#wireshark

Wireshark -- is a tool to help you see what is happening on your network. It anaylzes the network protocols and captures packets being sent and received through a network connection.

It’s a packet sniffer!

So what will we SNIFF today?? HERE’S THE CHALLENGE:

link for the interceptor file: https://shell.fullstackacademy.com/static/c2e9660a916c75f416cd3ffd29cf4fc5/interceptor

Step 1.

Let’s start off by downloading the interceptor file. 

The curl (clinet user) command will work great here. Think of curl as the url browser for your terminal! We can also add the option -o (for open) to the curl command, in order to download and create the binary file into your linux terminal.

INPUT: curl -o <interceptor link>

LS to check if the file has been downloaded.

.

Step 2.

Is it downloaded? Have you tried running it? Maybe you got this:

DENIED.

Ah, but that’s okay. Our trusty sudo command can give us root access to modify the permission of this file to be changed to executable. Just make sure you know your root password to use sudo.

To modify the permission, use the chmod command with options -a (for all) + -x (for executable)

INPUT: sudo chmod a+x “interceptor”

COOL. let’s see if anything changed now.

OHOHO. the file is in green so it means the file is ready to be executed (you can also check the specific permissions of the file using: ls -l <filename>)

.

Step  3.

Whoah, whoah. Hold your horses before executing. This is where the SNIFFing starts. 

Let’s open Wireshark.

The opening menu will prompt you to select the network you want to capture. For this demonstration, we’ll select any.. ***** keep any internet browsers closed as this will pick up any packets that are going through the network.

It should look like this:

Empty?? NICE. It should be to help us sort through the traffic we want from when we run our binary file.

.

Step 4.

Okay! Now let’s go back to our terminal and run our interceptor binary (with our Wireshark open). 

When we execute the binary, we should expect to see some traffic on Wireshark.

Ohoho..... that’s some SNIFFing. There should be about 38 packets, and while that’s not too many (compared to hundereds and hundreds), we still want to find a way to narrow down our search. 

The Challenge question states that the interceptor file is a beacon for criminal activity, so we can expect these nefarious players to be interacting in this network.

Let’s make sense of the first few lines of what is being picked up!

The first 4 lines shows us making the request to a DNS server to find the host of this website. The request for tor the DNS is sent with a response confirming that the host is from “shell.fullstackacademy.com”. We can see that the host’s IP is “52.1.103.48″. Let’s take a closer look at that.

Along with the host’s IP we see the DNS server request/response followed by a TCP protocol. Notice how the next few subsequent rows show the TCP/IP protocol’s classic “3-way handshake” -- [SYN], [SYN, ACK], and [ACK].

Seeing this, we can confirm that packets are being requested and responded.

COOL. Let’s take even a CLOSER look at the packets being sent by the host’s IP.

.

Step 5.

In order to “Follow” the stream of packets, right click on the desired packet and select “Follow” --> “TCP Stream”

AHA. we’ve intercepted a message between the hackers! But the message only shows an inquiry for the password (or Flag) and not the actual flag.

Let’s keep following this TCP Stream. On the Bottom right corner , click the arrow button to go through different TCP Packets in this stream.

And thereeeee it is! We’ve successfuly intercepted the hacker’s password by SNIFFing on their traffic.

FLAG: FS{no_unencrypted_traffic_is_safe_548844}

Mcp Alternative: Mcpsnoop

Outshine Wireshark with Mcpsnoop, a new open-source MCP tool