Network Sniffing
Capturing or analysing network traffic to find credentials and cleartext protocols.
How it shows up on Hack The Box
It may be a .pcap you find on the box or tcpdump with capabilities: filter for HTTP, FTP, LDAP or Telnet and look for cleartext passwords.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Analysing a PCAP in a CTF with Wireshark and tshark 3 min read What to check first in a packet capture, how to pull FTP, HTTP, LDAP and Kerberos credentials, extract files and decrypt TLS or WiFi with Wireshark and tshark.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Wireshark y tshark › Capture
Does my ping arrive? (confirm command execution)
Attacker
sudo tcpdump -i tun0 icmp
Save a capture
sudo tcpdump -i eth0 -w captura.pcapWireshark y tshark › Analyse a pcap
TCP conversations
tshark -r captura.pcap -q -z conv,tcp
HTTP requests
tshark -r captura.pcap -Y 'http.request' -T fields -e http.host -e http.request.uri
FTP passwords
tshark -r captura.pcap -Y 'ftp.request.command == "PASS"' -T fields -e ftp.request.arg
Export files transferred over HTTP
tshark -r captura.pcap --export-objects http,objetos/
Wireshark filter for submitted forms
http.request.method == "POST"No command matches.