Now the last tool we're going to examine here is NetworkMiner and this is where
we actually start
to get into understanding the actual systems themselves by getting a whole lot
more information
on them. Trust me it'll make sense here in a second. Now this is actually a
Windows tool and that's
why here in the depth in the lab you can see that I'm in the actual host the
hyper-v when you go
and log into the actual lab itself. And on the desktop I have two folders. One
is called NetworkMiner
and the other one is called Share. I'm going to get there we go. They're down
here. One of them is
under the date created real quick but they're on the lower left hand side. If
you open up Share
real quick you'll see that there's a network monitoring practice PCAP and G. It
's the same one
that's actually in the Kali box as well and then you'll see a folder called
NetworkMiner which
we're open up right now. Now this is the free version of it. I will put a link
below on where the actual
download is and also if you want to download the professional and pay for it on
the side.
This is pretty straightforward. You could just double click it and also while
this is opening,
not all tools are inside of Kali. Again that's Kali specific is pin 103. We're
here getting into
actually doing and learning and trying to make as much as we can out of this
and some tools are
outside of our Kali box. Now when you open up NetworkMiner there are a couple
things I want to
note here and that is up to the top there's a drop down box that lists all the
interfaces that you
have on your specific system. Now it has lint PCAP and socket meaning that one
of them is looking at it
through the guys of how to make a PCAP. The other one is just actually looking
at it from the
raw interface itself. You can actually do captures on this one and I do want to
do one real quick.
We're going to select the Hyper-V Ethernet adapter number two which is the 192.
1.1.1.1.1 and the host
for the actual virtual network inside of this lab. And once we select it we're
going to hit start
and you can see here in just a second I may have to you know box some traffic
real quick. Let me
open up the Kali box for us real quick and there you go you can see on the left
that we actually had
some traffic generated and I'm going to zoom in for you there real quick and
along with the
connections that are going in and out. Now the reason this is working here is
because this Hyper-V
that you log into is basically the gateway for those virtual machines on the
right side. Kali
Ubuntu and Windows 10 that we have. So this is effectively acting like the
network cap
so to speak for this particular network. Now in Windows the downside is you can
't run it for
misgues mode. So network miner being a Windows tool has its parts. So it best
works with actual
PCAPs and earlier when we mentioned that wire shark has its own flavor of PCAPs
this is where
we have to remember that TCP dump is in the rawest of forms for network
captures. Now I'm going to
go ahead and stop this because reason we're more into actual network miner is
for the its ability
to be able to examine an actual PCAP. And on top left you click file open. I'm
going to go to
the actual share folder itself and you'll see that there's no PCAP solicited in
there.
But I can go in the share folder itself we see PCAP right there. If this
happens to you open up
that PCAP NG inside of wire shark and once it fully loads because there's a few
quite a few
packets in here. You can click on file go to save as and change your save as to
wire shark
TCP dump PCAP and then we're just going to follow network dash depth. And I
will leave this in
there for you as well when you go into the lab so you don't see it. Now I can
close wire shark
and you can see I have two files there now network monitoring practice PCAP NG
and network
dash test PCAP by itself. When we swap back over to network miner you can see
well now it's listed.
Now the paid professional version of network miner actually allows and
encourages PCAP
NG's from wire shark but since we're using the free version and don't need all
the belts
whistles we're loading up inside of TCP dump raw data. And you can see it's
loading and there's a
lot of data that we have in there. Basically the same thing that we saw inside
of either eight
those connections to and from those individual systems and allows us to be able
to sort as well
to because now it's by default IP address ascending but there's going into the
weeds even more. If
you're familiar with wire shark you know you can actually data carve outside of
the PCAPs and
potentially get files other information and things like that you can do the
same thing inside of
network miner. And to do that I'm going to zoom in for us real quick you can
see that the tabs
at the top you have host files images meaning PNGs JPEGs but not messages
credentials sessions
DNS parameters and keywords. Now I just did a very basic capture to do
basically a rant update
on everything and that's all that we it was going back up for with which is why
under files you see
that we have a pretty good bit of files in here. Now these right off the gate
are the actual
certificates for SSL connection and things like that. If I scroll down you can
see that there's
other stuff in here too such as .xv which is like a temp file .cabpiles and you
can even see where
they come from because you get the source host information as well. Now inside
of the actual
host tab this is where we have to be able to remember that we have a scope for
our rules of
engagement for the tempest itself. Now there is enter a host filter and you can
do it by string
redjacks or a cider. I'm going to type in cider and our scope for this
particular test
is going to be 192.168.0.0/24. Titer filters are not available in the free
version that we're
my in. Well that's something we learned together. Now what you can do is type
in and string one IP
address and again this is the free version but you can see here that I typed in
192.168.0.1
and we actually have a result meaning the actual host that we're working on
right now inside of
Hyper-B. And when we go in I'm going to now zoom in for you again and you can
see that we're
starting to get way more detailed information about the system itself. The MAC
address, the NIC
vendor, the MAC age host name and this one says OS unknown but we also have
host details along
with the two in front of information as well. And if we expand the host details
we can get the
query IP address of 0.53 and right there, zoom in for us again real quick,
Windows version 1 10.0.
So it did identify that this is in fact a Windows system and probably Windows
10. Well is it?
Let's hit start run on the host real quick and I am or excuse me, Winber. Win
ber. It's server 22
so it got close right it's in that same family but you can actually go through
and get a lot more
information on some of these systems the more traffic that you have going back
and forth 51.
Sorry my bad I have to remember the IP addresses but that's the whole point of
taking note during
your pen test. We're going to expand this here real quick and you can see that
we actually have
more information on the actual operating system itself because I captured
traffic going back
and forth enough to satisfy the OS fingerprinting of network miner. Now this is
information that
you can also find inside of wire shard but this parses it for you a whole lot
in you.
You can see here that the OS is Windows and it's going to guess that it's
either Windows 8, 7 or 10
which is very close because we are using Windows 10. You can get more host
details as well based on
the actual web browsers and services that it's using on the actual system
itself. So there's a
whole lot of information you can get from just passively listening to the
network and where you
take this is basically saying okay now that I know I have a Windows operating
system on the
network that's using let me highlight here for you Mozilla and also Windows NT
10, WY64, X64.
So it's a 64-bit operating system and it's using Mozilla 5.0 or Chrome meaning
I can start zoning
in on some of the vulnerability testing against that particular system just by
passively listening
to the traffic and identifying what's on the actual network. Now there's other
stuff on this
network as well too because as you saw on the desktop now on the top left there
's a challenge.pcap
and we'll become a Mac this one here in a minute but I wanted to cover the
basics of network miner
and let you browse around and start getting familiar with it because as far as
we're concerned we
just want to be able to see what's in the host and potentially in the files
later on we'll come back
and start doing file extraction inside of WYershark and inside of here in other
tools but for right
now it's just understanding what's on the network and how to replay a pcap
through it.