Wireshark 101: Wireshark with HipChat; HakTip 132 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this episode of hack tip is brought to
you by HipChat welcome to act tip the
show will we break down concepts tools
and techniques for hackers gurus and IT
ninjas I'm Shannon Morse and today we
are checking out Wireshark with our
sponsor HipChat so HipChat
is encrypted via SSL so you can work
with your team on your network and I
want to make sure that information going
through HipChat
is for sure secure so in my case I
decided to use the web browser login and
then send a few like photos and text
messages and whatnot and what forth so
this is what HipChat looks like whenever
you open it up so I sent a few pictures
to my colleagues none of them are logged
in right now but they were previously
and then I sent a couple of texts and a
few little files and a few more pictures
so I just want to make sure that this
information isn't sent out in plain text
across my network just in case anybody
else might be listening very very
important so as you can see all that
stuff came through and if I open it up
on Wireshark which I did and I was doing
a capture file during the entire thing I
don't see much HTTP in here anywhere as
I scroll up and down there are a few
things but these are resolved towards a
different IP address now if I look up
here there is one HTTP packet that I
wanted to point out to you guys so if I
scroll down on this one you'll notice
that under the get subscribe host this
is a bunch of information that you'll
most likely see if you're working with
Dropbox so every single time my drop
boss sinks you'll see this kind of
information sinking from my computer up
to the Dropbox servers so Dropbox comm
shows up several times during my packet
capture but these don't necessarily have
to do with HipChat obviously so when I
open up this fire file in Wireshark I
see all sorts of stuff happening some of
these IP addresses belong to things like
Dropbox or syncing to our Nass or
whatnot but a few things belong to the
actual HipChat servers and most of those
show up as TCP so I ran across a couple
of HTTP Dropbox packets but we're not
going to think about those we just want
to focus on
TCP packets so basically what I did to
find out if these are HipChat
IPS is just link it up on who is just a
little search database online very very
easy to do once I matched it up I was
able to figure it out
so when I look up these and I talked
about these previously in an episode
you'll notice that we have a whole bunch
of acknowledged agreements with 4-3-3
now again
4:33 is where you're going to notice
that things are using Secure Sockets
Layer so that's SSL encryption if I
scroll down a little bit you'll see that
this particular packet is an
acknowledgment to the segment six nine
one so if I double click on that we find
this TCP acknowledgment and application
data scroll down here and we see that we
have some encrypted application data
again so it is for sure encrypted that's
good to know
now after the break I will give you a
few examples of different kind of
problems that you might run across
whenever you're dealing with your own
network and how you can resolve these
using Wireshark yeah real world time
we'll be right back
how is your team communicating are they
using a variety of email I am texting
cloud storage and document sharing apps
well HipChat puts everything in one
place and is designed specifically for
businesses the solution HipChat is
instant messaging video chat document
sharing screen sharing system updates
code sharing all integrated into one
simple platform emails to slow meetings
get sidetracked and regular IMS don't
work well for groups HipChat will keep
your team in sync and it works from any
device no matter where you are the best
part of this is HipChat integrates with
the top developer tools like my favorite
github JIRA Zendesk and more in fact
there's 57 services that HipChat were
actually working with now HipChat brings
your entire project and your team
communications together and it's easy to
set up it's really fun to use it's super
simple and it makes your team wildly
productive I've been using HipChat here
to send well funny pictures of myself to
all my friends in the office as well as
code snippets for my segments on hack 5
which is extremely useful when I just
want to share that code real quick and
easy there is a freemium version which
you can use for
forever but for the next 30 days you'll
get the full version of HipChat free
which includes the bonus features of
video and screen sharing
you can try HipChat for free no credit
card required visit HipChat comm slash
hawk tip sign-up click on start chatting
and then invite a few team members and
try it for free for 30 days
remember HipChat calm / hot tips sign up
and for the first 100 signups HipChat is
going to send their 30-day free trial
for 90 days HipChat your team your
project in sync
instantly we're back with more Wireshark
now there are many common problems that
you might run into with connections and
I wanted to name off a few just to get
your creative juices flowing
so let's say that your network printer
keeps malfunctioning whenever you want
to connect to it and do like a really
long print job sometimes it works
sometimes it doesn't and it seems super
janky well in this case you would see
for example in Wireshark a TCP
acknowledged packet in Wireshark and
then the printer would receive a bunch
of packets with data but if you see a
TCP retransmission packet sent to the
printer that means that there was some
kind of disconnect somewhere in this
case you would want to test several
different computers to see if they all
have the same problem sending printer
TCP packets or just one client in this
case therefore if furthermore you can
then check your printer to see if the
issue is on the printer side or if it's
a problem that everybody is dealing with
yay Wireshark now when I worked at a
bank this was a big problem that we have
we used to have an intranet for all of
our local work and one of the branches
couldn't get to the intranet but our
main branch which is where the server
was kept had no problems so in this case
the branch would get server failures
under their dns packet header showing
that they couldn't get to the intranet
the intranet would show UDP packets sent
to the branch or TCP if the packet size
is way too big remember when we talked
about UDP and TCP that's where it comes
into play now if you are seeing a syn
packet with no response in this TCP
header it may be because there is a zone
transfer issue haha now you know now
there are tons of other problems that
you might run into with communications
but Wireshark can
really really handy so if you've ever
used Wireshark in the past I would love
to know how you dealt with issues and
how you figured out how to solve them
send me a comment below or email us tips
at hak5 org and be sure to check out our
sister show hack 5 for more great stuff
just like this I'll be there reminding
you to trust your techni lest