In our challenge, we were tasked to see if we could find out what kind of base-
operated system the Ministry Box has.
I don't know about you, but I'm enticed by what's in the box.
Well, let's take a look.
As you can see, we're inside of our adept lab here, and I have Mystery Box
highlighted.
Now, I'm going to open up NetworkMiner.
I have the folder open right here.
And I'm going to go to File, Open, the PCAP that we have on the actual desktop,
Challenge.PCAP.
Now, there's a couple of ways you can do this.
I just want to point out, you can type 192.168.0.0 and enter and see all the IP
addresses there that fall within that scope that we're allowed to play with.
Or you can just type in 192.168.0.0.
But what's the app here, dress here? 50. Sorry, even I had the double check.
And we can see here already that it's a Linux system.
Let's dive in a little bit deeper and see if we can tell what kind.
I don't know if we can go too far into it, because we do know that it's Linux 5
.4.
I can tell you it's not a boot tube.
You can definitely go into it. It's the same username and password as the
Ubuntu system, learner and password.
I purposely left it out of the VM information.
I've had this in there for a couple of skills when I'm using it to work on
passive traffic collection.
And you may see it in previous skills if you go back and take a look.
Now, the difference here is that in this skill, it's 0.50.
But in other skills, it may not be. Why is that?
Well, I have DHCP enabled on all the systems and it's first come first served.
And this is really good for us to be able to track here because right now it's
0.50.
In previous skills and ones coming up, it may be different.
Using our passive network capture, we'd be able to identify not only DHCP on
the network,
but we can track that MAC address and see if a different IP address has been
assigned to it.
Now you may be thinking, well, one suite won't necessarily pick up all that
information.
And I'm glad you asked. And that's why at the beginning of this course, when we
started talking about the pen testing life cycle,
that the cycle itself is circular just for being able to put the book.
But we're always bouncing around between part one, part three, part five,
and always making sure that we're crossing our eyes and dot nartis.
Because we may be in the scanning phase as we are right now,
but we may have to go back and do a little bit more reconnaissance works
because we noticed that a system like the mystery box in the HTTP and has
changed IP addresses.
You may be in the exploitation phase and have to do another scan here and there
because you may have a system that came back the addresses and exploits aren't
working.
If you run another scan, you should be able to see and identify based on MAC
address and other fingerprint identifiers that that system has a new IP address
.
But the layer one will always be the same.
Just things to keep in mind as we're going through and taking a look at passive
network capturing data.
And we've seen now in a couple of skills where we can gain a whole lot of
information by passively listening to the network with that glass on the door
to pick up the conversation on the other side.
And just because we don't have direct access to the system, as long as we have
a portion of the network that we're able to tap into and listen traffic to go
back and forth, we can listen all day long.
But we do want to make sure that it's not tampered with by having a IP address
or an interface that we're listening on be in not be in for misgues mode.
Essentially, that'd be like listening to the door with the glass and also
having a conversation with somebody else.
Why are you trying to listen at the same time.
Just different things to think about as we start making our way through the
pentesting life cycle and start working our way towards vulnerability and
exploits.
I hope this has been informative for you and I'd like to thank you for viewing.
[BLANK_AUDIO]