As we're opening up Wireshark, I do want to point out that this needs to be on
the interface that's facing the internet.
Even though our burp suite proxy is going on local loopback or however you may
have it configured,
in order for us to be able to make sure that we capture everything, we need to
be on ETH1 on this particular system.
So that way we go through and capture all that we need to get.
So I'm going to go back now that we have Wireshark running. I'm just going to
go to the browser and type in
vwap.test and go back to my proxy real quick and approve all the packets for it
all.
Yeah, get away from the Google site, go back to my Wireshark and make sure that
we're capturing everything. Cool, we got it.
So we're going to go back to Chrome real quick. We're going to click on New
User, approve us going to that page.
And we're going to create Eric to same email. I'll just put a two on the end of
Eric.
This time we're not we're not manipulating the password this time.
We just want to take a look at what it looks like on the Wireshark to see if
there's any kind of difference or in fact what we're looking for.
So go to create for the packet, go to our Wireshark right here and stop it for
a second.
Yeah.
Now right here, this is where the HTTP packet right there is it because we know
that bwap.test does in fact tie to 192.168.0.13
right here.
And you can see that it is HTTPL form and right there is the information that I
sent in form item. I'm going to zoom in for you real quick.
Right here, you can see that I made HTML form URL encoded application, etc, etc
.
But right there form items, it's sent it in the actual forms itself across the
actual packet.
So the login was here to the email was air to a bwap.test and password password
along with the secret hint and what action was taken on there.
Well, this very slightly differs from what we're seeing inside of burp suite in
a sense of when we go to burp suite.
Right here and go to our target while we do get a listing of all sites and can
extract information from burp suite like the pages themselves and do a little
bit more digging.
We can actually go to wire shark itself on this particular capture go to file
and we've covered this in previous wire shark classes of courses here on CBT n
uggets and we can go to export objects.
And we're going to say HTTP and right here you can see all the different pages
that we have that were actually created and we could export these and examine
them as well.
So not only is the power of burp suite good as a proxy and allows us to be able
to go through and manipulate traffic and also do some intercept and later on
some fuzzing as we talked about.
But combining it with your other tools like wire shark allows us to be able to
go through and analyze and dig even further.
Not only the information that we saw for the intercept portion, but also
pulling out files that we can analyze and compare contrast to how that traffic
works or is intended to work.
So that way when we get to cross site scripting.
We make sure that all of this that we've been doing so far in this course looks
as normal to the user as possible and try to make it look decent for those
ideas and IPS systems for those evasion tactics.
But if we go through and start setting this up and having the administrators
take a look at it in the security professionals.
They're going to eyeball something and have those either defined rules or he
uristic rules set in IPS and ideas to try to stop us pen testers from using
tools like this to fool the users.
Remember it's not always the settings and patching that allows us to be able to
penetrate a system or network.
Sometimes it's user fault or error and this these tactics that we've been doing
thus far in the last couple of skills.
Enhance and help those users make those errors for us to be able to go through
and properly pen test and gain entry.
So let's put a bow in it for now and start moving on to what we do after that
because we've seen that we can interject traffic.
Now we start getting into how we start doing manipulations of files that we
could potentially send to those users and systems.
I hope this has been informative for you and I'd like to thank you for viewing.
[BLANK_AUDIO]