Wireshark & Tshark Basic Filtering

Well everyones heard of wireshark (and if you haven't you're missing out). What I want to dig more into is the filter capability it provides. This is extremely useful and can make life much easier if you know how to use them. Assuming I've already got wireshark fired up and sniffing up packets, I'll go up to the text input bar next to the Filter button and enter the following so I can filter out all traffic but the host I'm interested in.

ip.addr == 10.0.0.5

You could also just filter out your own traffic if you'd like to see everything while not having your own traffic flooding wireshark.

ip.addr != 10.0.0.2

If I had only wanted to see the packets being sent by the target host than I would use the follwing filter;

ip.src == 10.0.0.5 

or to see the packets being received by the host I could use this;

ip.dst == 10.0.0.5

We could also filter out packets for specific protocols by just specifying the protocol you'd like to filter. I.E "http", "tcp", "ssh", etc OR a specific TCP port "tcp.port == 8080".  We could also specify multiple different protocols. If perhaps we only wanted to see ssh and ftp packets we could just specify that like this;

ip.addr == 10.0.0.5 && ssh || ftp 

OR  

ip.addr == 10.0.0.5 && tcp.port == 22 || tcp.port == 21

We could also use the "and" to filter packets going back and forth to a web server like this;

ip.addr == 10.0.0.5 && ip.addr == xx.xx.xx.xx && tcp.port == 80

There are other nice filter options such as filtering everything but a certain hosts http cookies like so;

ip.addr == 10.0.0.5 && http.cookie

or if you were interested in their http requests this come in handy;

ip.addr == 10.0.0.5 && http.request

you could also view the http response;

ip.addr == 10.0.0.5 && http.request || http.response

In addition to the filters above, wireshark also provides filters for things such as yahoo messenger and AIM. If I wanted to see what our targets yahoo messenger activity is like than I would use a filter along these lines;

ip.addr == 10.0.0.5 && ymsg

We'd now see all their activity on yahoo messenger, whether it be sending a message or adding a friend.

This is where I'll wrap things up, these are just a few possible filters and should help you guys understand wireshark filters and the possible uses the provide.

Tor - Protect Your Privacy

Tor is a great tool for increasing anonymity and I highly suggest giving it a try if you haven't already. Below is some info borrowed from their site; http://www.torproject.org/

Inception

Tor was originally designed, implemented, and deployed as a third-generation onion routing project of the U.S. Naval Research Laboratory. It was originally developed with the U.S. Navy in mind, for the primary purpose of protecting government communications. Today, it is used every day for a wide variety of purposes by normal people, the military, journalists, law enforcement officers, activists, and many others.

Overview

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. Tor provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy.

You can find more information about tor here and download it from the following url;

https://www.torproject.org/download/download.html.en

Bash scripting friendly Java Ip Parser

Well I made a simple ip parser in Java to grab ips from a given file, mainly used for parsing nmap logs and writing them to a file in a list format for use with other tools. This was very useful, but I hadn't given it any thought to further automate the process by making the parser bash friendly by allowing command line arguments. Now you can tie it together with other tools of your liking with simple command like so;

nmap 192.168.1.1/24 -p 22 --open -oG sshlist; java -jar ips.jar sshlist; medusa -u root -H ips -P /root/passwords.txt -e ns -f -v 6 -O sshcrack -M ssh

You can find the edited version of the source below;

Source - http://pastebin.com/9CfyjtuG

Jar - http://www.mediafire.com/?c3hpb22nk3lj2a3

NOTE: You can remove duplicate IP's from the list by piping the Java parsers output to the unix command "uniq", which will filter out the duplicates.


java -jar ips.jar nlog | uniq > iplist.txt

Paros Proxy

Paros Proxy is another tool I've started playing with since I've began getting more into the websec side of things. It's used for evaluating web app security and performing client side attacks. It acts as a proxy and intercepts all packets going back and forth between you and the web server, giving you the ability to manipulate those packets. I was going to make a simple tutorial but this guy did a great job an explains it well, so here's his video tutorial to get an idea of how you can use Paros Proxy.