2026-04-13 01-09-23

May 25, 2026 14:05 · 33:23 · English · Whisper Turbo · 2 Puheenvuorot
Tämä raportti päättyy tänään. Päivitys pysyvään säilytykseen →
Luennon hakemisto
Näyttää vain
0:06
S… Speaker 1 (2026-04-13 01-09-23)
In this video, we're going to take a look at both DNS and
0:10
S… Speaker 1 (2026-04-13 01-09-23)
HTTP traffic and how to potentially recognize
0:14
S… Speaker 1 (2026-04-13 01-09-23)
some of the abnormal traffic you may see while threat
0:18
S… Speaker 2 (2026-04-13 01-09-23)
hunting for both of those.
0:20
S… Speaker 1 (2026-04-13 01-09-23)
So first of all,
0:21
S… Speaker 1 (2026-04-13 01-09-23)
we're going to start looking at DNS.
0:24
S… Speaker 1 (2026-04-13 01-09-23)
DNS normally is going to be a query response protocol.
0:28
S… Speaker 1 (2026-04-13 01-09-23)
A DNS client makes a query followed by a response
0:32
S… Speaker 1 (2026-04-13 01-09-23)
from a DNS server.
0:34
S… Speaker 2 (2026-04-13 01-09-23)
Normally,
0:35
S… Speaker 1 (2026-04-13 01-09-23)
you're going to see this on port 53 using UDP.
0:40
S… Speaker 2 (2026-04-13 01-09-23)
However,
0:40
S… Speaker 1 (2026-04-13 01-09-23)
there are some legitimate uses for TCP
0:45
S… Speaker 1 (2026-04-13 01-09-23)
or for seeing DNS over TCP protocol,
0:48
S… Speaker 1 (2026-04-13 01-09-23)
mainly for larger responses
0:52
S… Speaker 1 (2026-04-13 01-09-23)
or legitimate zone transfers,
0:56
S… Speaker 1 (2026-04-13 01-09-23)
things like that.
0:58
S… Speaker 2 (2026-04-13 01-09-23)
Really,
0:59
S… Speaker 1 (2026-04-13 01-09-23)
the determination there is going to be,
1:01
S… Speaker 1 (2026-04-13 01-09-23)
is there a legitimate reason to see TCP DNS
1:06
S… Speaker 1 (2026-04-13 01-09-23)
traffic on your network,
1:07
S… Speaker 1 (2026-04-13 01-09-23)
or is there not?
1:09
S… Speaker 1 (2026-04-13 01-09-23)
That's going to be the determination there of whether or not it's suspicious
1:13
S… Speaker 1 (2026-04-13 01-09-23)
or not.
1:14
S… Speaker 1 (2026-04-13 01-09-23)
Maybe it's legitimate,
1:15
S… Speaker 1 (2026-04-13 01-09-23)
maybe it is suspicious,
1:16
S… Speaker 1 (2026-04-13 01-09-23)
something to keep an eye out,
1:18
S… Speaker 1 (2026-04-13 01-09-23)
and again, that's where all of the context comes from.
1:21
S… Speaker 2 (2026-04-13 01-09-23)
However,
1:22
S… Speaker 1 (2026-04-13 01-09-23)
regardless of what,
1:23
S… Speaker 1 (2026-04-13 01-09-23)
if it's using UDP or TCP,
1:26
S… Speaker 1 (2026-04-13 01-09-23)
The destination for DNS traffic should always be a DNS server.
1:31
S… Speaker 1 (2026-04-13 01-09-23)
If it's not going to a DNS server,
1:33
S… Speaker 1 (2026-04-13 01-09-23)
that should kind of raise some flags there about,
1:37
S… Speaker 1 (2026-04-13 01-09-23)
okay, where is this traffic going,
1:39
S… Speaker 1 (2026-04-13 01-09-23)
first of all, and what is in these actual packets?
1:43
S… Speaker 1 (2026-04-13 01-09-23)
Is this actually DNS traffic,
1:45
S… Speaker 1 (2026-04-13 01-09-23)
or is it something else that an attacker is using DNS
1:50
S… Speaker 1 (2026-04-13 01-09-23)
headers and DNS protocols to attempt to mask what they are
1:54
S… Speaker 2 (2026-04-13 01-09-23)
doing?
1:55
S… Speaker 1 (2026-04-13 01-09-23)
So let's take a look at a couple of ways for...
1:58
S… Speaker 2 (2026-04-13 01-09-23)
you know,
1:59
S… Speaker 1 (2026-04-13 01-09-23)
recognizing what suspicious DNS might be.
2:02
S… Speaker 1 (2026-04-13 01-09-23)
So again,
2:03
S… Speaker 1 (2026-04-13 01-09-23)
normally you're going to see DNS traffic is going to be on UDP
2:08
S… Speaker 2 (2026-04-13 01-09-23)
port 53.
2:09
S… Speaker 1 (2026-04-13 01-09-23)
If you see it on using TCP 53,
2:12
S… Speaker 1 (2026-04-13 01-09-23)
that could be a reason to be suspicious about the traffic.
2:16
S… Speaker 1 (2026-04-13 01-09-23)
Again, it's going to depend on your network and if there are legitimate reasons
2:21
S… Speaker 2 (2026-04-13 01-09-23)
to see it.
2:22
S… Speaker 1 (2026-04-13 01-09-23)
Again, one of those legitimate reasons would be larger responses.
2:26
S… Speaker 1 (2026-04-13 01-09-23)
that need TCP connectivity instead of UDP.
2:29
S… Speaker 2 (2026-04-13 01-09-23)
Normally,
2:30
S… Speaker 1 (2026-04-13 01-09-23)
your DNS traffic should only be going to DNS servers.
2:35
S… Speaker 1 (2026-04-13 01-09-23)
However, it'll come from any client at all,
2:39
S… Speaker 1 (2026-04-13 01-09-23)
including other DNS servers.
2:42
S… Speaker 1 (2026-04-13 01-09-23)
If that traffic is not going to a DNS server,
2:45
S… Speaker 1 (2026-04-13 01-09-23)
then you could be suspicious in nature.
2:49
S… Speaker 1 (2026-04-13 01-09-23)
Why would DNS queries or DNS traffic be going somewhere
2:54
S… Speaker 1 (2026-04-13 01-09-23)
that isn't a DNS server?
2:55
S… Speaker 2 (2026-04-13 01-09-23)
Unless,
2:56
S… Speaker 1 (2026-04-13 01-09-23)
of course, this is a response to a
3:00
S… Speaker 1 (2026-04-13 01-09-23)
query.
3:01
S… Speaker 1 (2026-04-13 01-09-23)
If it's coming from a DNS server back to the client
3:05
S… Speaker 1 (2026-04-13 01-09-23)
that requested it,
3:06
S… Speaker 1 (2026-04-13 01-09-23)
well, that's perfectly normal.
3:08
S… Speaker 1 (2026-04-13 01-09-23)
If you have DNS queries or DNS traffic going from a non -DNS
3:12
S… Speaker 1 (2026-04-13 01-09-23)
server to a non -DNS server,
3:15
S… Speaker 1 (2026-04-13 01-09-23)
that should be cause for alarm and require additional investigation.
3:21
S… Speaker 1 (2026-04-13 01-09-23)
Also,
3:22
S… Speaker 1 (2026-04-13 01-09-23)
when we're looking at DNS traffic,
3:24
S… Speaker 1 (2026-04-13 01-09-23)
I mentioned at the beginning,
3:25
S… Speaker 1 (2026-04-13 01-09-23)
it is a query and response protocol.
3:27
S… Speaker 1 (2026-04-13 01-09-23)
Normally with DNS,
3:29
S… Speaker 1 (2026-04-13 01-09-23)
there will be some sort of query from a client and then a server
3:34
S… Speaker 1 (2026-04-13 01-09-23)
sending a response to that query.
3:37
S… Speaker 1 (2026-04-13 01-09-23)
Even if the client is requesting information about a domain
3:41
S… Speaker 1 (2026-04-13 01-09-23)
that doesn't exist,
3:42
S… Speaker 1 (2026-04-13 01-09-23)
that response will still say that the domain doesn't exist.
3:47
S… Speaker 1 (2026-04-13 01-09-23)
As far as suspicious traffic there,
3:50
S… Speaker 1 (2026-04-13 01-09-23)
if you're seeing a lot of queries with no responses coming back
3:54
S… Speaker 2 (2026-04-13 01-09-23)
at all, well,
3:55
S… Speaker 1 (2026-04-13 01-09-23)
that could mean that the DNS server it's trying to talk to is maybe down.
3:58
S… Speaker 1 (2026-04-13 01-09-23)
That's a possibility,
3:59
S… Speaker 1 (2026-04-13 01-09-23)
and there's no other backups that are in place for redundancy.
4:02
S… Speaker 1 (2026-04-13 01-09-23)
Or maybe that DNS traffic isn't going to a DNS server.
4:07
S… Speaker 1 (2026-04-13 01-09-23)
Also,
4:08
S… Speaker 1 (2026-04-13 01-09-23)
if you have a lot of responses to DNS,
4:13
S… Speaker 1 (2026-04-13 01-09-23)
We'll see what a response looks like when we take a look at it in Wireshark here in a second.
4:17
S… Speaker 1 (2026-04-13 01-09-23)
But there's no associated queries with those responses.
4:20
S… Speaker 1 (2026-04-13 01-09-23)
That could be suspicious as well.
4:23
S… Speaker 1 (2026-04-13 01-09-23)
Again, remember,
4:24
S… Speaker 1 (2026-04-13 01-09-23)
suspicious is going to require
4:28
S… Speaker 1 (2026-04-13 01-09-23)
the context of what is going on on the network and
4:32
S… Speaker 1 (2026-04-13 01-09-23)
what's normal in the network as well.
4:35
S… Speaker 1 (2026-04-13 01-09-23)
So let's take a look over in our lab at Wireshark about what some of
4:39
S… Speaker 1 (2026-04-13 01-09-23)
these DNS packets actually look like,
4:42
S… Speaker 1 (2026-04-13 01-09-23)
what normal looks like,
4:44
S… Speaker 1 (2026-04-13 01-09-23)
so you know how to recognize abnormal.
4:46
S… Speaker 1 (2026-04-13 01-09-23)
And switching over to our lab environment,
4:50
S… Speaker 1 (2026-04-13 01-09-23)
got Wireshark pulled up with some DNS traffic.
4:53
S… Speaker 1 (2026-04-13 01-09-23)
There's a few different types of queries and responses here.
4:57
S… Speaker 1 (2026-04-13 01-09-23)
So let's take a look at the first one I've got highlighted.
5:00
S… Speaker 2 (2026-04-13 01-09-23)
So we can see this is Wireshark recognizes the protocol
5:04
S… Speaker 2 (2026-04-13 01-09-23)
as DNS right here,
5:05
S… Speaker 2 (2026-04-13 01-09-23)
and we see it's just going to all of them including the responses will say standard
5:10
S… Speaker 1 (2026-04-13 01-09-23)
query.
5:10
S… Speaker 2 (2026-04-13 01-09-23)
However, the responses will start out with the word response here to
5:15
S… Speaker 2 (2026-04-13 01-09-23)
easily kind of separate them out.
5:18
S… Speaker 2 (2026-04-13 01-09-23)
So what we have is the source IP address,
5:22
S… Speaker 2 (2026-04-13 01-09-23)
destination IP address.
5:23
S… Speaker 1 (2026-04-13 01-09-23)
In this case,
5:24
S… Speaker 2 (2026-04-13 01-09-23)
we see that there are responses to these queries.
5:27
S… Speaker 2 (2026-04-13 01-09-23)
So we can make the assumption that 192 .168 .17d20
5:31
S… Speaker 2 (2026-04-13 01-09-23)
is a DNS server.
5:33
S… Speaker 1 (2026-04-13 01-09-23)
So in this case,
5:34
S… Speaker 2 (2026-04-13 01-09-23)
we're requesting a text record,
5:36
S… Speaker 2 (2026-04-13 01-09-23)
txt is the type of request that's
5:40
S… Speaker 2 (2026-04-13 01-09-23)
going out, for google .com.
5:42
S… Speaker 1 (2026-04-13 01-09-23)
And if we go down here,
5:43
S… Speaker 2 (2026-04-13 01-09-23)
we can see in the query information pretty much the same information.
5:47
S… Speaker 2 (2026-04-13 01-09-23)
We're looking for a text type record for google .com,
5:51
S… Speaker 2 (2026-04-13 01-09-23)
and we see the destination port is 53,
5:55
S… Speaker 2 (2026-04-13 01-09-23)
and it is UDP as we see the user datagram
5:59
S… Speaker 2 (2026-04-13 01-09-23)
protocol right here.
6:01
S… Speaker 2 (2026-04-13 01-09-23)
So this is a normal text request for google .com.
6:05
S… Speaker 1 (2026-04-13 01-09-23)
We see, again,
6:06
S… Speaker 2 (2026-04-13 01-09-23)
UDP port 53.
6:08
S… Speaker 2 (2026-04-13 01-09-23)
And the response is kind of acknowledging the query and providing
6:12
S… Speaker 2 (2026-04-13 01-09-23)
the answers as well that we can expand and see additional
6:16
S… Speaker 2 (2026-04-13 01-09-23)
information here as well.
6:19
S… Speaker 2 (2026-04-13 01-09-23)
Very simplistic,
6:22
S… Speaker 2 (2026-04-13 01-09-23)
and we see what is in the text record that's being requested.
6:25
S… Speaker 2 (2026-04-13 01-09-23)
This appears to be an SPF record for email.
6:30
S… Speaker 2 (2026-04-13 01-09-23)
So that is a simple request and response,
6:35
S… Speaker 2 (2026-04-13 01-09-23)
and we have some additional types of requests.
6:37
S… Speaker 2 (2026-04-13 01-09-23)
They're all going to be somewhat formatted the same way in Wireshark
6:41
S… Speaker 1 (2026-04-13 01-09-23)
when we're looking at it.
6:42
S… Speaker 2 (2026-04-13 01-09-23)
This is an MX request,
6:43
S… Speaker 2 (2026-04-13 01-09-23)
and we see that down here as well,
6:45
S… Speaker 2 (2026-04-13 01-09-23)
type MX or mail exchange.
6:47
S… Speaker 2 (2026-04-13 01-09-23)
And the response provides a lot of information as
6:52
S… Speaker 2 (2026-04-13 01-09-23)
well for all of the MX records that are contained
6:56
S… Speaker 2 (2026-04-13 01-09-23)
in this record.
6:58
S… Speaker 2 (2026-04-13 01-09-23)
And we can see there are a good number of them.
7:01
S… Speaker 2 (2026-04-13 01-09-23)
And we see this is still using UDP port
7:06
S… Speaker 2 (2026-04-13 01-09-23)
53 as well.
7:08
S… Speaker 2 (2026-04-13 01-09-23)
We have some additional,
7:09
S… Speaker 2 (2026-04-13 01-09-23)
we have some A record requests.
7:12
S… Speaker 1 (2026-04-13 01-09-23)
Go down here,
7:13
S… Speaker 2 (2026-04-13 01-09-23)
we have a reverse record.
7:15
S… Speaker 2 (2026-04-13 01-09-23)
A PTR is a reverse request.
7:17
S… Speaker 2 (2026-04-13 01-09-23)
This is essentially what normal requests are going to
7:21
S… Speaker 1 (2026-04-13 01-09-23)
look like.
7:22
S… Speaker 2 (2026-04-13 01-09-23)
It's going to be the type of request and then what the request actually is.
7:26
S… Speaker 2 (2026-04-13 01-09-23)
Here's one for a name server request.
7:28
S… Speaker 2 (2026-04-13 01-09-23)
Basically, what name servers is this domain using?
7:32
S… Speaker 2 (2026-04-13 01-09-23)
We can see their responses down here as well.
7:36
S… Speaker 2 (2026-04-13 01-09-23)
Then we can also see what happens if there is a request for
7:40
S… Speaker 1 (2026-04-13 01-09-23)
a domain.
7:41
S… Speaker 1 (2026-04-13 01-09-23)
In this case,
7:41
S… Speaker 2 (2026-04-13 01-09-23)
an A record request for this domain name.
7:44
S… Speaker 2 (2026-04-13 01-09-23)
Basically, what's the IP address here?
7:46
S… Speaker 2 (2026-04-13 01-09-23)
And the response is actually,
7:47
S… Speaker 2 (2026-04-13 01-09-23)
well, there isn't one.
7:48
S… Speaker 2 (2026-04-13 01-09-23)
There is no such a record that exists.
7:52
S… Speaker 2 (2026-04-13 01-09-23)
So that's what it looks like when there is no record to return.
7:57
S… Speaker 2 (2026-04-13 01-09-23)
It's not going to be no response.
7:59
S… Speaker 2 (2026-04-13 01-09-23)
The DNS server will respond with,
8:03
S… Speaker 1 (2026-04-13 01-09-23)
we don't know,
8:04
S… Speaker 2 (2026-04-13 01-09-23)
we don't have that information.
8:06
S… Speaker 2 (2026-04-13 01-09-23)
So this is what normal DNS traffic looks like.
8:10
S… Speaker 2 (2026-04-13 01-09-23)
So really, if you're not seeing the equivalent of this,
8:13
S… Speaker 1 (2026-04-13 01-09-23)
again,
8:14
S… Speaker 2 (2026-04-13 01-09-23)
contextual information for what your network needs,
8:17
S… Speaker 2 (2026-04-13 01-09-23)
what your network is using,
8:19
S… Speaker 2 (2026-04-13 01-09-23)
then it is something that should be investigated a little further
8:23
S… Speaker 2 (2026-04-13 01-09-23)
if it needs to be,
8:25
S… Speaker 2 (2026-04-13 01-09-23)
again, based on what your network looks like.
8:28
S… Speaker 2 (2026-04-13 01-09-23)
So let's go ahead and move back and we'll take a look at HTTP
8:32
S… Speaker 2 (2026-04-13 01-09-23)
traffic now to see what normal
8:36
S… Speaker 2 (2026-04-13 01-09-23)
and abnormal looks like for that.
8:40
S… Speaker 2 (2026-04-13 01-09-23)
So similar to DNS,
8:42
S… Speaker 2 (2026-04-13 01-09-23)
HTTP traffic uses requests and responses.
8:47
S… Speaker 2 (2026-04-13 01-09-23)
Requests from the client to pull information from typically a
8:51
S… Speaker 2 (2026-04-13 01-09-23)
web server.
8:52
S… Speaker 2 (2026-04-13 01-09-23)
These are known as messages when we're talking about HTTP.
8:56
S… Speaker 2 (2026-04-13 01-09-23)
And the responses to those requests will
9:00
S… Speaker 2 (2026-04-13 01-09-23)
include some sort of three -digit,
9:03
S… Speaker 2 (2026-04-13 01-09-23)
what they call status code.
9:04
S… Speaker 2 (2026-04-13 01-09-23)
So anything in the 200 range.
9:07
S… Speaker 2 (2026-04-13 01-09-23)
means that the server is responding to it.
9:09
S… Speaker 1 (2026-04-13 01-09-23)
There's no problem.
9:10
S… Speaker 1 (2026-04-13 01-09-23)
There's no issues.
9:11
S… Speaker 2 (2026-04-13 01-09-23)
It's just sending the information back.
9:14
S… Speaker 2 (2026-04-13 01-09-23)
Something in the 300 range usually is some sort of a redirection
9:19
S… Speaker 2 (2026-04-13 01-09-23)
or something like that.
9:20
S… Speaker 2 (2026-04-13 01-09-23)
400 range is usually some sort of an error.
9:23
S… Speaker 2 (2026-04-13 01-09-23)
There's a number of different other codes that are used,
9:26
S… Speaker 2 (2026-04-13 01-09-23)
but those are some of the most common ones,
9:29
S… Speaker 2 (2026-04-13 01-09-23)
like 404 is page not found.
9:32
S… Speaker 2 (2026-04-13 01-09-23)
302 is a redirect,
9:33
S… Speaker 2 (2026-04-13 01-09-23)
things like that.
9:34
S… Speaker 2 (2026-04-13 01-09-23)
Those are what the response codes mean.
9:36
S… Speaker 2 (2026-04-13 01-09-23)
If you're looking for more information on that,
9:38
S… Speaker 2 (2026-04-13 01-09-23)
there is plenty of information to be able to see what all the response codes are,
9:42
S… Speaker 2 (2026-04-13 01-09-23)
and there's a lot of response codes.
9:45
S… Speaker 2 (2026-04-13 01-09-23)
These HTTP messages will also include a
9:49
S… Speaker 2 (2026-04-13 01-09-23)
message header for just basic information about the transfer
9:54
S… Speaker 2 (2026-04-13 01-09-23)
and about the server and things like that,
9:56
S… Speaker 2 (2026-04-13 01-09-23)
and then the message body,
9:57
S… Speaker 2 (2026-04-13 01-09-23)
which will usually be some sort of,
9:59
S… Speaker 1 (2026-04-13 01-09-23)
you know,
10:00
S… Speaker 1 (2026-04-13 01-09-23)
HTML code or CSS,
10:01
S… Speaker 1 (2026-04-13 01-09-23)
JavaScript,
10:02
S… Speaker 1 (2026-04-13 01-09-23)
whatever else like that.
10:03
S… Speaker 1 (2026-04-13 01-09-23)
And then there are methods in HTTP that are used
10:08
S… Speaker 1 (2026-04-13 01-09-23)
to just do different things,
10:10
S… Speaker 1 (2026-04-13 01-09-23)
perform various options or operations,
10:13
S… Speaker 1 (2026-04-13 01-09-23)
excuse me, on the server.
10:14
S… Speaker 1 (2026-04-13 01-09-23)
Things like there are,
10:17
S… Speaker 1 (2026-04-13 01-09-23)
well, first of all,
10:18
S… Speaker 1 (2026-04-13 01-09-23)
there are nine current methods that are in place,
10:21
S… Speaker 1 (2026-04-13 01-09-23)
and these do change sometimes as the
10:25
S… Speaker 1 (2026-04-13 01-09-23)
technology changes.
10:27
S… Speaker 2 (2026-04-13 01-09-23)
But at the moment,
10:28
S… Speaker 1 (2026-04-13 01-09-23)
at the time of recording,
10:29
S… Speaker 1 (2026-04-13 01-09-23)
there are nine different methods.
10:30
S… Speaker 1 (2026-04-13 01-09-23)
Some of those commonly used ones are get,
10:33
S… Speaker 1 (2026-04-13 01-09-23)
which is one that's used when a client is basically just trying to get
10:37
S… Speaker 1 (2026-04-13 01-09-23)
information from the server.
10:38
S… Speaker 1 (2026-04-13 01-09-23)
That's one that's very commonly used just when it's pulling down different
10:42
S… Speaker 1 (2026-04-13 01-09-23)
web pages,
10:43
S… Speaker 1 (2026-04-13 01-09-23)
JavaScript,
10:44
S… Speaker 1 (2026-04-13 01-09-23)
CSS,
10:44
S… Speaker 1 (2026-04-13 01-09-23)
things like that.
10:45
S… Speaker 1 (2026-04-13 01-09-23)
You have put,
10:47
S… Speaker 1 (2026-04-13 01-09-23)
which is used to upload information to a server.
10:49
S… Speaker 1 (2026-04-13 01-09-23)
Post, that is usually used.
10:51
S… Speaker 1 (2026-04-13 01-09-23)
for form filling activities.
10:54
S… Speaker 1 (2026-04-13 01-09-23)
There's several other different methods.
10:57
S… Speaker 1 (2026-04-13 01-09-23)
But just keep in mind,
10:58
S… Speaker 1 (2026-04-13 01-09-23)
as of right now,
10:58
S… Speaker 1 (2026-04-13 01-09-23)
there are nine different methods.
11:00
S… Speaker 1 (2026-04-13 01-09-23)
And it's important to be familiar with what they do,
11:03
S… Speaker 1 (2026-04-13 01-09-23)
especially if you're troubleshooting any kind of HTTP status codes.
11:08
S… Speaker 2 (2026-04-13 01-09-23)
Now with HTTP,
11:09
S… Speaker 1 (2026-04-13 01-09-23)
it can be a little more difficult to spot
11:14
S… Speaker 1 (2026-04-13 01-09-23)
or detect malicious traffic.
11:15
S… Speaker 1 (2026-04-13 01-09-23)
It does require a bit more digging into the actual
11:20
S… Speaker 1 (2026-04-13 01-09-23)
application information of the packets because HTTP packets
11:25
S… Speaker 1 (2026-04-13 01-09-23)
and HTTP traffic.
11:27
S… Speaker 1 (2026-04-13 01-09-23)
in general just relays a lot more information and
11:31
S… Speaker 1 (2026-04-13 01-09-23)
this is where the follow stream feature will really come in
11:35
S… Speaker 1 (2026-04-13 01-09-23)
handy in Wireshark,
11:37
S… Speaker 1 (2026-04-13 01-09-23)
assuming you're using Wireshark for any of your threat hunting,
11:39
S… Speaker 1 (2026-04-13 01-09-23)
to be able to follow the stream and follow the information a
11:44
S… Speaker 1 (2026-04-13 01-09-23)
lot easier and just be able to view the information a lot easier
11:48
S… Speaker 1 (2026-04-13 01-09-23)
as well.
11:48
S… Speaker 1 (2026-04-13 01-09-23)
So we'll take a look at normal versus suspicious
11:53
S… Speaker 1 (2026-04-13 01-09-23)
HTTP now.
11:55
S… Speaker 1 (2026-04-13 01-09-23)
Normal ports that you'll see HTTP traffic on,
11:58
S… Speaker 1 (2026-04-13 01-09-23)
and we're talking about unencrypted traffic right now.
12:01
S… Speaker 1 (2026-04-13 01-09-23)
We are not talking about HTTPS yet.
12:04
S… Speaker 1 (2026-04-13 01-09-23)
We will in a minute.
12:05
S… Speaker 2 (2026-04-13 01-09-23)
Normally,
12:07
S… Speaker 1 (2026-04-13 01-09-23)
HTTP traffic will be on port 80.
12:09
S… Speaker 1 (2026-04-13 01-09-23)
That is the standard TCP port for this traffic.
12:14
S… Speaker 1 (2026-04-13 01-09-23)
It's not uncommon to see it on other ports like port 8080
12:18
S… Speaker 1 (2026-04-13 01-09-23)
or 8088.
12:19
S… Speaker 1 (2026-04-13 01-09-23)
For public traffic,
12:22
S… Speaker 1 (2026-04-13 01-09-23)
it's almost always going to be on port 80.
12:25
S… Speaker 1 (2026-04-13 01-09-23)
There are a lot of other ports that can be used,
12:29
S… Speaker 1 (2026-04-13 01-09-23)
and this may be suspicious.
12:32
S… Speaker 1 (2026-04-13 01-09-23)
It really just depends.
12:34
S… Speaker 1 (2026-04-13 01-09-23)
Those standard ports can still be used
12:38
S… Speaker 1 (2026-04-13 01-09-23)
by attackers,
12:39
S… Speaker 1 (2026-04-13 01-09-23)
though, and are often very frequently used by attackers because
12:43
S… Speaker 1 (2026-04-13 01-09-23)
they're typically not blocked on network firewalls because
12:48
S… Speaker 1 (2026-04-13 01-09-23)
these ports are
12:49
S… Speaker 1 (2026-04-13 01-09-23)
you know, especially port 80 is required for like
12:53
S… Speaker 1 (2026-04-13 01-09-23)
normal web and internet traffic and attackers will take advantage of
12:58
S… Speaker 1 (2026-04-13 01-09-23)
that because they're typically not blocked.
13:01
S… Speaker 1 (2026-04-13 01-09-23)
With normal HTTP traffic,
13:03
S… Speaker 1 (2026-04-13 01-09-23)
this is going to be plain text traffic.
13:06
S… Speaker 1 (2026-04-13 01-09-23)
If you see encrypted information on port 80 or
13:10
S… Speaker 1 (2026-04-13 01-09-23)
another port that is using your standard HTTP headers,
13:14
S… Speaker 1 (2026-04-13 01-09-23)
and you see encrypted traffic there,
13:16
S… Speaker 1 (2026-04-13 01-09-23)
again, not HTTPS,
13:18
S… Speaker 1 (2026-04-13 01-09-23)
that is suspicious as well.
13:21
S… Speaker 1 (2026-04-13 01-09-23)
This HTTP traffic should always be plain text.
13:26
S… Speaker 1 (2026-04-13 01-09-23)
And normally when a workstation,
13:28
S… Speaker 1 (2026-04-13 01-09-23)
a browser,
13:29
S… Speaker 1 (2026-04-13 01-09-23)
anything like that is making a connection to a web server,
13:33
S… Speaker 1 (2026-04-13 01-09-23)
it's going to be using a fully qualified domain name.
13:37
S… Speaker 1 (2026-04-13 01-09-23)
We're talking about external connections to public
13:41
S… Speaker 1 (2026-04-13 01-09-23)
web servers.
13:42
S… Speaker 1 (2026-04-13 01-09-23)
On your internal enterprise network,
13:46
S… Speaker 1 (2026-04-13 01-09-23)
sometimes there may be connections to IP addresses.
13:49
S… Speaker 1 (2026-04-13 01-09-23)
Again,
13:50
S… Speaker 1 (2026-04-13 01-09-23)
this is where context of your own network is going to be important.
13:55
S… Speaker 1 (2026-04-13 01-09-23)
However,
13:55
S… Speaker 1 (2026-04-13 01-09-23)
if you see IP -based connections to external web
14:00
S… Speaker 1 (2026-04-13 01-09-23)
servers,
14:01
S… Speaker 1 (2026-04-13 01-09-23)
That is a little suspicious because that is not something
14:05
S… Speaker 1 (2026-04-13 01-09-23)
that will normally happen.
14:07
S… Speaker 1 (2026-04-13 01-09-23)
Normally, users aren't going to type in an IP address in their browser.
14:11
S… Speaker 1 (2026-04-13 01-09-23)
They're going to type in a fully qualified domain
14:15
S… Speaker 1 (2026-04-13 01-09-23)
name.
14:16
S… Speaker 1 (2026-04-13 01-09-23)
I guarantee your users don't know what IP addresses
14:20
S… Speaker 1 (2026-04-13 01-09-23)
are, and I don't know about them,
14:22
S… Speaker 1 (2026-04-13 01-09-23)
but I certainly don't remember IP addresses for Google .com
14:26
S… Speaker 1 (2026-04-13 01-09-23)
or anything like that.
14:28
S… Speaker 1 (2026-04-13 01-09-23)
So if you see HTTP connections,
14:31
S… Speaker 1 (2026-04-13 01-09-23)
especially to external servers,
14:33
S… Speaker 1 (2026-04-13 01-09-23)
using just IP addresses,
14:37
S… Speaker 1 (2026-04-13 01-09-23)
that is potentially suspicious.
14:39
S… Speaker 1 (2026-04-13 01-09-23)
And again,
14:40
S… Speaker 1 (2026-04-13 01-09-23)
not all of these are going to be definite indications of something
14:44
S… Speaker 1 (2026-04-13 01-09-23)
malicious.
14:45
S… Speaker 1 (2026-04-13 01-09-23)
A lot of your internal systems on your network may use
14:49
S… Speaker 1 (2026-04-13 01-09-23)
your non -standard ports or might use your IP -based connections
14:54
S… Speaker 1 (2026-04-13 01-09-23)
instead of fully qualified domain names.
14:56
S… Speaker 1 (2026-04-13 01-09-23)
Context is everything here.
15:00
S… Speaker 2 (2026-04-13 01-09-23)
what is important.
15:01
S… Speaker 1 (2026-04-13 01-09-23)
All right let's switch back over to our lab once again and we'll take a look
15:06
S… Speaker 2 (2026-04-13 01-09-23)
in Wireshark at what normal HTTP traffic
15:10
S… Speaker 2 (2026-04-13 01-09-23)
looks like.
15:12
S… Speaker 1 (2026-04-13 01-09-23)
Moving over to our lab,
15:14
S… Speaker 2 (2026-04-13 01-09-23)
here is a packet capture of an HTTP communication.
15:19
S… Speaker 2 (2026-04-13 01-09-23)
So because this is TCP,
15:21
S… Speaker 2 (2026-04-13 01-09-23)
we start out the very first thing with our three -way handshake.
15:25
S… Speaker 1 (2026-04-13 01-09-23)
So we have our SYN,
15:26
S… Speaker 2 (2026-04-13 01-09-23)
and we see we are going to port 80 here.
15:29
S… Speaker 2 (2026-04-13 01-09-23)
Again, that's the standard port to use,
15:31
S… Speaker 2 (2026-04-13 01-09-23)
but it doesn't necessarily mean it's always going to be that way.
15:34
S… Speaker 1 (2026-04-13 01-09-23)
So we see our three -way handshake,
15:36
S… Speaker 1 (2026-04-13 01-09-23)
SYN, SYN,
15:37
S… Speaker 1 (2026-04-13 01-09-23)
AC, AC.
15:38
S… Speaker 2 (2026-04-13 01-09-23)
Very first three packets we see in our TCP communication,
15:41
S… Speaker 2 (2026-04-13 01-09-23)
and then we immediately see our HTTP method of
15:45
S… Speaker 2 (2026-04-13 01-09-23)
get, where we are getting a specific HTML file.
15:50
S… Speaker 1 (2026-04-13 01-09-23)
So again,
15:51
S… Speaker 2 (2026-04-13 01-09-23)
using port 80 here,
15:53
S… Speaker 2 (2026-04-13 01-09-23)
we see the destination port is 80.
15:55
S… Speaker 2 (2026-04-13 01-09-23)
Source port is going to be a randomly generated port.
15:58
S… Speaker 1 (2026-04-13 01-09-23)
And we scroll down,
15:59
S… Speaker 2 (2026-04-13 01-09-23)
and we can see the actual request here.
16:02
S… Speaker 2 (2026-04-13 01-09-23)
So we are getting download .html,
16:04
S… Speaker 2 (2026-04-13 01-09-23)
and we can see additional headers that are being sent with this request.
16:09
S… Speaker 2 (2026-04-13 01-09-23)
So the host we're talking to,
16:11
S… Speaker 2 (2026-04-13 01-09-23)
the user agent.
16:13
S… Speaker 1 (2026-04-13 01-09-23)
So in this case,
16:13
S… Speaker 1 (2026-04-13 01-09-23)
we see this is a...
16:15
S… Speaker 2 (2026-04-13 01-09-23)
Probably going to be a Firefox or Mozilla -based browser on a Windows machine.
16:22
S… Speaker 2 (2026-04-13 01-09-23)
various encoding information,
16:23
S… Speaker 2 (2026-04-13 01-09-23)
language information,
16:25
S… Speaker 2 (2026-04-13 01-09-23)
things like that.
16:26
S… Speaker 2 (2026-04-13 01-09-23)
And again,
16:27
S… Speaker 2 (2026-04-13 01-09-23)
we were the referrer of where we came from,
16:30
S… Speaker 2 (2026-04-13 01-09-23)
what page we were on when we clicked on this link,
16:32
S… Speaker 2 (2026-04-13 01-09-23)
and so forth.
16:33
S… Speaker 2 (2026-04-13 01-09-23)
So a lot of the request information that is sent with the
16:37
S… Speaker 2 (2026-04-13 01-09-23)
HTTP GET request.
16:39
S… Speaker 1 (2026-04-13 01-09-23)
Now it's,
16:41
S… Speaker 2 (2026-04-13 01-09-23)
again, it can be a little difficult to follow this communication in this view.
16:45
S… Speaker 2 (2026-04-13 01-09-23)
So if we look down here,
16:47
S… Speaker 1 (2026-04-13 01-09-23)
Let's see,
16:48
S… Speaker 1 (2026-04-13 01-09-23)
scrolling through,
16:49
S… Speaker 2 (2026-04-13 01-09-23)
we see some more header information here.
16:54
S… Speaker 1 (2026-04-13 01-09-23)
And now it seems like here,
16:56
S… Speaker 2 (2026-04-13 01-09-23)
because we're looking on the side over here,
16:58
S… Speaker 2 (2026-04-13 01-09-23)
we can see we're looking at some HTML code right here potentially.
17:01
S… Speaker 2 (2026-04-13 01-09-23)
But again, a little difficult to view in this view.
17:05
S… Speaker 2 (2026-04-13 01-09-23)
So one thing I recommend,
17:07
S… Speaker 2 (2026-04-13 01-09-23)
and we've talked about this in other videos,
17:09
S… Speaker 2 (2026-04-13 01-09-23)
is to use the follow feature in Wireshark.
17:12
S… Speaker 2 (2026-04-13 01-09-23)
So we're going to follow the HTTP stream.
17:15
S… Speaker 1 (2026-04-13 01-09-23)
And we see again,
17:16
S… Speaker 2 (2026-04-13 01-09-23)
we're starting with this get download,
17:18
S… Speaker 2 (2026-04-13 01-09-23)
all the same header and request information we saw.
17:21
S… Speaker 2 (2026-04-13 01-09-23)
And then we see the HTTP response,
17:24
S… Speaker 2 (2026-04-13 01-09-23)
the 200 code,
17:26
S… Speaker 2 (2026-04-13 01-09-23)
which means here's your page,
17:27
S… Speaker 1 (2026-04-13 01-09-23)
essentially.
17:28
S… Speaker 2 (2026-04-13 01-09-23)
And then the HTML code of the page that
17:32
S… Speaker 2 (2026-04-13 01-09-23)
was requested.
17:33
S… Speaker 2 (2026-04-13 01-09-23)
And we can just keep scrolling down.
17:35
S… Speaker 1 (2026-04-13 01-09-23)
And this is everything,
17:36
S… Speaker 2 (2026-04-13 01-09-23)
again, that you would see if you right -clicked on a page and hit View
17:40
S… Speaker 1 (2026-04-13 01-09-23)
Source.
17:42
S… Speaker 2 (2026-04-13 01-09-23)
This is the easy way to view HTTP and
17:46
S… Speaker 2 (2026-04-13 01-09-23)
HTML information within Wireshark.
17:50
S… Speaker 2 (2026-04-13 01-09-23)
That is the easy way to do it.
17:52
S… Speaker 2 (2026-04-13 01-09-23)
Now, if you want to follow the entire TCP stream,
17:56
S… Speaker 2 (2026-04-13 01-09-23)
you can do that as well just by following TCP stream.
18:00
S… Speaker 1 (2026-04-13 01-09-23)
And you're going to see pretty much the same information,
18:03
S… Speaker 1 (2026-04-13 01-09-23)
at least in this case,
18:05
S… Speaker 2 (2026-04-13 01-09-23)
you'll see the same information because this TCP stream...
18:08
S… Speaker 2 (2026-04-13 01-09-23)
It was pretty much just this HTML request.
18:12
S… Speaker 1 (2026-04-13 01-09-23)
So that is the kind of simple
18:16
S… Speaker 2 (2026-04-13 01-09-23)
way to view the information.
18:18
S… Speaker 1 (2026-04-13 01-09-23)
And we can, again,
18:19
S… Speaker 2 (2026-04-13 01-09-23)
get additional information using Wireshark about what information
18:23
S… Speaker 2 (2026-04-13 01-09-23)
is in this packet capture.
18:25
S… Speaker 2 (2026-04-13 01-09-23)
We can show some of the individual information.
18:28
S… Speaker 2 (2026-04-13 01-09-23)
We can show where the communication was between.
18:30
S… Speaker 2 (2026-04-13 01-09-23)
We can see that it was HTML,
18:33
S… Speaker 1 (2026-04-13 01-09-23)
or excuse me,
18:34
S… Speaker 2 (2026-04-13 01-09-23)
we can see that it was using port 80,
18:36
S… Speaker 1 (2026-04-13 01-09-23)
using TCP.
18:37
S… Speaker 2 (2026-04-13 01-09-23)
The assumption there is going to be that it was HTTP traffic.
18:41
S… Speaker 2 (2026-04-13 01-09-23)
That doesn't necessarily mean it will be,
18:44
S… Speaker 2 (2026-04-13 01-09-23)
but that's the assumption we can make just by glancing at the
18:49
S… Speaker 1 (2026-04-13 01-09-23)
data.
18:49
S… Speaker 1 (2026-04-13 01-09-23)
And then we can also,
18:51
S… Speaker 1 (2026-04-13 01-09-23)
because it's HTML,
18:52
S… Speaker 2 (2026-04-13 01-09-23)
we can come over here to file.
18:54
S… Speaker 2 (2026-04-13 01-09-23)
export objects and look at our HTTP objects to see what
18:59
S… Speaker 2 (2026-04-13 01-09-23)
information we can pull,
19:00
S… Speaker 2 (2026-04-13 01-09-23)
and we see our download .html.
19:02
S… Speaker 1 (2026-04-13 01-09-23)
We can save this file and easily be able to view the
19:07
S… Speaker 2 (2026-04-13 01-09-23)
HTML code outside of Wireshark if we wanted to perform further
19:11
S… Speaker 2 (2026-04-13 01-09-23)
analysis during the threat hunt.
19:13
S… Speaker 2 (2026-04-13 01-09-23)
So there's a lot of information you can pull from Wireshark,
19:16
S… Speaker 1 (2026-04-13 01-09-23)
and that's...
19:18
S… Speaker 1 (2026-04-13 01-09-23)
A very simplistic example of what your HTTP
19:22
S… Speaker 2 (2026-04-13 01-09-23)
traffic will look like.
19:23
S… Speaker 2 (2026-04-13 01-09-23)
And again, we're talking about unencrypted plain text HTTP
19:28
S… Speaker 1 (2026-04-13 01-09-23)
traffic,
19:29
S… Speaker 2 (2026-04-13 01-09-23)
not HTTPS traffic.
19:32
S… Speaker 2 (2026-04-13 01-09-23)
So now that we've looked at what normal traffic looks like with this
19:36
S… Speaker 2 (2026-04-13 01-09-23)
protocol, what does abnormal traffic look like?
19:40
S… Speaker 2 (2026-04-13 01-09-23)
So here is a screenshot of some additional HTTP
19:45
S… Speaker 1 (2026-04-13 01-09-23)
traffic.
19:46
S… Speaker 1 (2026-04-13 01-09-23)
That's very similar,
19:47
S… Speaker 1 (2026-04-13 01-09-23)
and at first glance,
19:48
S… Speaker 2 (2026-04-13 01-09-23)
it may look pretty much the same.
19:51
S… Speaker 2 (2026-04-13 01-09-23)
We have our GET request starting right here.
19:54
S… Speaker 2 (2026-04-13 01-09-23)
We see we have a couple other GET requests.
19:57
S… Speaker 2 (2026-04-13 01-09-23)
There's a news .php.
20:00
S… Speaker 1 (2026-04-13 01-09-23)
This appears to be fairly standard.
20:02
S… Speaker 1 (2026-04-13 01-09-23)
There's some HTTP responses here.
20:06
S… Speaker 1 (2026-04-13 01-09-23)
There's a 200 OK.
20:07
S… Speaker 1 (2026-04-13 01-09-23)
This looks pretty normal.
20:10
S… Speaker 1 (2026-04-13 01-09-23)
However, there's one thing that kind of jumps out at us
20:14
S… Speaker 1 (2026-04-13 01-09-23)
when we're taking a deeper look at this.
20:16
S… Speaker 1 (2026-04-13 01-09-23)
And that's this section right here.
20:19
S… Speaker 1 (2026-04-13 01-09-23)
Getting news details dot PHP.
20:21
S… Speaker 1 (2026-04-13 01-09-23)
Then we have a query with an ID with a number
20:25
S… Speaker 1 (2026-04-13 01-09-23)
and then a percent 27.
20:29
S… Speaker 1 (2026-04-13 01-09-23)
When looking at HTTP and HTML and URLs specifically,
20:34
S… Speaker 1 (2026-04-13 01-09-23)
%27 is used with what's known as URL encoding.
20:38
S… Speaker 1 (2026-04-13 01-09-23)
This exact code,
20:41
S… Speaker 1 (2026-04-13 01-09-23)
%27,
20:43
S… Speaker 1 (2026-04-13 01-09-23)
decodes to a single quote.
20:46
S… Speaker 1 (2026-04-13 01-09-23)
This is a common tactic and a typical behavior when
20:51
S… Speaker 1 (2026-04-13 01-09-23)
an attacker is trying to probe for a possible SQL
20:55
S… Speaker 1 (2026-04-13 01-09-23)
injection attack.
20:56
S… Speaker 2 (2026-04-13 01-09-23)
However,
20:57
S… Speaker 1 (2026-04-13 01-09-23)
we only see this one instance here so far.
21:00
S… Speaker 1 (2026-04-13 01-09-23)
So maybe it was a typo.
21:03
S… Speaker 1 (2026-04-13 01-09-23)
Maybe they accidentally hit the button on the keyboard.
21:06
S… Speaker 1 (2026-04-13 01-09-23)
That's possible.
21:07
S… Speaker 1 (2026-04-13 01-09-23)
But it is something to be suspicious about and something that
21:11
S… Speaker 1 (2026-04-13 01-09-23)
requires additional hunting.
21:13
S… Speaker 1 (2026-04-13 01-09-23)
within this packet capture.
21:15
S… Speaker 1 (2026-04-13 01-09-23)
So we see that in there.
21:16
S… Speaker 1 (2026-04-13 01-09-23)
Let's move on within the file.
21:19
S… Speaker 1 (2026-04-13 01-09-23)
So we're taking a look here and we're seeing some additional instances
21:23
S… Speaker 1 (2026-04-13 01-09-23)
of the same thing and they're getting a little more complicated
21:28
S… Speaker 1 (2026-04-13 01-09-23)
as well.
21:29
S… Speaker 1 (2026-04-13 01-09-23)
This one specifically,
21:31
S… Speaker 1 (2026-04-13 01-09-23)
we're seeing a lot more URL coding.
21:34
S… Speaker 1 (2026-04-13 01-09-23)
One thing that jumps out at me here is %20,
21:38
S… Speaker 1 (2026-04-13 01-09-23)
which is a URL code for a space.
21:40
S… Speaker 1 (2026-04-13 01-09-23)
So we have AND,
21:43
S… Speaker 1 (2026-04-13 01-09-23)
and then we have the spaces on either side of an AND.
21:45
S… Speaker 1 (2026-04-13 01-09-23)
1 equals 1 and a semicolon.
21:48
S… Speaker 1 (2026-04-13 01-09-23)
That is a very typical way to
21:52
S… Speaker 1 (2026-04-13 01-09-23)
test for SQL injection vulnerabilities.
21:56
S… Speaker 1 (2026-04-13 01-09-23)
And we have something similar at the bottom here with a 1 equals 2
22:01
S… Speaker 1 (2026-04-13 01-09-23)
as well.
22:02
S… Speaker 1 (2026-04-13 01-09-23)
So we're seeing some definite instances that this
22:06
S… Speaker 1 (2026-04-13 01-09-23)
is a probe for a SQL injection attack.
22:10
S… Speaker 2 (2026-04-13 01-09-23)
Now,
22:11
S… Speaker 1 (2026-04-13 01-09-23)
these are not typos.
22:12
S… Speaker 1 (2026-04-13 01-09-23)
You're not going to accidentally type the word and 1 equals 1.
22:16
S… Speaker 1 (2026-04-13 01-09-23)
That's not going to be a typo.
22:18
S… Speaker 1 (2026-04-13 01-09-23)
This is definitely suspicious.
22:22
S… Speaker 1 (2026-04-13 01-09-23)
Our next step as part of the threat hunt here would be to continue
22:26
S… Speaker 1 (2026-04-13 01-09-23)
to figure out what's going on.
22:28
S… Speaker 1 (2026-04-13 01-09-23)
Is this a manual attack or is this a tool -based
22:32
S… Speaker 1 (2026-04-13 01-09-23)
attack?
22:33
S… Speaker 1 (2026-04-13 01-09-23)
So looking at some more of the information,
22:37
S… Speaker 1 (2026-04-13 01-09-23)
we see again,
22:38
S… Speaker 1 (2026-04-13 01-09-23)
we have the,
22:40
S… Speaker 1 (2026-04-13 01-09-23)
let's see,
22:42
S… Speaker 1 (2026-04-13 01-09-23)
this is the one equals two section right here that we see
22:46
S… Speaker 1 (2026-04-13 01-09-23)
in the request details.

Tämän selostuksen on tehnyt tekoäly (automaattinen puheentunnistus). Saattaa sisältää virheitä – tarkista alkuperäistä ääntä vastaan kriittiseen käyttöön. Tekoälypolitiikka

❤️ Rakastatko STT.ai:tä? Kerro ystävillesi!
Yhteenveto
Klikkaa yhteenvetoa luodaksesi tekoälyn tiivistelmän tästä selostuksesta.
Yhteenvetona...
Kysy tekoälyltä tästä transcriptistä
Kysy mitään tästä selostuksesta – tekoäly löytää asiaan liittyviä osioita ja vastaa niihin.
Ota toinen asia puheeksi