Hack Like a Pro: Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics) « Null Byte :: WonderHowTo

Welcome back, my hacker apprentices!I recentlybegana new series ondigital forensicsto show aspiring hackers what the forensic investigator can do and see while investigating a cyber attack. This is the second installment in that series and will focus upon network forensics. In other words, what can a network forensic investigator learn about the attacker during an investigation and how.Step 1: Get WiresharkAlthough there are numerous tools to do network analysis and investigations, the most widely used tool, by far, for doing so isWireshark. It's a free, network analysis tool that's ported for Windows, Unix, OS X and Linux, and you can get itfrom here. Even better, it's built into ourBackTrack, so no need to download anything, if you are using BackTrack.You can start Wireshark from the BackTrack menu by going toBackTrack->Information Gathering->Network Analysis->Network Traffic Analysisand click onWireshark.Step 2: Grab a Live CaptureNext, we need to start Wireshark, which is capable of doing analysis on pcap and other capture files, as well as a live capture. Let's do a live capture. Click onCaptureon theMenuacross the top and it will open a window like that below.Select the active interface, which in this case iseth0, as I'm running it on a wired connection.Step 3: Our ProblemHere's the problem we're faced with.Our client has been complaining that strange things are happening on his computer. His browser keeps changing his home page to a page that keeps telling him that his computer is infected with a virus, while also telling him that he needs to buy an antivirus program. We've all seen this at one time or another.In addition, his computer is running slowly and various ads keep coming up. Something has infected this system. Let's see what we can decipher about this situation.Step 4: Live CaptureWe start by sniffing the traffic on the network and we can see the live packets go by like that below.Note that Wireshark has three windows. The upper windows shows us each packet and some basic information about it. The middle window enables us to see each and every bit and byte of the packet headers. The bottom window shows us the packet contents in hexadecimal and ASCII.Step 5: Remote AttemptsThe far left column enumerates the packets in the order that they arrive. Let's look at packet 147 below. We can see a messenger packet from a device somewhere on the Internet. Let's take a closer look at this packet by clicking on it. When we do, it's details appear in the middle window in white.Since the messenger service is disabled on this network, nothing happens. We can verify that by looking at the next packet, which is an ICMP "Destination Unreachable" packet sent back to the IP requesting a messenger connection. This is suspicious activity.Step 6: Filter the TrafficWith so much traffic going by, we need to filter the traffic so we only see the traffic we are interested in. If we click on traffic between 216.49.88.118, we can see that this address is antivirus update from McAfee (note in the bottom window in the ASCII section a reference to mcafee.com).Since this traffic is not dangerous, we can remove it from our viewing by filtering it out. In this case, we want to see everything that is not coming from IP address 216.49.88.118. We can put the following filter into the filter window. When the syntax is correct it, the window background will turn green. The proper syntax to exclude an IP address is:!ip.addr == 216.49.88.118Now we have removed any traffic from our view coming from an innocuous address. This helps us focus our attention on the other, potentially malicious traffic.In the screenshot below, we have successfully filtered out the traffic to and from McAfee.Step 7: DNS QueryNow let's look down a few packets. In this screenshot, we can see that our client's computer (216.148.227.68) in the second packet shows a "standard query" with the DNS protocol to virtumonde.com. This is suspicious!If we scroll down to packet 386, we can see our client's host goes out to the virtumonde.com server and requests a download. When we click on this packet and expand its HTTP protocol in the middle window, we can see "updates.virtumonde.com\r\n."This is VERY suspicious activity and probably indicates that our client's system has been infected with a rootkit or spyware and it's reporting back to its home server.Keep coming back my aspiring hackers as we keep exploring the finer points of hacking and forensics!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)How To:Become a Computer Forensics Pro with This $29 TrainingNews:Why YOU Should Study Digital ForensicsHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)Hack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 8 (More Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)SPLOIT:Forensics with Metasploit ~ ( Recovering Deleted Files )Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 15 (Parsing Out Key Info from Memory)News:Airline Offers Frequent Flyer Miles to HackersHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 12 (Windows Prefetch Files)Hack Like a Pro:Digital Forensics Using Kali, Part 2 (Acquiring a Hard Drive Image for Analysis)How To:Why You Should Study to Be a HackerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 9 (Finding Storage Device Artifacts in the Registry)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 7 (Windows Sysinternals)Hack Like a Pro:Digital Forensics Using Kali, Part 3 (Creating Cases in Autopsy & Sleuth Kit)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 14 (Live Memory Forensics)News:What to Expect from Null Byte in 2015News:Becoming a HackerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 16 (Extracting EXIF Data from Image Files)How To:Defend your hacker space with a USB missile launcherHack Like a Pro:Getting Started with BackTrack, Your New Hacking SystemNews:Sneaky! WhatsApp Adds Encryption to iCloud Backups on the SlyHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)How To:Recover deleted text messages on an iPhoneHow To:Don't Get Caught! How to Protect Your Hard Drives from Data ForensicsGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker Training