2019 oplossingen labo 2 - Lars Lemmens

Met dank aan de Github van Martijn en natuurlijk Lars Lemmens

LABO 2

What is the IP address of your computer?

What is the status code returned from the server to your browser?

When was the HTML file that you are retrieving last modified on the server?

'user:~$'echo -ne 'HEAD /HTTP-Wireshark-file1.html HTTP/1.1\r\nHost:  virtualhostname.x.cnw2.uclllabs.be\r\n\r\n' | nc localhost 80 | grep 'Last-Modified:'

'user:~$' • tshark -r http.pcapng -Y http -T fields -e http.last_modified

How many bytes of content are being returned to your browser?

What software and version is the web server running?

'user:~$' • tshark -r http.pcapng -Y http.server -T fields -e ip.src -e http.server | sort -u

Explain in detail the above tshark command.

What TCP ports are in use at the client and the server during your browsing session?

'user:~$' • tshark -r http.pcapng -Y http -T fields -e tcp.port | sort -u

Exercise 1:

Which HTTP method was used the most during the entire browsing session?

'user:~$' • tshark -r http.pcapng -Y http.request.method -T fields -e http.request.method | sort | uniq -c | head -1 | awk '{print $2}'
'user:~$' • tshark -r http.pcapng -Y http.request.method -T fields -e http.request.method | sort | uniq -c | awk 'NR=1{print $2}'

In case you would like to automate this: With tshark and a Bash loop"

'user:~$' • tshark -r http.pcapng -Y 'http.request.method==GET' -T fields -e tcp.srcport | sort -u | while read PORT;do tshark -r http.pcapng -Y "tcp.dstport==$PORT && http.server contains Apache" -T fields -e ip.src;done | sort -u

Exercise 2:

How many HTTP GET request messages did your browser send?

'user:~$' • tshark -r http.pcapng -Y http.request.method==GET | wc -l

To which Internet addresses were these GET requests sent?

'user:~$' • tshark -r http.pcapng -Y http.request.method==GET -T fields -e ip.dst | sort -u

Exercise 5:

Use Netcat to download these images. check the echo -ne options or use printf. If needed, slow down netcat with option -i. The image part in the HTTP stream starts after a blank line.

'user:~$'echo -ne "GET /nw2/images/image1.jpg HTTP/1.1\r\nHost: darthvader.uclllabs.be\r\n\r\n" |\ nc darthvader.uclllabs.be 80 | sed '1,/^\r/d' > image1.jpg

'user:~$'echo -ne "GET /nw2/images/image1.jpg HTTP/1.1\r\nHost: darthvader.uclllabs.be\r\n\r\n" |\ nc darthvader.uclllabs.be 80 | grep -A9999999999999999 -B0 -Pa 'JFIF' > image1.jpg

Exercise 7:

Use httpie, a cURL-like tool for humans to inspect the various HTTP headers in request and responses. Connect to various websites and explain the use of the HTTP headers.

'user:~$' • http -v -a Rey:StarWars http://darthvader.uclllabs.be/nw2/private/

Exercise 8:

A simulated phone is running at http://darthvader.uclllabs.be/nw2/phone/. Create a oneliner to bruteforce the pincode. Tip: pincode range: 1200-1300

'user:~$'for foo in {1200..1300}; do if wget -q --http-user='admin' --http-password=$foo http://darthvader.uclllabs.be/nw2/phone; then echo $foo;break;fi;done

Exercise 9:

"Put the following text.txt on your web server. This text contains the string Goed bezig :-)

Write an HTTP request by using the Range header so your web server will only return this exact string 'Goed bezig :-)'. Try to do this by only using netcat

'user:~$' • curl http://your.server.name/output.txt -i -H "Range: bytes=1-"
'user:~$'echo -ne "GET /output.txt HTTP/1.1\r\nHost: your.server.name\r\nRange: bytes=1-\r\n\r\n" | nc your.server.name 80

Exercise 10:

This can be accomplished by sending the output of tshark or tcpdump to STDOUT instead of a regular file. Direct this STDOUT stream to Wireshark running on your local computer.

'root #' • ssh myserver.X.cnw2.uclllabs.be tcpdump -nli eth0 not tcp port 22345 -s0 -w - | wireshark -nki -

'root #' • ssh myserver.X.cnw2.uclllabs.be 'tshark -nli eth0 -f "not tcp port 22345" -s0 -w -' | wireshark -nki -

Exercise 11:

Capture some HTTP traffic while browsing several websites and save it to the file http.pcapng.

You can also use the test capture in /home/logs on leia. create a CLI oneliner which parses the captured file http.pcapng and displays all HTTP server strings which do not contain Apache.

 

Only the commands tshark and sort are allowed.

'user:~$' • tshark -r http.pcapng -Y 'http.server && !(http.server contains Apache)' -T fields -e http.server | sort -u

Exercise 12:

This exercise is a small variation of the previous one. Count and sort all HTTP server strings which do not contain Apache in HTTP responses on your GET requests.

'user:~$' • tshark -r http.pcapng -Y '!(http.request.method==GET)' -T fields -e tcp.srcport | sort -u | while read PORT;do tshark -r http.pcapng -Y "tcp.dstport==$PORT && http.server && !(http.server contains Apache)" -T fields -e http.server;done | sort | uniq -c | sort -rn

Revision #1
Created 17 June 2021 14:13:05 by Jasper G.
Updated 3 December 2021 22:13:09 by Jasper G.