網路攻擊與封包分析- Wireshark

Security Camp 2012

網路攻擊與封包分析- Wireshark

講師：鄭毓芹博士生

服務單位:國立成功大學電機系

E-mail：[email protected]

2 Security Camp 2012

Agenda

n  Basics n What is “Network Security Analysis” ? n How useful for your security activities? n Who Uses Network Analyzers

n  Tool Introduction n About Wireshark n Sniffer Positioning n Features & Panels

n  Exercise


What is “Network Security Analysis” ?

n  Important activities for incident responders and security analyst

n  Currently data just travels around your network like a train. With a packet sniffer, get the ability to capture the data and look inside the packets to see what is actually moving along the tracks.


What is “Network Security Analysis” ?

n  Related to many security activities n Network monitoring

n To detect on-going incident n Network forensics:

n To find evidence in the specific incident n Malware analysis:

n To find capability of malware such as “sending important data to malicious servers” or “Bot command & control”

n  Process of capturing, decoding, and analyzing network traffic

5 Security Camp 2012 5

Who Uses Network Analyzers n  System administrators

n  Understand system problems and performance n  Intrusion detection

n  Malicious individuals (intruders) n  Capture cleartext data n  Passively collect data on vulnerable protocols

n  FTP, POP3, IMAP, SMATP, rlogin, HTTP, etc. n  Capture VoIP data

n  Mapping the target network n  Traffic pattern discovery

n  Actively break into the network (backdoor techniques)


Network security analysis –Flow based

n  Feature n Focus on network flow/traffic instead of each packet

n Good approach to get high level overview or accounting

n  Tools n Netflow / sFlow n MRTG/RRDTool


Network security analysis –Packet based

n  Feature n Focus on each packet or group of packets n Can analyze thoroughly but high cost

n  Tools / Techniques n Tcpdump n Wireshark / tshark


Network security analysis –Packet based (Cont.) n  Capture packet

n Don’t use Wireshark to capture packets n Avoid running Wireshark with root privilege n Use more simple program instead

n E.g. tcpdump, dumpcap

n  Analyze packet: n Wireshark is the best friend for this purpose.


Tool Introduction: About Wireshark

n  Wireshark is free and open-source tool n  Run on many OSs

n Windows / Linux / *BSD / Solaris and others n  User Interface

n GUI - Packet list / Packet details / Packet Bytes n CUI – tshark (Command line modes)

n  Many Features n Search / Filter/ Colorize / Statistics / others

n  Vulnerability: http://www.wireshark.org/security/


n  Decodes over 750 protocols n  Compatible with many other sniffers n  Plenty of online resources are available n  Supports command-line and GUI interfaces

n  TSHARK (offers command line interface) has three components

n  Editcap n  Mergecap n  text2pcap

Tool Introduction: About Wireshark (Cont.)


Tool Introduction: Sniffer Positioning


Hub

Tool Introduction: Sniffer Positioning (Cont.)


Switches

Tool Introduction: Sniffer Positioning (Cont.)

14

Wireshark (and WinPcap) Wireshark – Application for Sniffing Packets

WinPcap – open source library for packet capture

Operating System – Windows & Unix/Linux

Network Card Drivers – Ethernet/WiFi Card

Ethernet Card


Getting Wireshark

n  Download the program from n www.wireshark.org/download.html

n  Requires to install capture drivers (monitor ports and capture all traveling packets)

n Windows: winpcap (www.winpcap.org) n Linux: libpcap


Running Wireshark


Simple Capture


Capture Options


Details of the selected packet (#215)

Raw data (content of packet # 215)

Packet #215: HTTP packet


Menu Bar


Status Bar


Filtering HTTP packets

only


Right Click Filtering


Follow TCP Stream


Protocol Hierarchy


Conversations


Expert Info


Capture Filter

Security Camp 2012

Exercise 1

FTP Traffic


Exercise 1 : FTP Traffic

n  Q1: 封包擷取日期？ n  Q2: Protocol analysis ? n  Q3. FTP server's IP address is n  Q4. FTP client's IP address is n  Q5. FTP Err Code 530 means n  Q4. 10.234.125.254 attempt

Security Camp 2012

Exercise 2

Malware Communication Traffic


Exercise 2: Malware Communication Traffic

n  Q1. What kind of malicious activity did this malware do?

n  Q2. What is the malicious server's IP address?

Security Camp 2012

Exercise 3

Malicious HTTP Traffic


n  Q1. Which site and which page were defaced?

n  site n  page

n  Q2. Which URL looks malicious? n  Q3. Which software seemed to be the target

of this exploit? n  Q4. What kind of malicioius activity was

executed after exploit?


HTTP Analysis


HTTP Analysis – Load Distribution


HTTP Analysis – Packet Counter


HTTP Analysis – Requests


Export HTTP Objects


Packet Length

網路攻擊與封包分析- Wireshark

Presentations & Public Speaking

Transcript of 網路攻擊與封包分析- Wireshark