Wireshark 101: CloudShark Review - HakTip 144 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

today on hack tip we're reviewing an
online tool to share those packet
captures online and this episode a hack
tip is brought to you by Atlassian what
can hack tip the show will we break down
concepts tools and techniques for
hackers gurus and IT ninjas I'm Shannon
Morse and today we are checking out an
online tool for your recon from
Wireshark to share those packet capture
files online now while Wireshark and TCP
dump or Windham can definitely get you
started and help you focus on your
network
sometimes you need a tool to help you
share your pcap files with friends or
coworkers or your cat or your dog enter
clouds shark over at cloud shark dot org
this is a paid service that allows you
to upload your pcap files and view them
as if they were actually in Wireshark
now it doesn't allow you to do packet
captures like Wireshark does you can
just view and analyze them so cloud
shark is best for collaboration and
sharing obviously so today I'm going to
give you a review of cloud shark and why
this might be useful or not if you need
to share your packet captures so first
off if you haven't been following along
a pcap file is the packet capture file
you receive from Wireshark which is a
packet analyzer for networks now I have
done a whole entire series on Wireshark
which you can find over on your YouTube
playlist at youtube.com slash hak5
highly suggest watching that series in
case you haven't checked it out quite
yet and you're just joining us on hack
tip so first and foremost do not use
this cloud shark tool if the packet
capture you need to share includes
security minded content because you are
legit uploading your network info onto a
cloud service so again don't upload them
to a cloud service if they contain
sensitive content you are putting trust
into a company and their security
protocols now if you just need to share
non-sensitive pcap files for use in
education or with somebody using an iOS
device that can't necessarily use
Wireshark or with a boss who doesn't
have a clue what Wireshark is and is not
necessarily going to download then
on their Mac then it might be a good
idea to upload those files onto a cloud
service might be I will leave that
discretion up to you now signing up for
cloud shark org gives you a free trial
and after your trial is up you can pay
19 bucks a month for a personal account
and upwards from there for enterprises
and such so they really aim this towards
businesses and the like but you can't
use it for personal use as well now you
can upload a pcap file through there
drag-and-drop interface which is found
right over here and that file will now
show up under your profile along with
any others that you've uploaded as well
and you'll find the file name right here
so it's very easy to search for them you
can also import a file from a URL as
somebody else using cloud shark has a
specific one that they want to share
with you that you want to download to
and be able to analyze and you can also
search for specific ones via the search
box which is down here luckily they have
a ton of filters that you can go through
and use which is very very useful
especially if you have hundreds of
packet captures which you can
necessarily have happen if you're
analyzing a network day in and day out
so once you have everything in there you
can click table options to remove or add
any necessary columns to your list of
files there is a nifty cloud shark
plugin for Wireshark that requires an
API plugin so if you need an API token
for Wireshark so that you can do that
and automatically upload to cloud shark
that can be found under your preferences
lastly you can also refresh you can
merge a couple of different packet
captures together to see them in the
same exact capture file and you can add
tags so if there's a specific tag that
you need to add to say one capture click
there
choose your tag also put snubs and then
save your capture and that will start
showing up under your tags column if you
decide to have tags as a column entry
under your table options now if I click
on my file it's going to open and it
will look like dot dot dot
Wireshark yes it looks just like
Wireshark now after the break I am going
to show you some really really useful
tools in
cloud shark and discuss my own thoughts
on this tool and if it is necessarily
necessary for your own use today nearly
anything is possible and if we can dream
it
teams can build it so how do you bring
everyone together to create what is next
the solution teaming up with Atlassian
makers of collaboration software that
lets teams work and communicate better
together a sign track and manage tasks
for any project no matter how complex
that is the clarity of JIRA create and
share content organize results and bring
team members up to speed with the
flexibility of confluence instant
message or video chat you with your team
from any device with the freedom of
HipChat and test review and manage code
snippets in real time and that is the
power of bitbucket
you know that we do a lot of coding
around here I have used bitbucket to
share code snippets with my co-workers
and to get their feedback so that I can
make better segments for you guys
whenever I am learning new coding
languages because you know I love to
learn you can visit Atlassian comm to
learn more about how JIRA confluence
HipChat and bitbucket give your team
everything you need to organize discuss
and complete shared work Atlassian
helping teams everywhere team up to
create what's next
Atlassian comm we are now back with
cloud shark and viewing my pcap file now
if we look back over at cloud shark org
yeah
looks a little similar to Wireshark like
eerily similar for viewing and it kind
of works the same way too so at the top
you'll see this little thing called
display filters this is where you can
enter things such as TCP and then click
enter and it'll just give you the
protocols TCP in my packet capture or I
could do something a little bit more
like IP address equaling only 151 dot
what is that first one I'm going to turn
off this comment right here and I will
go over that in a moment
one 29.6 line hit enter and then we just
get those IP addresses equaling the one
that I chose
so that display filter option is going
to show me anything that I want to view
from IP addresses to protocol entries it
all the same filters as Wireshark so you
shouldn't have a problem using any
filters that you've already memorized as
well now the display filters option in
cloud shark does not give you the color
signifiers that Wireshark does so for
example if I type in TCP up here it's
not going to turn green but if I switch
over to Wireshark and type in TCP up
here it does turn green if I type
something wrong it turns red but if I
switch back over to Chrome and type in
something wrong here it does not turn
red so you're not gonna get that fancy
little signifier that you do that we've
gotten so used to in Wireshark now I
think that if clouds are implemented
that it would be really useful now the
graph allows you to zoom in on a
specific set of data based on time so if
I wanted to see just things that
happened six seconds into my my
Wireshark packet capture then I could
move it over to 6.0 26.9 and that will
just show me what happened at that time
frame so very easy and just like in
Wireshark the analysis tools help you
view the tree of layers along with a
bunch of other stuff so let's choose
protocol hierarchy and this will show me
my nice handy little graph of each of
the layers that is going on in the
stream of data I can also choose to have
conversations so I can choose a specific
protocol conversation and I'll choose
this one since there's a lot of frames
going on and you can see all those
different conversations happening
between them and then I'm gonna go ahead
and clear that and choose follow stream
so for this example let me pick a let's
see I'll do that one okay so I'm
following the stream of data from that
specific packet and this is going to
show me the ascii or hex data for tcp
and UDP packet captures and there's so
much more that you can do under that
analysis tool as well now moving on the
graph option is pretty cool if you want
to view just specific graph graphical
data about your packet capture for a
specific time so this will show you the
bytes by second or by millisecond even
and I did mention this previously this
little comment button so if I have a
specific capture in here let's say this
one I can say which black magic device
is this and then leave that there for
somebody else to comment on back so they
can always go in and analyze this data
as well as myself I find that very very
useful especially if you're working in a
place where you have lots and lots of
different devices that are online all
the time
lastly there is also a comment button
for just the entire packet capture as a
whole to do that you go over to more
info go under comments and annotations
and then I can view not only the
annotations that I've made throughout
different packet captures or throughout
different packets but also for the
entire one so this is my comment for the
entire packet capture boom and then I
can save changes so very easy to use so
here's my question to you is it worth 19
bucks a month or more you can also pay
by the year as well and might as well
mention that maybe maybe not if you are
an educator it would probably be useful
and I know a lot of educators watch the
show so you may want to consider this
since the packet captures that I share
on my show or for public use and
everybody can link to them publicly or
whatever you want it would probably be
very useful in that sense but a would I
pay 19 bucks an hour that's that's the
choice that you got to make now I would
not even consider using this if I needed
it for InfoSec for sensitive materials I
am paranoid I don't like sharing more to
the cloud than I need to
maybe that's just me but you know I
think it's a good thing to be paranoid
online now and then let me know what you
think you can send me a comment below or
you can email us tips at hack 5 org and
be sure to check out our sister show
hack 5 for more great stuff just like
this hack 5 is up for an award so you
can vote every single day until June
12th hat dot t2 t2 EU is the link for
more info on that and with that I am
Shannon Morris reminding you to trust
your Technol us