Table of Contents for
Wireshark for Security Professionals

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition Wireshark for Security Professionals by Adam Gordon Published by Wiley, 2017
  1. Cover
  2. Contents
  3. Title Page
  4. Introduction
  5. Chapter 1: Introducing Wireshark
  6. Chapter 2: Setting Up the Lab
  7. Chapter 3: The Fundamentals
  8. Chapter 4: Capturing Packets
  9. Chapter 5: Diagnosing Attacks
  10. Chapter 6: Offensive Wireshark
  11. Chapter 7: Decrypting TLS, Capturing USB, Keyloggers, and Network Graphing
  12. Chapter 8: Scripting with Lua
  13. Copyright
  14. Dedication
  15. Credits
  16. About the Authors
  17. About the Technical Editor
  18. Acknowledgments
  19. End User License Agreement
Prev Previous Chapter
Cover
Next Next Chapter
Title Page

Table of Contents

  1. Cover
  2. Title Page
  3. Introduction
    1. Overview of the Book and Technology
    2. How This Book Is Organized
    3. Who Should Read This Book
    4. Tools You Will Need
    5. What's on the Website
    6. Summary
  4. Chapter 1: Introducing Wireshark
    1. What Is Wireshark?
    2. The Wireshark User Interface
    3. Filters
    4. Summary
    5. Exercises
  5. Chapter 2: Setting Up the Lab
    1. Kali Linux
    2. Virtualization
    3. VirtualBox
    4. The W4SP Lab
    5. Summary
    6. Exercises
  6. Chapter 3: The Fundamentals
    1. Networking
    2. Security
    3. Packet and Protocol Analysis
    4. Summary
    5. Exercises
  7. Chapter 4: Capturing Packets
    1. Sniffing
    2. Dealing with the Network
    3. Loading and Saving Capture Files
    4. Dissectors
    5. Viewing Someone Else's Captures
    6. Summary
    7. Exercises
  8. Chapter 5: Diagnosing Attacks
    1. Attack Type: Man-in-the-Middle
    2. Attack Type: Denial of Service
    3. Attack Type: Advanced Persistent Threat
    4. Summary
    5. Exercises
  9. Chapter 6: Offensive Wireshark
    1. Attack Methodology
    2. Reconnaissance Using Wireshark
    3. Evading IPS/IDS
    4. Exploitation
    5. Remote Capture over SSH
    6. Summary
    7. Exercises
  10. Chapter 7: Decrypting TLS, Capturing USB, Keyloggers, and Network Graphing
    1. Decrypting SSL/TLS
    2. USB and Wireshark
    3. Graphing the Network
    4. Summary
    5. Exercises
  11. Chapter 8: Scripting with Lua
    1. Why Lua?
    2. Scripting Basics
    3. Setup
    4. Tools
    5. Creating Dissectors for Wireshark
    6. Extending Wireshark
    7. Summary
  12. End User License Agreement

Pages

  1. ii
  2. iii
  3. iv
  4. v
  5. vi
  6. vii
  7. viii
  8. xiii
  9. xiv
  10. xv
  11. xvi
  12. 1
  13. 2
  14. 3
  15. 4
  16. 5
  17. 6
  18. 7
  19. 8
  20. 9
  21. 10
  22. 11
  23. 12
  24. 13
  25. 14
  26. 15
  27. 16
  28. 17
  29. 18
  30. 19
  31. 20
  32. 21
  33. 22
  34. 23
  35. 24
  36. 25
  37. 26
  38. 27
  39. 28
  40. 29
  41. 30
  42. 31
  43. 32
  44. 33
  45. 34
  46. 35
  47. 36
  48. 37
  49. 38
  50. 39
  51. 40
  52. 41
  53. 42
  54. 43
  55. 44
  56. 45
  57. 46
  58. 47
  59. 48
  60. 49
  61. 50
  62. 51
  63. 52
  64. 53
  65. 54
  66. 55
  67. 56
  68. 57
  69. 58
  70. 59
  71. 60
  72. 61
  73. 62
  74. 63
  75. 64
  76. 65
  77. 66
  78. 67
  79. 68
  80. 69
  81. 70
  82. 71
  83. 72
  84. 73
  85. 74
  86. 75
  87. 76
  88. 77
  89. 78
  90. 79
  91. 80
  92. 81
  93. 82
  94. 83
  95. 84
  96. 85
  97. 86
  98. 87
  99. 88
  100. 89
  101. 90
  102. 91
  103. 92
  104. 93
  105. 94
  106. 95
  107. 96
  108. 97
  109. 98
  110. 99
  111. 100
  112. 101
  113. 102
  114. 103
  115. 104
  116. 105
  117. 106
  118. 107
  119. 108
  120. 109
  121. 110
  122. 111
  123. 112
  124. 113
  125. 114
  126. 115
  127. 116
  128. 117
  129. 118
  130. 119
  131. 120
  132. 121
  133. 122
  134. 123
  135. 124
  136. 125
  137. 126
  138. 127
  139. 128
  140. 129
  141. 130
  142. 131
  143. 132
  144. 133
  145. 134
  146. 135
  147. 136
  148. 137
  149. 138
  150. 139
  151. 140
  152. 141
  153. 142
  154. 143
  155. 144
  156. 145
  157. 146
  158. 147
  159. 148
  160. 149
  161. 150
  162. 151
  163. 152
  164. 153
  165. 154
  166. 155
  167. 156
  168. 157
  169. 158
  170. 159
  171. 160
  172. 161
  173. 162
  174. 163
  175. 164
  176. 165
  177. 166
  178. 167
  179. 168
  180. 169
  181. 170
  182. 171
  183. 172
  184. 173
  185. 174
  186. 175
  187. 176
  188. 177
  189. 178
  190. 179
  191. 180
  192. 181
  193. 182
  194. 183
  195. 184
  196. 185
  197. 186
  198. 187
  199. 188
  200. 189
  201. 190
  202. 191
  203. 192
  204. 193
  205. 194
  206. 195
  207. 196
  208. 197
  209. 198
  210. 199
  211. 200
  212. 201
  213. 202
  214. 203
  215. 204
  216. 205
  217. 206
  218. 207
  219. 208
  220. 209
  221. 210
  222. 211
  223. 212
  224. 213
  225. 214
  226. 215
  227. 216
  228. 217
  229. 218
  230. 219
  231. 221
  232. 222
  233. 223
  234. 224
  235. 225
  236. 226
  237. 227
  238. 228
  239. 229
  240. 230
  241. 231
  242. 232
  243. 233
  244. 234
  245. 235
  246. 236
  247. 237
  248. 238
  249. 239
  250. 240
  251. 241
  252. 242
  253. 243
  254. 244
  255. 245
  256. 246
  257. 247
  258. 248
  259. 249
  260. 250
  261. 251
  262. 252
  263. 253
  264. 254
  265. 255
  266. 256
  267. 257
  268. 258
  269. 259
  270. 260
  271. 261
  272. 262
  273. 263

Guide

  1. Table of Contents
  2. Begin Reading

List of Illustrations

  1. Chapter 1: Introducing Wireshark
    1. Figure 1-1: The Wireshark home screen
    2. Figure 1-2: The Packet List pane
    3. Figure 1-3: The Packet Details pane
    4. Figure 1-4: Field information in the status bar
    5. Figure 1-5: ARP packet Opcode
    6. Figure 1-6: Filter results of ARP from a source address
    7. Figure 1-7: Complex display filter example
  2. Chapter 2: Setting Up the Lab
    1. Figure 2-1: Getting SHA-256 file hash in PowerShell
    2. Figure 2-2: VirtualBox SHA-256 checksums
    3. Figure 2-3: VirtualBox installation window
    4. Figure 2-4: VirtualBox feature selection
    5. Figure 2-5: VirtualBox shortcut creation
    6. Figure 2-6: VirtualBox networking warning
    7. Figure 2-7: VirtualBox installation window
    8. Figure 2-8: VirtualBox installation status
    9. Figure 2-9: VirtualBox driver installation prompt
    10. Figure 2-10: VirtualBox installation finished
    11. Figure 2-11: VirtualBox GUI and restart window
    12. Figure 2-12: VirtualBox Extension Pack download
    13. Figure 2-13: VirtualBox Extension Pack preferences
    14. Figure 2-14: VirtualBox Extension Pack installation
    15. Figure 2-15: Successful VirtualBox Extension Pack installation
    16. Figure 2-16: Kali download web page
    17. Figure 2-17: Creating a new virtual machine
    18. Figure 2-18: Selecting virtual machine memory
    19. Figure 2-19: Creating virtual disk
    20. Figure 2-20: Selecting virtual disk type
    21. Figure 2-21: Storage on physical disk
    22. Figure 2-22: Virtual disk size
    23. Figure 2-23: Enabling PAE
    24. Figure 2-24: Selecting start-up disk
    25. Figure 2-25: Kali boot menu
    26. Figure 2-26: Possible temporary error
    27. Figure 2-27: Entering a hostname
    28. Figure 2-28: Skipping the domain
    29. Figure 2-29: Entering a root password
    30. Figure 2-30: Partitioning the disk
    31. Figure 2-31: Confirming the disk
    32. Figure 2-32: Confirming a single partition
    33. Figure 2-33: Writing changes to the disk
    34. Figure 2-34: Confirming disk changes
    35. Figure 2-35: The installation progress bar
    36. Figure 2-36: The option for a network mirror
    37. Figure 2-37: Network connection proxy
    38. Figure 2-38: GRUB boot loader
    39. Figure 2-39: Installation is complete
    40. Figure 2-40: System settings
    41. Figure 2-41: New user w4sp-lab
    42. Figure 2-42: Firefox to GitHub
    43. Figure 2-43: Saving the W4SP Lab file
    44. Figure 2-44: Opening Terminal
    45. Figure 2-45: Unzipping the W4SP Lab
    46. Figure 2-46: Running the W4SP Lab installation script
    47. Figure 2-47: Running the W4SP Lab setup
    48. Figure 2-48: The full W4SP Lab network
  3. Chapter 3: The Fundamentals
    1. Figure 3-1: OSI layers in Wireshark
    2. Figure 3-2: VirtualBox networking options
    3. Figure 3-3: Malware signature code
    4. Figure 3-4: Small Incoming Layer 2 frame
    5. Figure 3-5: Smaller outgoing Layer 2 frame
    6. Figure 3-6: Gratuitous ARP
    7. Figure 3-7: TCP's 3-way handshake
  4. Chapter 4: Capturing Packets
    1. Figure 4-1: The Capture interfaces list
    2. Figure 4-2: Superuser warning
    3. Figure 4-3: New traffic
    4. Figure 4-4: Renaming a network interface
    5. Figure 4-5: Sample localhost ICMP traffic
    6. Figure 4-6: Installing the loopback adapter on Windows
    7. Figure 4-7: RawCap loopback sniffing
    8. Figure 4-8: RawCap pcap in Wireshark
    9. Figure 4-9: VirtualBox bridging
    10. Figure 4-10: Wireshark sniffing bridged network
    11. Figure 4-11: Capturing packets with a hub
    12. Figure 4-12: Traffic when sniffing on a hub
    13. Figure 4-13: SPAN sniffing connections
    14. Figure 4-14: Throwing star LAN tap
    15. Figure 4-15: Traffic flow when sniffing a Linux bridge
    16. Figure 4-16: Raw wireless packets in Wireshark
    17. Figure 4-17: The File Save dialog box
    18. Figure 4-18: Properties of a capture file
    19. Figure 4-19: Multiple file settings
    20. Figure 4-20: Stop capture options
    21. Figure 4-21: Setting multiple files and ring buffer
    22. Figure 4-22: Resultant ring buffer files
    23. Figure 4-23: Mergecap verbose
    24. Figure 4-24: Mergecap complete
    25. Figure 4-25: Clearing recent files
    26. Figure 4-26: Changing the number of recent files shown
    27. Figure 4-27: Wireshark's Decode As window
    28. Figure 4-28: Wireshark's Decode As window
    29. Figure 4-29: Packet list filtering for SMB
    30. Figure 4-30: SMB packets referencing a file
    31. Figure 4-31: Packet list filtered for NT Create calls
    32. Figure 4-32: Adjusting packet colors
    33. Figure 4-33: Colorizing conversations
  5. Chapter 5: Diagnosing Attacks
    1. Figure 5-1: Man-in-the-middle position
    2. Figure 5-2: Ping and ARP transaction
    3. Figure 5-3: W4SP Lab network
    4. Figure 5-4: W4SP's vic1
    5. Figure 5-5: LOCALSIP
    6. Figure 5-6: Exploit in progress
    7. Figure 5-7: ARP packets fly
    8. Figure 5-8: FTP credentials to attacker
    9. Figure 5-9: Expert information
    10. Figure 5-10: Noting your IP address
    11. Figure 5-11: DHCP module options
    12. Figure 5-12: DHCP running
    13. Figure 5-13: DNS settings done
    14. Figure 5-14: DNS queries
    15. Figure 5-15: Quieter fake DNS
    16. Figure 5-16: FTP capturing
    17. Figure 5-17: Mirai password list
    18. Figure 5-18: Pingbed
    19. Figure 5-19: Gh0st
    20. Figure 5-20: Xinmic
    21. Figure 5-21: Malware analysis practice
  6. Chapter 6: Offensive Wireshark
    1. Figure 6-1: W4SP Lab network
    2. Figure 6-2: Nmap port scan
    3. Figure 6-3: Nmap port scan in Wireshark
    4. Figure 6-4: Open port in Wireshark
    5. Figure 6-5: Metasploitable and its IP
    6. Figure 6-6: Searching for the VSFTPD exploit
    7. Figure 6-7: Exploit success but no shell
    8. Figure 6-8: Exploit attempt in Wireshark
    9. Figure 6-9: Exploit success with shell
    10. Figure 6-10: Root shell command WHOAMI
    11. Figure 6-11: Root in packet bytes
    12. Figure 6-12: Metasploit RMI data
    13. Figure 6-13: Metasploit HTTP JAR data
    14. Figure 6-14: Metasploit hex dump
    15. Figure 6-15: Unanswered SYNs
    16. Figure 6-16: Filter for tcp/4444
    17. Figure 6-17: Encrypted traffic
    18. Figure 6-18: ELK
    19. Figure 6-19: Time-field name
    20. Figure 6-20: SSHdump install
  7. Chapter 7: Decrypting TLS, Capturing USB, Keyloggers, and Network Graphing
    1. Figure 7-1: Browsing to ftp1.labs
    2. Figure 7-2: Follow TCP stream on SSL/TLS traffic
    3. Figure 7-3: Wireshark SSL/TLS protocol options
    4. Figure 7-4: Setting up SSL/TLS decryption
    5. Figure 7-5: Decrypting TLS traffic in Wireshark
    6. Figure 7-6: Adding SSLKEYLOGFILE
    7. Figure 7-7: Decrypted SSL/TLS data
    8. Figure 7-8: USB device overview
    9. Figure 7-9: usbmon interfaces
    10. Figure 7-10: Connecting USB device to Kali VM
    11. Figure 7-11: Wireshark usbmon error
    12. Figure 7-12: Capturing on usbmon2
    13. Figure 7-13: USBPcap device list
    14. Figure 7-14: USBPcap running a capture
    15. Figure 7-15: Filtering USB traffic to host
    16. Figure 7-16: HID key codes
    17. Figure 7-17: TShark key sniffer
    18. Figure 7-18: TShark-generated network graph
  8. Chapter 8: Scripting with Lua
    1. Figure 8-1: Lua Interactive Interpreter
    2. Figure 8-2: Wireshark About page
    3. Figure 8-3: Lua in Tools menu
    4. Figure 8-4: Lua Console in Wireshark
    5. Figure 8-5: Wireshark Evaluate Lua
    6. Figure 8-6: Wireshark without a dissector
    7. Figure 8-7: Our protocol fields
    8. Figure 8-8: Sample protocol hexdump
    9. Figure 8-9: Tree items in Wireshark
    10. Figure 8-10: Running direction script
    11. Figure 8-11: Finding a suspicious packet

List of Tables

  1. Chapter 1: Introducing Wireshark
    1. Table 1-1: Comparison Operators
    2. Table 1-2: Logical Operators
  2. Chapter 4: Capturing Packets
    1. Table 4-1: Common Wireshark Capture File Formats
  3. Chapter 5: Diagnosing Attacks
    1. Table 5-1: Exploit Options
    2. Table 5-2: Well-Known DoS Tools
Prev Previous Chapter
Cover
Next Next Chapter
Title Page
Back to top