Wireshark for Pentesters

Wireshark is a network protocol analyzer that captures and inspects packets in real time or from saved capture files (.pcapng). For pentesters, it is indispensable for: - Reconnaissance: Discovering hosts, services, and network topology. - Credential Harvesting: Sniffing unencrypted protocols (HTTP, FTP, Telnet, SMTP). - Protocol Analysis: Understanding application behavior and finding misconfigurations. - Attack Detection: Identifying ARP spoofing, DNS poisoning, or DoS attempts. - Exploit Verification: Confirming that an exploit resulted in the expected traffic.

Wireshark works by putting the network interface into promiscuous mode (or monitor mode for wireless) to capture all packets on the segment. It uses the libpcap/WinPcap/Npcap library to capture raw frames from the network adapter.

When you start a capture, Wireshark opens a live capture interface. Each packet is timestamped and dissected into protocol layers. The main window has three panes: - Packet List Pane: Shows a summary of each packet (number, time, source, destination, protocol, length, info). - Packet Details Pane: Expands the packet into OSI layers (Frame, Ethernet, IP, TCP/UDP, Application). - Packet Bytes Pane: Shows the raw hex dump and ASCII representation.

Wireshark uses a powerful display filter language. For example: - ip.addr == 192.168.1.1 filters packets to/from that IP. - tcp.port == 80 filters HTTP traffic. - http.request shows only HTTP GET/POST requests. - !arp excludes ARP packets.

Filters are applied after capture, unlike capture filters (which use BPF syntax and are applied during capture to reduce file size). Common capture filters for pentesters: - host 10.0.0.5 captures only traffic to/from that host. - port 21 or port 22 captures FTP or SSH. - not broadcast and not multicast reduces noise.

#### 1. Follow TCP/UDP Stream Right-click a packet and select "Follow" > "TCP Stream" to reassemble the entire conversation. This is invaluable for extracting credentials, files, or understanding application logic. The stream is displayed in ASCII or hex. You can also filter on a specific stream with tcp.stream eq 0.

#### 2. Statistics Menu - Statistics > Protocol Hierarchy: Shows the percentage of packets for each protocol. Useful for identifying unusual protocols (e.g., ICMP tunneling). - Statistics > Endpoints: Lists all IP addresses and MAC addresses seen. - Statistics > IO Graph: Plots packet rate over time. A sudden spike may indicate a scan or attack. - Statistics > Flow Graph: Visualizes the sequence of packets between hosts.

#### 3. Expert Information Access via Analyze > Expert Information. Wireshark automatically marks packets with notes (Chat, Note, Warning, Error). For example, a TCP retransmission is a Warning; a malformed packet is an Error. This helps quickly spot anomalies.

#### 4. Name Resolution Wireshark can resolve MAC addresses to vendor names (OUI), IP addresses to hostnames (DNS), and ports to service names. Enable in View > Name Resolution. Be cautious: DNS resolution sends queries and may alert defenders.

#### 5. Coloring Rules Wireshark colors packets by protocol or condition. Default rules: TCP SYN is red, HTTP is green, UDP is light blue. You can create custom rules (e.g., color all packets with tcp.flags.syn == 1 red) to highlight attacks.

#### ARP Spoofing - Filter: arp - Look for duplicate IP addresses with different MACs. Use arp.duplicate-address-detected or check arp.opcode == 2 (reply) for unsolicited ARP replies. - A typical ARP spoofing attack: attacker sends fake ARP replies claiming to be the gateway. In Wireshark, you see multiple ARP replies for the same IP from different MACs.

#### SYN Flood - Filter: tcp.flags.syn == 1 and tcp.flags.ack == 0 - A SYN flood shows many SYN packets to the same port from different source IPs (spoofed) with no SYN-ACK responses. The IO Graph will show a spike. - Use Statistics > Conversations to see the number of packets per conversation.

#### DNS Tunneling - Filter: dns - Look for DNS queries with long subdomains (e.g., base64encodeddata.example.com). High volume of TXT queries or large response sizes (>512 bytes) are suspicious. - Check dns.qry.name for unusual lengths.

#### HTTP Credential Harvesting - Filter: http.request.method == POST - Follow TCP stream to see POST data. Look for username=, password=, or passwd=. - Also filter http.authbasic for Basic Authentication headers (Base64-encoded credentials).

#### SMB Relay / Pass-the-Hash - Filter: smb or smb2 - Look for SMB Session Setup requests. The NTLM challenge-response can be captured for offline cracking. - Use ntlmssp filter to see NTLM authentication packets.

#### Using TShark (Command-Line Wireshark) TShark is the CLI version, useful for scripting. Example: tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri extracts host and URI from HTTP requests.

#### Extracting Files from PCAP - File > Export Objects > HTTP/SMB/etc. to extract files transferred over those protocols. - For other protocols, use foremost or binwalk on the pcap. - Example: Extract all HTTP objects: Wireshark > File > Export Objects > HTTP > Save All.

#### Decrypting TLS Traffic If you have the server's private key, configure Wireshark: Edit > Preferences > Protocols > TLS > (Pre)-Master-Secret log filename. Provide the key log file (e.g., from Firefox with SSLKEYLOGFILE environment variable). Then TLS streams will be decrypted.

#### Wireless Capture For Wi-Fi, use monitor mode (if supported). Capture filters: wlan.fc.type == 0 for management frames, wlan.fc.type_subtype == 8 for beacons. Use airdecap-ng to decrypt WEP/WPA if you have the key.

The exam tests practical knowledge of Wireshark filters and attack identification. You may be given a screenshot of a Wireshark capture and asked to identify the attack or the filter used. Common scenarios:

Memorize these filters: - tcp.flags.syn == 1 and tcp.flags.ack == 0 – SYN packets (scan, flood) - tcp.flags.reset == 1 – RST packets (connection refused) - icmp.type == 8 – Echo request (ping) - arp.opcode == 2 – ARP reply - http.request – HTTP requests - dns.qry.type == 1 – DNS A queries

Also know how to follow streams, use IO Graphs, and export objects.

During an internal pentest, you are given network access (e.g., plugged into a switch port). You start Wireshark on a laptop and capture traffic on the local subnet. After a few minutes, you see HTTP POST requests to a web application. Following the TCP stream reveals a login form with username 'admin' and password 'P@ssw0rd'. You also capture FTP traffic where credentials are sent in plaintext. This is a common finding: many internal applications still use unencrypted protocols. In production, companies often have legacy systems that cannot be upgraded. A pentester must document the capture and demonstrate the risk. Misconfiguration: if the switch port is not in promiscuous mode (or if port security is enabled), you may only see broadcast traffic and your own packets. To mitigate, use ARP spoofing (with tools like Bettercap) to redirect traffic through your machine, but ensure you have authorization.

You are testing an external web server. You capture traffic to the server but most is encrypted (HTTPS). To analyze application-layer data, you need the server's private key. If you have obtained the key (e.g., via misconfiguration), configure Wireshark: Edit > Preferences > Protocols > TLS > (Pre)-Master-Secret log filename. Point to the key log file. Now Wireshark decrypts TLS streams, allowing you to see HTTP requests and responses. In a real engagement, you might find sensitive data in the clear. Common scale: enterprise servers handle thousands of TLS connections; Wireshark can decrypt them if you have the session keys. However, Perfect Forward Secrecy (PFS) prevents decryption even with the private key if ephemeral Diffie-Hellman is used. In that case, you need the pre-master secret from the client, which can be captured via SSLKEYLOGFILE environment variable on the client.

During a red team exercise, you have compromised a workstation and need to detect lateral movement. You run Wireshark on the compromised host and capture outbound traffic. You notice SMB connections to multiple internal IPs on port 445. Using filter smb2, you see SMB2 Session Setup requests. Following the streams reveals NTLM authentication attempts. You can extract the NTLM challenge-response for offline cracking. This indicates the attacker is trying to move laterally using pass-the-hash. In production, monitoring SMB traffic is critical for detecting ransomware propagation. Performance: capturing on a busy server may drop packets; use a capture filter port 445 to reduce load. Misconfiguration: if the capture buffer is too small, packets may be dropped silently. Always check Wireshark's status bar for 'Dropped packets' count.