Hacking Lab 0x01 Packet Capturing and Analysis
Hacking Lab 0x01 - Packet Capturing and Network Forensics
© Paul W. Poteete, 2016
Overview:
This lab introduces the student to packet capturing and network forensics. It should provide a primer for the risks of unencrypted network traffic, as well as the complications when using encrypted traffic. Xplico and NetworkMiner are excellent tools; however, this exercise is intended to provide foundational knowledge of how and why the packet capturing works. There are many excellent forensics tools that provide a graphical interface for analysis.
As a general note, additional labs often discuss the commands in greater detail. This method presents the information in a “What” then “Why” model, allowing the students to experiment with the tools before studying the tools in hope that this will generate greater understanding when the tools are studied in the future.
Resources:
Victim: Windows 2003 Server (Virtual Machine, 128MB of RAM)
Attacker: Linux Box (Physical Host for the VM, Debian-based)
Promiscuous Mode Interface (Virtual or Physical Tap)
pcap files (optional for email exercises)
Dictionary word lists:
http://download.openwall.net/pub/word...
http://www.packetstormsecurity.org/Cr...
Victim Tools:
Built-In Services: ftp, telnet
Attacker Tools:
hydra
telnet client
tcpdump
dsniff
net-creds.py - https://github.com/DanMcInerney/net-c...
wireshark
-----------------------
Thank you for dropping by!
Please join me:
/ paulwpoteete
/ paulwpoteete
/ paulwpoteete
CC by Paul W. Poteete