://1.bp.blogspot.com/-y5c_2BVGjVY/YHXQGikU4yI/AAAAAAAAvXc/9QZwA-24DDQoRodfHBHl2Vn9pmenrqBFQCLcBGAsYHQ/s16000/19.png <o:p

The main menu contains the following Items:<o:p <o:pFile <o:pThis menu contains items to open and merge capture files, save, print, or export capture files in different Formats<o:p

<o:p Edit<o:pThis menu contains items to find a packet, time reference or mark one or more packets, handle configuration profiles, and set your preferences; (cut, copy, and paste are not presently implemented). The Wireshark Edit menu contains the fields as shown in below image<o:p

<o:p View<o:pThis menu controls the display of the captured data, including colorization of packets, zooming the font, showing a packet in a separate window, expanding and collapsing trees in packet details.<o:p

<o:p Go<o:pThis menu contains items to go to a specific packet.<o:p

<o:p Capture<o:pThis menu allows you to start and stop captures and to edit capture filters. Some of important filters that makes our capture more efficient are described below.<o:p

<o:p Analyze<o:pThis menu contains items to manipulate display filters, enable or disable the dissection of protocols, configure user specified decodes and follow a TCP stream.<o:p

<o:p Statistics<o:pThis menu contains items to display various statistic windows, including a summary of the packets that have been captured, display protocol hierarchy statistics and much more. Some of important filters that makes our Trace analysis more efficient are described below.<o:p

<o:p

Statistics -> Protocol Hierarchy <o:p

· Presents descriptive statistics per protocol. <o:p

· Useful for determining the types, amounts, and relative proportions of protocols within a trace<o:p https://1.bp.blogspot.com/-4HZLc-5ZKn0/YHXQLm8_lKI/AAAAAAAAvXg/kYvorNlkW1gT8wbme0niXCrk-9lBSxk1QCLcBGAsYHQ/s16000/20.png <o:p

Statistics -> Conversations <o:p

· Generates descriptive statistics about each conversation for each protocol in the trace.<o:p https://1.bp.blogspot.com/-ZzuA-MPspNg/YHXQR88MmdI/AAAAAAAAvXo/QTl2Dc_tms4ruhJiApNGKBmbbYisWFiFgCLcBGAsYHQ/s16000/21.png <o:p

Statistics -> Flow Graph <o:p

· Generates a sequence graph for the selected traffic. <o:p

· Useful for understanding seq. and ack. calculations.<o:p https://1.bp.blogspot.com/-ZnSpVU0-TkE/YHXQWYMmc3I/AAAAAAAAvXw/aZBn8EJRInc5Qp3JSscclmd5D5haGg6EACLcBGAsYHQ/s16000/22.png <o:p Telephony<o:pThis menu contains items to display various telephony related statistic windows, including a media analysis, flow diagrams, display protocol hierarchy statistics and much more.<o:p

<o:p Wireless<o:pThis menu contains items to display Bluetooth and IEEE 802.11 wireless statistics.<o:p

<o:p Tools<o:pThis menu contains various tools available in Wireshark, such as creating Firewall ACL Rules.<o:p

<o:p Help<o:pThis menu contains items to help the user, e.g. access to some basic help, manual pages of the various command line tools, online access to some of the webpages, and the usual about dialog.<o:p

<o:p

The Main Toolbar<o:p

<o:p

The main toolbar provides quick access to frequently used items from the menu. This toolbar can customize by the user.<o:p https://1.bp.blogspot.com/-Rq-3Rb-x5mY/YHXQbGZpdkI/AAAAAAAAvX4/7tmaJcJxamc324N8m7xtT-3C5LNfpc-7ACLcBGAsYHQ/s16000/23.png <o:p

Actions of this filter toolbar are described below<o:p https://1.bp.blogspot.com/-VfCtQnHFwaQ/YHXQfkb2rJI/AAAAAAAAvX8/M85ezuXkFkk7D5Ndpmy6P1ohVEI4DymPQCLcBGAsYHQ/s16000/24.png <o:p https://1.bp.blogspot.com/-z2m1l4XPuEE/YHXQrIWZ6zI/AAAAAAAAvYM/e_I2e3-Mv9oB71FOnz33u2Eb-aL7gWrDQCLcBGAsYHQ/s16000/25.png <o:p

Reference: - https://ww[...]

w.wireshark.org/docs/wsug_html_chunked/ChUseMainToolbarSection.html<o:p

The Filter Toolbar<o:p

<o:p

The filter toolbar lets you quickly edit and apply display filters.<o:p https://1.bp.blogspot.com/-hegUclAPz2Q/YHXQ1CQT5tI/AAAAAAAAvYU/Ke6Frg173hUrbP7uOHjW29jGHagMo369wCLcBGAsYHQ/s16000/26.png <o:p

Actions of this filter toolbar are described below<o:p https://1.bp.blogspot.com/-S7KxTM90d-0/YHXQ64IIbJI/AAAAAAAAvYc/D54DScFsVs8ha1r5mYtFOGEjMjl2PWBVwCLcBGAsYHQ/s16000/27.png <o:p

The packet list pane<o:p

The packet list pane displays all the packets in the order they were recorded.<o:p https://1.bp.blogspot.com/-PX1qKJyWRR8/YHXQ-zPs2RI/AAAAAAAAvYg/e9owmlB60AYitV46N-08BYGJ7xgBK5WNACLcBGAsYHQ/s16000/28.png <o:p

Each line in the packet list corresponds to one packet in the capture file select the lines to get more details. More details will be displayed In the Packet details pane and packet byte panes.<o:p

There are lots of column available such as <o:p

<o:p

· No: - The number of the packet in the capture file. This number won’t change, even if a display filter is used.<o:p

· Time: - The timestamp of when the packet was captured is displayed in this column. The presentation format of this timestamp can be changed.<o:p

· Source: - The address where this packet is coming from.<o:p

· Destination: - The address where this packet is going to.<o:p

· Protocol: - The highest-level protocol that Wireshark can detect.<o:p

· Length: - The length in bytes of each packet.<o:p

· Info: - Additional information about the packet content.<o:p

<o:p

The packet details pane <o:p

The packet details pane shows the selected or current packet in detailed form.<o:p https://1.bp.blogspot.com/-PrWfIEE8edA/YHXRDcWVUXI/AAAAAAAAvYk/zz_T1NhvPxoCI4zBsMv2OxEH4_YsWgvtACLcBGAsYHQ/s16000/29.png <o:p

This above pane shows the protocols and protocol fields of the packet selected in the “packet list” pane. The protocols shown in a tree which can be expanded and collapsed.’’<o:p

<o:p

The Packet Bytes pane <o:p

The packet bytes pane shows the data of the selected or current packet in hex dump style.<o:p https://1.bp.blogspot.com/-qJVNGgZIWik/YHXRKsoHY1I/AAAAAAAAvYs/oIEA3lVjTQ0-EFBP8z2CakJhCYOdihPxACLcBGAsYHQ/s16000/30.png The packet bytes pane shows a canonical hex dump of the packet data. Each line contains the data offset, sixteen hexadecimal bytes and sixteen ASCII bytes. Non printable bytes are replaced with period “.” <o:p<o:pThe statusbar <o:p

The statusbar displays informational messages such as<o:p https://1.bp.blogspot.com/-UWFHpQf2uRY/YHXRPB6zezI/AAAAAAAAvY0/aUzVdrZ8A30Q-D78ba6g5CbgiCmFaNiHwCLcBGAsYHQ/s16000/31.png <o:p The colourized bullet<o:pOn the left side shows the highest expert information in the current loaded capture file. Hovering the mouse on the colourized bullet will show you a description of the expert information level.<o:p

<o:p The edit icon<o:pThis allows you to add a comment to the capture file using capture file properties dialog.<o:p

<o:p The middle <o:pIt shows the current number of packets in the capture file. The following values are displayed:<o:p

<o:p Packets<o:p

The number of packets is being captured.<o:p

<o:p Displayed <o:pThe number of packets is being displayed.<o:p

<o:p Marked<o:pThe number of marked packets. Only displayed if you mark any packets in the capture.<o:p Dropped<o:p

It shows the number of dropped packets. only displayed If Wireshark was unable to capture all packets.<o:p

<o:p Ignored<o:pIt shows the number of ignored packets and it will only be displayed if you ignore any of packets.<o:p

<o:p The right side<o:pit shows the selected configuration profile. Clicking on this p[...]

art of the statusbar will bring up a menu with all available configuration profiles, and selecting from this list will change the configuration profile.<o:p

<o:p https://1.bp.blogspot.com/-xi6a2dvFPHs/YHXRTTufMZI/AAAAAAAAvY8/ZHDs6JDElyEXXAdxWFHO6jGBKTg1M3emgCLcBGAsYHQ/s16000/32.png <o:p

Start packet capture <o:p

The following methods can be used to start capturing packets <o:p

<o:p

You can double-click on interface in the welcome screen of Wireshark <o:p

If you already know the name of the capture interface then you can start Wireshark from the command line by running the following command:<o:p

<o:p

Wireshark -I eth0 -k<o:p

<o:p

This will start Wireshark capturing on interface eth0 <o:p

<o:p

Working with captured packets<o:p

Once you have captured some packets you can view the packets that are displayed in packet list pane by simply clicking on a packet on a packet list pane, which will bring up the selected packet in the tree view and byte view panes. As soon you capture some traffic then you need to apply some filter to make it easily understandable. <o:p

<o:p

Wireshark has two filtering languages <o:p

· Capture filters<o:p

· Display filters<o:p

<o:p

Capture filters are used for filtering when capturing packets and display filters are used for filtering which packets are displayed. Wireshark provides a display filter language that enables you to precisely control which packets are displayed<o:p

<o:p

Display filter fields<o:p

Wireshark's display filter a bar located right above the column display section. To only display packets containing a particular protocol, type the protocol into Wireshark’s display filter toolbar Wireshark offers a list of suggestion based on the text that you typed. <o:p

<o:p

For example, to only display TCP packets, type tcp into Wireshark’s display filter toolbar.<o:p https://1.bp.blogspot.com/-NyqAdW5Qq6M/YHXRXXxSQTI/AAAAAAAAvZA/aByav3xUykUFcJ-2yphcFNYfnAXDH2jPACLcBGAsYHQ/s16000/33.png <o:p

Similarly, to only display packets containing a particular field, type the field into Wireshark’s display filter toolbar. For example, to only display HTTP requests, type http.request into Wireshark’s display filter toolbar and it will accept the expression and works as intended <o:p https://1.bp.blogspot.com/-AGLeSIQ1b1E/YHXRbSD3X0I/AAAAAAAAvZE/UTSjClc73AYIyzSi0SEnbrcfdVP60cucwCLcBGAsYHQ/s16000/34.png <o:p

Similar example of Wireshark display filter accepting an expression but it does not work as intended such as type dns and ip.addr !=10.96.203.66<o:p

<o:p https://1.bp.blogspot.com/-rcyJ6qL8SqA/YHXRfSZFHJI/AAAAAAAAvZM/TFu10OGn7g0K0_Y5QOJTQSMcMH5whp3XACLcBGAsYHQ/s16000/35.png <o:p

As you saw above the expression works but not intended.<o:p

<o:p

As we have noticed these packet captures have different colours. So, what are these colours intended for...?<o:p

Don’t get confused with different type of colour packets. These colours are intended for <o:p

· Gray – TCP packets <o:p

· Black with red letters – TCP Packets with errors<o:p

· Green – HTTP Packets<o:p

· Light Blue – UDP Packets <o:p

· Pale Blue – ARP Packets <o:p

· Lavender – ICMP Packets <o:p

· Black with green letters – ICMP Packets with errors <o:p <o:pNote: - Colourings can be changed under View -> Colouring Rules<o:p<o:p

Building Display Filter expressions.<o:p

we can build display filters that compares values using different type of comparison operator. <o:p

For example to only display packets to or from the IP address 10.96.200.253 use ip.addr==10.96.200.253 . Wireshark display filter uses Boolean expressions, so we can specify values and chain them together. A complete list of available comparison operators is shown below.<o:p

<o:p https://1.bp[...]

.blogspot.com/-Z_rKS6ZyCok/YHXRk5Qm-hI/AAAAAAAAvZU/0GLMCT8vgToS4eniAxIL2SJMcjR7xKtAQCLcBGAsYHQ/s16000/36.png <o:p

Some useful filters <o:p

Here are some filter expressions that can be used as a way to quickly review web traffic.<o:p

Let’s understand this with some sort of methods like how we are going to filter some infectious traffic.<o:p

Open the packet capture and apply the following filter: “http.request”. This filter will show all HTTP post requests. Also, you can find total no. of packets at the bottom of the Wireshark screen that are 16 of these packets. <o:p

<o:p

Filter: - http.request<o:phttps://1.bp.blogspot.com/-7flqN1yRtsY/YHXRr0qusII/AAAAAAAAvZg/Cb_Ff2WszQ0NVT7lBIqac_etcaTnqq3gwCLcBGAsYHQ/s16000/37.png <o:p

After that to reveal all the URLs for HTTP requests, Domain names we can use the following expression as a way to quickly review web traffic <o:p

<o:p http.request or ssl.handshake.type == 1<o:p<o:p

The value http.requestreveals URLs for HTTP requests, and ssl.handshake.type == 1reveal domain names used in HTTPS or SSL/TLS traffic. Filtering with this display filter can outline the flow of events for the web traffic.<o:p

<o:p https://1.bp.blogspot.com/-fw6T0TebOeo/YHXRwjsRqoI/AAAAAAAAvZo/8jsLVM2EqRYMnBHAgnbllFURjhK15Hn4gCLcBGAsYHQ/s16000/38.png <o:p

By modifying these types of filters, you can drill down the infectious traffic.<o:p

<o:p

Questionnaire<o:p

<o:p Let’s understand Wireshark with some sort of Questions <o:p<o:p Q1.Find out the total no. of TCP syn packet for port 80<o:p

<o:p Answer: -To reveal all the TCP syn packets we can use the following expression as a way to quickly review web traffic for the port 80. Also, you can find total no. of packets at the bottom of the Wireshark screen that are 4 of these packets.<o:p

<o:p Filter: - tcp.flags.syn == 1 and tcp.flags.ack == 0 && tcp.port == 80<o:p<o:p https://1.bp.blogspot.com/-CYcSreE6sTk/YHXR1t3vDAI/AAAAAAAAvZw/Xn9kCVoJXYITbcSBg9ssCR6esGVIr25bwCLcBGAsYHQ/s16000/39.png <o:p Q2.Filter out all the packet with the http response code 200.<o:p

<o:p Answer: -The value http.responsereveals URLs for HTTP responses, and HTTP status code 200means success. The client has requested documents from the server. The server has replied to the client and given the client the documents. Filtering with this display filter can outline the flow of events for the web traffic.<o:p

<o:p Filter: - http.response.code == 200<o:p<o:p https://1.bp.blogspot.com/-Gp60YIN6DYo/YHXSMrfoqTI/AAAAAAAAvaE/wqO0egj_tysiStgVkDIe5tiFip2eyK1qQCLcBGAsYHQ/s16000/40.png <o:p Q.3Attacker try to download the malicious file from www.ethereal.com. Write down the filter to identify the http host.<o:p

<o:p Answer: -In this case we have to find out the host who have visited on the malicious website. As we know each website have own URL. So simply we can find out the host by using the following expression who have visited on malicious website.<o:p

<o:p Filter: - http.host=="www.ethereal.com”<o:pOr http.host=="URL”<o:p<o:p https://1.bp.blogspot.com/---dIkSADfAc/YHXSR_iOkPI/AAAAAAAAvaI/u0WIicj3mt42Ec3_Vl5Zt4Y9LYSRosyegCLcBGAsYHQ/s16000/41.png <o:p Q4.Write down the filter to identify the destination port 23.<o:p

<o:p Answer: -Answer is quite simple… you can use the following expression to filter out the destination port 23 <o:p

<o:p Filter: - tcp.dstport == 23<o:phttps://1.bp.blogspot.com/-hvnNVDvl5dQ/YHXScTc3kJI/AAAAAAAAvaM/3sul0VPJHf42Lom2IqTTpBYmSR3XwfhHgCLcBGAsYHQ/s16000/42.png <o:p Q5.Filter out the packets on behalf of the mac address.<o:p

<o:p Answer: -Apply the following expression[...]

to filter out the traffic for the specific mac address.<o:p

<o:p Filter: - eth.addr == 00:a0:cc:3b:bf:fa <o:pOr eth.addr == “mac addr”<o:p<o:phttps://1.bp.blogspot.com/-jndGk7FA2nY/YHXShuDENyI/AAAAAAAAvaQ/wf0m4DFJGygGJQ1h8247vhpXaWvHS8v6wCLcBGAsYHQ/s16000/43.png <o:p Q6.Write down the filter to identify the IP address 10.96.203.66 for the port 80 also including the IP address 10.121.1.161. find out the total no. of packet.<o:p

<o:p Answer: -In this situation we can create our custom filter for these types of random scenarios by using logical operators such as <o:p

<o:p Filter: - ip.addr==10.96.203.66 and tcp.port==80 &&!(ip.addr==10.121.1.161)<o:p<o:p

By applying this filter, we can easily find out the total packets that are 3 of these packets. <o:p https://1.bp.blogspot.com/-WXX0c0QMieQ/YHXSrHitFKI/AAAAAAAAvaU/C1Fe3NF2VqUuVSjuzPEkUfAwne2PvGXqQCLcBGAsYHQ/s16000/44.png <o:p Q7.Find out the flag hidden in the provided pcap file that contains the user name for<o:p

1. All users of Ftp session <o:p

2. Find out the credentials used for the Telnet session <o:p

3. Find out which command is being executed during the telnet session.<o:p

<o:p Answer: -Do it by yourself. By getting the flag submit the flag in comment section.<o:p

All the best.<o:p

<o:p

You can download pcap file from here.<o:p

Dark Reading: Attacks/Breaches
Dark Reading to Upgrade Site Design, Performance

Improvements will make site content easier to navigate, faster, and more functional.

Anatomy of learning new things and keeping yourself updated in hacking

Hi homies, I hope you all are safe and doing your stuff constantly. Summer is up and we are increasing our speed:) I have so many plans to…
Read more...

Hacking on Medium
How to install dig on Kali Linux

https://cdn-images-1.medium.com/max/1341/1*QI8y97nU4nEY3YTc2Kfz5w.png
You must install dnsutils if you need to get information from DNS name servers

Continue reading on Medium »

Hacking on Medium
Web Uygulama Güvenliği Part V

https://cdn-images-1.medium.com/max/1000/1*De9UpeeHUKQbEh1PmP2aRA.jpeg
Server-side Template Injection

Continue reading on Medium »

Traitor - Automatic Linux Privesc Via Exploitation Of Low-Hanging Fruit E.G. GTFOBin
http://www.kitploit.com/2021/04/traitor-automatic-linux-privesc-via.html

Automatically exploit low-hanging fruit to pop a root shell. Linux privilege escalation (https://www.kitploit.com/search/label/Privilege%20Escalation) made easy! Traitor packages up a bunch of methods to exploit local misconfigurations (https://www.kitploit.com/search/label/Misconfigurations) and vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) (including most of GTFOBins (https://gtfobins.github.io/)) in order to pop a root shell. It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable docker.sock. More routes to root will be added over time too.
Usage
Run with no arguments to find potential vulnerabilities/misconfigurations which could allow privilege escalation. Add the -p flag if the current user password is known. The password will be requested if it's needed to analyse sudo permissions etc. traitor -p Run with the -a/--any flag to find potential vulnerabilities, attempting to exploit each, stopping if a root shell is gained. Again, add the -p flag if the current user password is known. traitor -a -p Run with the -e/--exploit flag to attempt to exploit a specific vulnerability (https://www.kitploit.com/search/label/Vulnerability) and gain a root shell. traitor -p -e docker:writable-socket
Supported Platforms
Traitor will run on all Unix-like systems, though certain exploits will only function on certain systems.
Getting Traitor
Grab a binary from the releases page (https://github.com/liamg/traitor/releases), or use go: CGO_ENABLED=0 go get -u github.com/liamg/traitor/cmd/traitor
If the machine you're attempting privesc on cannot reach GitHub to download the binary, and you have no way to upload the binary to the machine over SCP/FTP etc., then you can try base64 encoding the binary on your machine, and echoing the base64 encoded string to | base64 -d > /tmp/traitor on the target machine, remembering to chmod +x it once it arrives.

Download Traitor (https://github.com/liamg/traitor)

Traitor - Automatic Linux Privesc Via Exploitation Of Low-Hanging Fruit E.G. GTFOBin

Automatically exploit low-hanging fruit to pop a root shell. Linux privilege escalation made easy! Traitor packages up a bunch of methods to exploit local misconfigurations and vulnerabilities (including most of GTFOBins) in order to pop a root shell. It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable docker.sock. More routes to root will be added over time too.Usage Run with no arguments to find potential vulnerabilities/misconfigurations which could allow privilege escalation. Add the -p flag if the current user password is known. The password will be requested if it's needed to analyse sudo permissions etc. traitor -p Run with the -a/--any flag to find potential vulnerabilities, attempting to exploit each, stopping if a root shell is gained. Again, add the -p flag if the current user password is known. traitor -a -p Run with the -e/--exploit flag to attempt to exploit a specific vulnerability and gain a root shell. traitor -p -e docker:writable-socket Supported Platforms Traitor will run on all Unix-like systems, though certain exploits will only function on certain systems. Getting Traitor Grab a binary from the releases page, or use go: CGO_ENABLED=0 go get -u github.com/liamg/traitor/cmd/traitor If the machine you're attempting privesc on cannot reach GitHub to download the binary, and you have no way to upload the binary to the machine over SCP/FTP etc., then you can try base64 encoding the binary on your machine, and echoing the base64 encoded string to | base64 -d > /tmp/traitor on the target machine, remembering to chmod +x it once it arrives. Download Traitor
Read more...

KitPloit - PenTest Tools!
Traitor - Automatic Linux Privesc Via Exploitation Of Low-Hanging Fruit E.G. GTFOBin

https://1.bp.blogspot.com/-bwv7NyL5Egk/YG0DGYBWZCI/AAAAAAAAV2E/uzu3cSqMVocc77fl9xd5XR4nUesRIJB9ACNcBGAsYHQ/w640-h380/traitor_1_demo.gif
Automatically exploit low-hanging fruit to pop a root shell. Linux privilege escalation made easy!

Traitor packages up a bunch of methods to exploit local misconfigurations and vulnerabilities (including most of GTFOBins) in order to pop a root shell.

It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable docker.sock. More routes to root will be added over time too.
Usage

Run with no arguments to find potential vulnerabilities/misconfigurations which could allow privilege escalation. Add the -pflag if the current user password is known. The password will be requested if it's needed to analyse sudo permissions etc.

traitor -p

Run with the -a/--any flag to find potential vulnerabilities, attempting to exploit each, stopping if a root shell is gained. Again, add the -pflag if the current user password is known.

traitor -a -p

Run with the -e/--exploit flag to attempt to exploit a specific vulnerability and gain a root shell.

traitor -p -e docker:writable-socket

Supported Platforms

Traitor will run on all Unix-like systems, though certain exploits will only function on certain systems.

Getting Traitor

Grab a binary from the releases page, or use go:
CGO_ENABLED=0 go get -u github.com/liamg/traitor/cmd/traitor

If the machine you're attempting privesc on cannot reach GitHub to download the binary, and you have no way to upload the binary to the machine over SCP/FTP etc., then you can try base64 encoding the binary on your machine, and echoing the base64 encoded string to | base64 -d > /tmp/traitoron the target machine, remembering to chmod +xit once it arrives.
Download Traitor

hacking: security in practice
Bug bounty hunting step by step (practical) resources?

I've been reading books and doing courses on penetration testing and bug hunting for a while, but I find most of them point to CTFs as the place to practice a hands-on approach. I've been doing that but can't help but notice a big difference between doing CTFs and real-world bug hunting. Only a handful of them are web apps (which I will be focusing on) and the vulnerabilities don't seem "real" enough. Feels like I have all the pieces of the puzzle and the picture on the box, but I don't know the methodology that people follow to complete them.

I know that I should just jump head first into HackerOne but I would like to see someone actually working on a real bounty and try to get a feel for the process. As an example I'm looking for something like a longer version of this video by InsiderPhd.

Any tip on a book/video/course/etc would be greatly appreciated, thanks in advance!

submitted by /u/Vanthian
[link] [comments]