Identifying Open Ports in Wireshark; HakTip 137 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this episode of hack tip is brought to
you by citrix gotoassist the number one
global market leader in remote support
welcome to hack tip the show will we
break down concepts tools and techniques
for hackers gurus and IT ninjas I'm
Shannon Morse and today we are checking
out Wireshark with network security and
recon as in reconnaissance now if you
are working at a business you may find
that an attacker wants to get into your
network the attacker would start by
collecting publicly available
information like from your website they
can scan the website's IP address for
any open ports running services and a
way to get in or intrude on your network
oftentimes an attacker can use something
like TCP syn for TCP synchronize that
kind of scan to find out what's
available to them and if your server was
open it would reply with an
acknowledgment packet of course and then
they would have a handshake but not a
completed one since the attacker won't
be connecting yet now if a port is
closed if you've got a firewall turned
on they would either get an rst packet a
reset or none at all now this info
probably sounds familiar if you watch my
series on nmap of course and that works
scanner by the way I made a playlist of
all my hack tips series on youtube.com
slash hack 5 so you're welcome I know
everybody wanted that so I'm using an
example from Chris Sanders practical
packet analysis book again so buy this
book because it's extremely useful and
it goes into a lot of details that I
pretty much just skipped over you can
find all of his examples over at packet
captures on his website as well as chris
sanders org slash captures and there's a
huge list over there of everything that
you can find now if you look under
conversations whenever you have some
kind of attack happening so let's look
under here and let's click on
conversations so you can find that under
statistics I'll go ahead and let lit
load now whenever you see something like
this going on you would see well just
one ipv4 conversation it's between
address a and address B and that's it
and then there's a whole bunch of TCP
conversations going on which is kind of
interesting so let's
look at the very very first packet in
here so I'm going to go ahead and close
this and go up to number one packet
number one over here now when you look
at this one by clicking on it and I open
up the packet header I'm looking at the
TCP protocol on here and I click on
destination port so let me scroll down
and find that real quick
there we go destination port 443 if I
look at this and then I choose to
prepare a filter so I go up to prepare a
filter and hit selected now if I put
this in first we have destination port
equals 443 but I want to see everything
not just the destination so I erase DST
at the beginning and I press ENTER and I
get two different packets going on here
so both of these are on port 443 as we
can see from the info column but they
never replied so the server never
replied to the source so maybe in this
example the port is closed now if we
want to go back so I'm going to go ahead
and erase this and go to one that starts
with port 53 so here's one it's a packet
number nine so in this case it would be
something for DMS so I'm going to do the
same thing I'm going to go down here to
destination port I'm going to create a
filter with the selected one and I'm
going to erase DST for destination so we
can see everything happening here ah
this is kind of interesting so the
server tries to reach out to the
attacker but the attacker did not
connect ssin ending the TCP handshake so
it looks like the DNS port is actually
open hmm okay so now we can do the same
thing again this time we're going to
look for port 1 1 3 so this is going to
be like packet number 13 so here's 1 1 3
in the info tab I'll go down to
destination port create another filter
hit selected and a raised est for
destination so we get everything so in
this case we did the same thing this is
used for authentication services in this
case the port is closed or nothing is
running on it the server basically just
replied with rst or reset packets both
times that it tried to get something out
that's pretty interesting we can see
that somebody is trying to get into our
server now after the break I'm going to
show you how to find your open ports in
case you're not really sure and you have
plenty of packets going on we'll be
right back with go to assist remote
support you can provide live and
unattended support to any computer or
mobile device you can screen share with
employees to diagnose and fix their
support problems faster and more
effectively and you can use go to assist
apps to deliver support anytime anywhere
from your iPhone your iPad and your
Android device with the new seeit
feature people can stream their
smartphones camera to go to assist so
you can even see whether something's
wrong with the hardware now sign up
today for a 30-day free trial no cought
contract no credit card needed visit go
to assist comm and click on the try it
free button right now and if you
purchase a go to assist annual plan
before March 31st you'll get a free
Samsung Galaxy Tab 4 as well that's
GoToAssist comm and we thank them for
their support of hack tip we're back
with more attackers trying to get into
my server oh my gosh what am I going to
do so first off something that I want to
do is get back into the conversations
window again and I'm going to sort this
time the TCP packets by size so in order
to do that I just click on the column
header up at the top a couple of times
and it'll give me the most packets down
to the least packets so why am I doing
this well in order to see what's going
on and see which ports are open or which
ones are closed I can see how many
packets are listed for each conversation
so I'm going to hit follow stream at the
bottom to view the conversation for a
specific conversation so for example I
could do the one for my very first
conversation up here
hit follow stream and I'll go ahead and
close that since we don't need it we
just want to look at the packet headers
up here so you'll notice that the ones
with five packets those are all going to
be open ports the one with two packets
are closed or they might have a reset
happening the rest only have one packet
meaning that the ports are most likely
closed for those two now all of this can
be very very informative
formation old for you in very
explanatory as far as what's going on on
your network and it can save a lot of
money for business as well now let me
know what you think send me a comment
below or email us tips at hack 5 org and
be sure to check out our sister show
hack 5 for more great stuff just like
this I'll be there reminding you to
trust your check molest