Wireshark 101: Pcapr Review - HakTip 145 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

today on hack tip we're checking out
pika burr a social network for packet
captures and this episode is brought to
you by Atlassian welcome to hack tip the
show will we break down concepts tools
and techniques for hackers gurus and IT
ninjas I am Shannon Morse and today we
are checking out a free social network
called Pete capper now Pete capper net
is a social networking site or a social
not-working site more on that in just a
little bit for folks who want to learn
about networks and protocols through
packet captures for Wireshark TCP dump
etc etc now while the site has been
around for quite some time it's also
very useful if you need to find an
example of a specific packet capture so
you can sign up for free to view and
upload your own packet captures however
the pcap files are limited to 40 48
kilobytes or 500 packets per upload so
you have to keep that in mind and the
packets need to be captured in full so
what does that mean when somebody says a
packet has to be captured in full this
can happen whenever Wireshark isn't
capturing a packet in full and it tosses
out an error like packet size limited
during capture so your actual packet
size that the byte size could be limited
to less than the total bytes that were
sent to you during that packet capture
which could arise depending on the
network that you're capturing on and any
kind of errors that are happening on
that network also all packet captures
uploaded to peak after net they are for
public use but you have to have an
account to actually view them so if your
packet has sensitive material you might
not want to upload them in the first
place but if you do want to upload one
with sensitive material you can also
upload it as a draft so a draft on peak
capper will let you edit it before
posting it publicly and you can upload
up to 5 private drafts per account on PK
Burnett now when I was testing out the
site I was unable to upload any of my
test pcap files under the limits and I
made sure I read and read them ten times
as far as what the limits are and on a
few occasions during my upload the peak
a per net site told me that my session
should had expired and I had to login
again to retry so for this review I'm
going to be relying on other publicly
available packet captures to show you
how they work but first a quick word
from this episode's sponsor today nearly
anything is possible and if we can dream
it
teams can build it so how do you bring
everyone together to create what's next
my solution teaming up with Atlassian
the makers of collaboration software
that lets teams work and communicate
better together
you can assign track and manage tasks
for any project no matter how complex
that's the clarity of JIRA create and
share content organized results and
bring team members up to speed with the
flexibility of confluence instant
message or video chat with your team
from any device with the freedom of
HipChat and my favorite testing
reviewing and managing code in real time
that's the power of bitbucket you know
that we do a lot of coding around here I
personally do because I love to learn
how to code different programs I use
bitbucket to share code snippets with my
co-workers and I get their feedback
because I work with some pretty awesome
people so I can make better segments for
you guys whenever I'm learning new
coding languages you can visit Atlassian
comm to learn more and see how JIRA
confluence HipChat and bitbucket give
your team everything you need to
organize discuss and complete shared
work Atlassian helping teams everywhere
team up to create what's next Atlassian
comm we are back with peak effort net
now I have gone ahead and logged in and
I'm in search for some kind of example
packet captures that I can view and I
can learn from so from the main page I
can go ahead and click on a whole bunch
of different options I can click into a
tag cloud and this is going to show me
any popular tags that are used for other
uploads of packet captures I can also
click on protocols and this will show me
a tag cloud of all the popular protocols
that are being used HTTP very popular go
figure
then I can go over here and click on
pcaps now this is going to give me a
listing of all the popular the recent or
the largest packet captures that have
been uploaded by other users you can
also search for specific ones up here in
the title bar and of course if you have
a URL to a direct one well I think
that's kind of obvious you just put it
the part at the top of course moving on
to the packets link and this is going to
give you a huge list of specific fields
found in the packets of these capture
files so for example I could go over to
E and if I want to specifically look for
Echo packet captures Echo data I can
choose a packet capture that has
specific information about Echo data
packets and then I can look for the
packets that I'm interested in learning
more about Echo so go ahead and find a
packet capture that you're really
interested in and open it up I'm gonna
choose one under apple this one looks
interesting now as far as viewing it you
can either download it and that's going
to download the pcap file or you can
also open up the link and open up all
the information in your browser now this
is probably obvious but I love
downloading my packet captures and
opening them up in Wireshark to view
because of the easy use and not having
to wait for a packet to actually open up
in your browser so I like to use
Wireshark but if you want to use the
browser I'll go ahead and show you how
to do that as well so by clicking on the
plus menu menu for any of these
different packet captures it's going to
give you a little drop-down menu now
this looks exactly what like what you
would find in Wireshark so if I click
over to Wireshark it's the same exact
menu as what you'll find down here in
the second window if you click on any of
the blue links such as Ethernet two
right here and then scroll down to the
bottom this is also going to show you
all the byte data at the bottom you can
also view a stream of data if you click
on actions and choose for example
reassemble and this will give me the
responses and requests for that specific
stream of data I can also select
specific data and choose just to see
just this data after are all before this
data all after or a whole conversation
of data sometimes clicking on that
doesn't work or I can go back and I can
choose to delete just this data all
before all after or conversations so I'm
looking at specifically what I need to
find in this entire packet capture now
all of those different changes that I
just made they're going to be viewable
or I can download them but you aren't
changing the original upload file so
keep that in mind nothing is changing on
pcap ernet now all in all I found peak
appers to be useful if you're just
looking the publicís
certain packet captures or if you need
to just browse on your own time but
given the Genki nosov the site like I
got logged out multiple times I had
problems uploading and the action
buttons did not always work for all the
different packet captures that I was
looking at I wouldn't use it if I was in
a time crunch now it is really fun to
browse around the site it's really fun
to learn from other captures because
it's nice that everybody has different
kind of networks so you get different
kind of data from everyone and it's
really nice to look at those so you can
learn more and more outside of your own
network but I got kind of annoyed with
the whole never-ending session expired
login again messages and notes which
would interrupt my research now let me
know what you think or send me
alternatives to peek cap or net if you
know if any of course there is the
Wireshark website where you can also
find packet captures examples you can
send me a comment below or you can email
us tips at hak5 org and be sure to check
out our sister show hak5 for more great
stuff just like this and thank you to
everybody who voted last week and with
that I am Shanna Morris reminding you to
trust your techno Leste