Network Sniffing

Budi Rahardjo
@rahard
2016

Network Layers

https://technet.microsoft.com/en-us/library/cc958821.aspx

2016

BR - Network Sniffing v.1.0

Telnet, FTP,

APPLICATION LAYER
SNIFFING
2016

BR - Network Sniffing v.1.0

Experiment Setup
Server

Client

Set telnet server

(telnetd)
Setup userid+pass

2016

Execute: telnet server

Enter:
userid+password
Execute some
commands & exit

BR - Network Sniffing v.1.0

Capture with tcpdump

Execute tcpdump (wireshark) on server /
client / attacker (on the same network) to
save in a file
tcpdumpns0wtcpdump.pcapport23

(after session, ctrl-C)

View & analyze tcpdump.pcap
Follow tcpstream
Show the captured userid + password
2016

BR - Network Sniffing v.1.0

Use ngrep
# ngrep 'USER|PASS'
interface: eth0 (167.205.22.128/255.255.255.224)
match: USER|PASS
##############
T 167.205.22.148:62045 -> 167.205.22.142:21 [AP]
USER kuliah..
####
T 167.205.22.148:62045 -> 167.205.22.142:21 [AP]
PASS takadayangtahu..
##############################^Cexit
48 received, 0 dropped
2016

BR - Network Sniffing v.1.0

Other Protocols
Use the same technique for
FTP
POP
SMTP
DNS

2016

BR - Network Sniffing v.1.0

Remarks
Show how vulnerable some
application protocols
List replacements of those protocols
with secure replacements

2016

BR - Network Sniffing v.1.0