Welcome to this tutorial.
Today I am gonna finish up with this section.
I will show you how you can actually monitor all traffic that goes on
the cloned network that you have set up on your laptop or desktop, or whatever.
Anyway, why is this important?
Well, first of all, don't get your hopes up too high.
Because you won't be able to actually get passwords,
or user credentials, by just listening to traffic.
You can, if they are not using any encrypted protocols, but
if they are using HTTPS, you can forget about it there.
That's gonna be too difficult.
I mean, there are some methods that are experimental today, but
I haven't really included them here as they are still experimental.
If you just go back a tutorial or two you have an option of SSL strip.
So you will be able to rid yourself of that encryption and
read the credentials in clear text without any problems whatsoever.
It doesn't always work with all browsers and all websites, but
like 90% of the time, it will work without any bigger problems.
Now, why then you might ask yourselves, why would we do this?
Well, you are able to see who is browsing what sort of content.
You are able to see who is logging into the back ends of the web servers.
You're able to see if somebody is using official email, or any email for
that matter.
And you are able to see who is using which type of services on the net.
And in such a way will be able to pick your target in a relatively easy fashion,
you will see who has what.
And okay, I need this, so let's go for it.
Anyway, this is not the only reason why we have accessed it,
why we have created an evil twin.
We can use it for other purposes,
such as a DNS change of the DNS servers and the router.
And, as I have stated previously, that's gonna enable us to do some wonderful
social engineering whereby we will be able to take user names,
passwords, user credentials in general, without any bigger difficulties.
But for the time being, let's just see how is traffic actually analyzed.
Let me just go ahead and clear the screen here.
Zoom it in, move it here.
For this purpose we will, of course, need a tool.
With which we can actually listen to traffic.
And that tool is called Wireshark.
That's one of many, there are others out there.
Wireshark is the most used one.
I would definitely recommend it,
but if you don't feel like it just go on the net and see what else is out there.
Now it's pretty simple, it comes with a pretty simple installation method.
So, yum search wireshark, and it should pop up here somewhere.
You need to install two packages, It will enable you to listen
to pretty much all traffic that goes through your network without any problems.
However, as I said before,
you won't be able to take passwords from encrypted traffic.
Moreover, Wireshark is, I mean, that's a course for itself and
its rather lengthy, there are a lot of options, it's a pretty sophisticated tool.
I won't go through all of the options today, but
I will show you some of the basics and
how you can actually monitor traffic based upon the information that I give you.
So you will need this package here that I am selecting, and
you will need the bottom one.
Hopefully by now, you know how to install.
It's, yum, space, install space, the name of the package, space -y.
So you wouldn't be prompted for any questions, and
it would install it without any problems.
Now I have Wireshark running here somewhere.
Yep, there we go.
Now I have opened it, and
here you can take a pick from the list of interfaces on which you wish to listen.
Our interface is of course Evil, and that is
what we want to listen to all the traffic that goes on it.
Now there isn't much traffic here,
primarily because there isn't much that is going on.
But you can see immediately there are some basic packets that are going through.
And let me just see if I can browse something on my phone, or
something of that kind.
This is just router communication.
So let's go over to Firefox over here.
I've just literally opening up a website on my phone, and that is it.
You can see that immediately the amount of traffic is jumping insanely.
Look at how much of it there is.
So all this traffic is generated basically,
well most of this traffic is generated by one single device.
And I'm gonna go ahead and
stop the capture here because I am no longer interested in this.
Over here you can see the queries.
And here you can actually see the URL from time to time.
The URL is a small piece of all of this.
But I'm not sure if I can find it now as there is a lot of it.
Look, here's one that says, standard query response,
safebrowsing.cache.l.google.com.
And you can see the IP address that was accessed from
which I do believe the response came.
Anyway, again we have something related to Google.
Again, I don't have a browser open.
There is literally no traffic going on, on my network here.
However, there is traffic that is being generated from my phone.
Or, yeah, there we go.
And this is www.google.ba.
You see here, you have the URL here that is being accessed.
And you can see that, that has been requested here.
If I just double-click on it, if I open it,
I'm gonna get a listing of pretty detailed information here.
So, domain name, if I just click on it,
there's some sort of information here, not very useful to you at the time.
But you can just go down to queries, and you can see the URL.
That is probably the most important thing for you at this particular point in time.
This is how you can actually see who is browsing for what.
Who wants what, who is going where.
Not a bad idea, pretty good thing to do, especially because you can, as I said
before, you can actually pick the targets, and you can see the IP addresses here.
I mean, you can see which IP address has requested which site.
So this first colon that you are looking at now.
Sorry, not the first colon, where it says source.
So source, IP addresses, and then you have the next one is destination IP addresses.
I'm clicking on the two of them.
So if you take a look at the top right corner, it says 192, the grey one.
It says 192.168.1.101, and then there is destination,
which is 173.194.116.225.
So, the device with this first IP address,192.168.1.101,
has requested something from the destination IP address,
173.194.116.225.
There was a communication in between these two IP addresses.
Now that can be different sorts of traffic.
And for the time being, you can disregard most of this.
What you are interested in are those URLs.
To see what sort of information are people browsing, and
you can see and get the addresses.
For example, if they're logging into their company's servers that have an external
IP address, you can actually see it here in the destination IP addresses part.
And in such a way you can go ahead, try to open it up in your browser and
see what sort of login procedures does it actually require.
How hard is it?
Is it HTTP or is it HTTPS?
It can give you a lot of information.
Now, this is just a raw overview of data.
I encourage you to expand upon this subject further.
In the upper left corner, there are filters and
here you can type in various values.
Do try to pick apart the information.
For example, I can type in DNS.
So, give me all the DNS queries,
and it's gonna give me all the DNS queries that have been made.
Which is very nice, because I now know what my phone has requested.
So look, It has CCNA.
That's for Cisco.
It has requested Google.
It has pulled some, is this an image from YouTube?
I have no idea what this is.
I don't know.
In any case, it has contacted YouTube.
Again, it went over to Google, and, yeah, there you go.
There's safe browsing, Google clients.
Yeah, okay so, I have opened up Firefox, I've seen something on Google.
I obviously can't see the search results, but I can see when a person clicks
on one of those search results and requests that particular URL.
For that purpose,
DNS filter is your friend, but it doesn't necessarily need to be.
You can just leave it empty and see how it goes.
You can also type in IP.addr == and
then you can type in the IP address.
Here for example, 192.168.1.101.
So now we have all the traffic, which has either a source, or
a destination IP address of 192.168.1.101.
So if you wish to see a traffic of a particular IP address,
you can use the filter that I have just used.
I would strongly encourage you to expand upon this subject further.
There is a course on Udemy that I have made, as well.
But you don't have to go there.
I mean, you also obviously have a great deal of knowledge on the Internet as well.
So you can explore it there.
Because Wireshark and networking traffic monitoring is a subject of its own.
That's like a course of its own.
There's a huge amount of information.
But you are able to get the basic information,
which interests you at this point of time.
In any case, I am going to wrap the tutorial up here.
And in the next chapter, we're going to get into routers and
how to break the first line of defense for pretty much any major network out there.
Until then, I bid you farewell, and I hope to see you in the next tutorial.