
If I could spell correctly, and then type in dash dash int or excuse me, I dash
I, I'll get there.
Hello. And then capital N net. There we go. Tab over. Now what this will do
right here is start
replay into traffic after I type in my pseudo password. And if I open up either
eight, you can
see that it's starting to populate. And it's doing very quick. That's because
that network
captured that I did was in real time. And you can see that it's already
starting to populate with
connections from point A to point B for the different systems that are on the
actual network.
Now where does this come in handy for us? Well, as a part of our reconnaissance
and moving on and
scanning in the pentesting lifecycle, you can see up on the screen that we're
starting to get
different protocols and services just on the hyperb network that we have inside
of our
a depth lab. So this being our playground look at, we know that we're already
starting to see HTTP
HTTP as domain, which is a fancy way of saying active directory. NTP UDP
unknown net bios,
all sorts of different things. And we can actually make heads or tails out of
this.
Because I'm going to pause real quick, and then go into the protocol. And you
can see how many
protocols. Yeah, let me zoom in for you real quick. The protocols is right
there next to a second
from right. And you can see the protocols are counted based on the actual
number of packets,
even so much as let me move that over for you real quick. Last heard, meaning
how long ago did
it happen? And is it common? So let's say you get one DNS packet, just throwing
it out there.
And you didn't hear it for three hours. Pretty sure that there's no DNS in that
area, but it gives
you an idea of what to actually look for at that point. Now I'm going to close
out the protocols
and go into nodes. This is where we start to get some really good information
as far as connections
are concerned. And we try to make this as big as possible. Now I'm going to
zoom in for us real quick
and start running through some of the information that we're going through here
real quick. In the
first row, we can see that 102 13396 237 has traffic, accumulated traffic, and
the average size of
that traffic along with number of packets and last heard. Basically, who are
our biggest talkers
on the network? Now this first IP address is probably not within the scope of
our rules of
engagement for our pen test. That's okay though, because we can actually filter
through here and see
what IP addresses that are within our scope and identify them correctly and see
where they're
actually going to communicate. As we mentioned earlier in the course, it may be
that you have a
full list of scope of IP addresses and ranges that you're allowed to pen test,
but you just
haven't seen them in your scans. Well, something like this, through passive
listening and replay
and back locally allows you to be able to identify if they're hiding or if they
're just low usage.
And sometimes those low usage systems are the least watched. I don't know, I'm
just, you know,
pen test experience here. Not that I would do anything, of course. Now, I'm
going to close out the
nodes here real quick and I'm going to hit stop. The reason is, is because you
saw how fast that
was actually playing back inside of either a and on top of that, you can see
here that it's maxed
out the RAM on the actual Kali system itself. See, that's a lot. So I'm going
to swap over to the
terminal that's actually doing the replay here. And I'm going to hit, not that
one, because that's
great. Second one, here we go. I'm going to hit control C and stop the actual
replay of traffic.
Now if we remember in the previous portion of the skill, we can actually
throttle this.
And I have the commands pulled up here, but they're in the skill above where we
covered TCD replay.
And we remembered we have to put it before the actual file man. So I'm going to
type in dash dash
TPS equals 100. We're going to do 100 packets per second. Go ahead and start my
capture,
make sure my capture is set in interfaces, hello. Inside a mode, you can even
change it from the
first three layers of the first couple of layers of the OSI model, link layer
IP or even TCP. They're
not straight to the layers. You can filter through there, meaning that unless
you have a system that
is in progress, you have a node and you, for whatever reason, you might be able
to spot it out
in something like this if you're listening correctly. So we're going to go
ahead and start
since we know all of our devices are assigned correctly and we're pointing to
the local loopback
interface and at 100 frames per second, unable to parse our arguments, I had
two
X, uh, equal signs there, my bad. There we go. And you can see that it's going
through again,
but this time it's not running near as fast. And that's because we throttle it
to 100 packets per second.