how to use wireshark to do forensic analysis

HOW TO USE WIRESHARK TO DO FORENSIC ANALYSIS FREE

HOW TO USE WIRESHARK TO DO FORENSIC ANALYSIS FREE

Use a Hex Editor to edit the saved file You can use any free hex editor I use Be.He圎ditor (GUI-based, Free): Find the start of the receipt.docx file: Need to know the start magic number of docx Google “docx file signature”, the link: Show that the start of docx should be “PK.”ġ7 Carving Out Files – Wireshark Approachĭelete all bytes before the “PK.” (50 4b) Now the file is readable by Word! So the magic number is “50 4b 03 04” Select the correct traffic direction, and select “save data as Raw”, then “Save as…” to save it to recipe.docx But, this file still contains protocol exchange info/content We need to remove those unrelated stuffġ6 Carving Out Files – Wireshark Approach We can directly use wireshark to carve out a file But, it is suitable only for small-size file From data transfer packet#112, right click to “follow TCP stream”, The duplex connection flow will show up (both directions) We are interested in the file transferred out from Annn’s computer So only need the half-duplex flow from source IP of (12kBytes) The other half-duplex is protocol and Acknowledgement traffic from the receiver (512 bytes)ġ5 Carving Out Files – Wireshark Approach Most protocols can be identified by well-known sequences of bytes near the zero-offset Almost all file formats have “headers” with a few zero-offset bytes to uniquely identify them These first few bytes are referred as “magic numbers” We need to “carve out” the file ‘recipe.docx’ from packet captureġ4 Carving Out Files – Wireshark Approach There are many TCP packets with Ann’s computer, might be file transfer? Google search found AIM file transfer use TCP port 5190 New display filter: ip.addr = & tcp.port=5190ġ2 Q3: What is the name of the file Ann transferred?Ĭheck the first data packet after the three-way handshake (connection setup) packets, it is Packet #112 Look at the binary data section: OFT2 file transfer protocol, file name is: recipe.docxġ3 Q4: What is the magic number of the file you want to extract (first four bytes)? Just copy to a thumb drive and you're good to go >:-)ġ1 Q3: What is the name of the file Ann transferred? I just downloaded it from the file server.

No real content Packet#25 content: So, the answer is: Here's the secret recipe. The other IP in those SSL packet is: What is this IP? Use “whois” command in Linux to check So, the SSL traffic is really AIM trafficĨ AIM protocol decoding? AOL has its own communication protocol, which is complicated Luckily, Wireshark builds AOL protocol in so it can decode AOL traffic! Right-click an SSL packet, choose “Decode As…” Choose “TCP port” and value of “443”, select “AIM” in Current field, then click “Save” Now Wireshark will decode all those port-443 traffic as AIM traffic!ĩ Q1: what is the name of Ann’s IM buddy?Ĭheck Packet 25: “outgoing to : Sec558user1” Check the AIM messaging section in this packet Now we know Ann is messaging with Buddy” Sec558user1ġ0 Q2: What was the first comment in the captured IM conversation? There are no packets labeled as “AIM” protocol There are many packets labeled as “SSL” because they use TCP port 443 But, check packet content and you will see they are not encrypted! So they are not really SSL packets! They are just AIM messages using port 443, in order to make sure AIM traffic can go through most firewalls Most firewalls allow HTTP and HTTPS traffic go through The puzzle’s name has “AIM”, so Ann must use AOL Instant Messenger First, Filter on Ann’s IP address Display filter: ip.addr = What is the secret recipe?ĥ Q1: What is the name of Ann’s IM buddy? What is the magic number of the file you want to extract (first four bytes)? 5. What is the name of the file Ann transferred? 4. What was the first comment in the captured IM conversation? 3. Ann’s computer, ( ) sent IMs over the wireless network to this computer. Today an unexpected laptop briefly appeared on the company wireless network. Security staff are worried that Ann may try to leak the company’s secret recipe, and monitor her computer’s traffic.

Ann has access to the company’s prize asset, the secret recipe. suspects that one of their employees, Ann Dercover, is really a secret agent working for their competitor. Cliff ZouĮxample “Ann’s bad AIM” is from this website Puzzle #1 Solution: Ann’s Bad AIM Puzzle #1 captured file: round-1-anns-bad-aim/ “Network Forensics: tracking hackers through cyberspace”, by Sherri Davidoff and Jonathan Ham, 2012ģ “Puzzle #1: Ann’s Bad AIM” from Īnarchy-R-Us, Inc. Presentation on theme: 'Traffic Analysis– Traffic Forensic Example'- Presentation transcript:ġ Traffic Analysis– Traffic Forensic ExampleĬIS 6395, Incident Response Technologies Fall 2016, Dr.

How to use wireshark to do forensic analysis