2026-04-13 01-09-23

May 25, 2026 14:05 · 33:23 · English · Whisper Turbo · 2 דוברים
תעתיק זה פג היום. שדרוג לאחסון קבוע →
אינדקס הרצאה
מציג בלבד
0:06
S… Speaker 1 (2026-04-13 01-09-23)
In this video, we're going to take a look at both DNS and
0:10
S… Speaker 1 (2026-04-13 01-09-23)
HTTP traffic and how to potentially recognize
0:14
S… Speaker 1 (2026-04-13 01-09-23)
some of the abnormal traffic you may see while threat
0:18
S… Speaker 2 (2026-04-13 01-09-23)
hunting for both of those.
0:20
S… Speaker 1 (2026-04-13 01-09-23)
So first of all,
0:21
S… Speaker 1 (2026-04-13 01-09-23)
we're going to start looking at DNS.
0:24
S… Speaker 1 (2026-04-13 01-09-23)
DNS normally is going to be a query response protocol.
0:28
S… Speaker 1 (2026-04-13 01-09-23)
A DNS client makes a query followed by a response
0:32
S… Speaker 1 (2026-04-13 01-09-23)
from a DNS server.
0:34
S… Speaker 2 (2026-04-13 01-09-23)
Normally,
0:35
S… Speaker 1 (2026-04-13 01-09-23)
you're going to see this on port 53 using UDP.
0:40
S… Speaker 2 (2026-04-13 01-09-23)
However,
0:40
S… Speaker 1 (2026-04-13 01-09-23)
there are some legitimate uses for TCP
0:45
S… Speaker 1 (2026-04-13 01-09-23)
or for seeing DNS over TCP protocol,
0:48
S… Speaker 1 (2026-04-13 01-09-23)
mainly for larger responses
0:52
S… Speaker 1 (2026-04-13 01-09-23)
or legitimate zone transfers,
0:56
S… Speaker 1 (2026-04-13 01-09-23)
things like that.
0:58
S… Speaker 2 (2026-04-13 01-09-23)
Really,
0:59
S… Speaker 1 (2026-04-13 01-09-23)
the determination there is going to be,
1:01
S… Speaker 1 (2026-04-13 01-09-23)
is there a legitimate reason to see TCP DNS
1:06
S… Speaker 1 (2026-04-13 01-09-23)
traffic on your network,
1:07
S… Speaker 1 (2026-04-13 01-09-23)
or is there not?
1:09
S… Speaker 1 (2026-04-13 01-09-23)
That's going to be the determination there of whether or not it's suspicious
1:13
S… Speaker 1 (2026-04-13 01-09-23)
or not.
1:14
S… Speaker 1 (2026-04-13 01-09-23)
Maybe it's legitimate,
1:15
S… Speaker 1 (2026-04-13 01-09-23)
maybe it is suspicious,
1:16
S… Speaker 1 (2026-04-13 01-09-23)
something to keep an eye out,
1:18
S… Speaker 1 (2026-04-13 01-09-23)
and again, that's where all of the context comes from.
1:21
S… Speaker 2 (2026-04-13 01-09-23)
However,
1:22
S… Speaker 1 (2026-04-13 01-09-23)
regardless of what,
1:23
S… Speaker 1 (2026-04-13 01-09-23)
if it's using UDP or TCP,
1:26
S… Speaker 1 (2026-04-13 01-09-23)
The destination for DNS traffic should always be a DNS server.
1:31
S… Speaker 1 (2026-04-13 01-09-23)
If it's not going to a DNS server,
1:33
S… Speaker 1 (2026-04-13 01-09-23)
that should kind of raise some flags there about,
1:37
S… Speaker 1 (2026-04-13 01-09-23)
okay, where is this traffic going,
1:39
S… Speaker 1 (2026-04-13 01-09-23)
first of all, and what is in these actual packets?
1:43
S… Speaker 1 (2026-04-13 01-09-23)
Is this actually DNS traffic,
1:45
S… Speaker 1 (2026-04-13 01-09-23)
or is it something else that an attacker is using DNS
1:50
S… Speaker 1 (2026-04-13 01-09-23)
headers and DNS protocols to attempt to mask what they are
1:54
S… Speaker 2 (2026-04-13 01-09-23)
doing?
1:55
S… Speaker 1 (2026-04-13 01-09-23)
So let's take a look at a couple of ways for...
1:58
S… Speaker 2 (2026-04-13 01-09-23)
you know,
1:59
S… Speaker 1 (2026-04-13 01-09-23)
recognizing what suspicious DNS might be.
2:02
S… Speaker 1 (2026-04-13 01-09-23)
So again,
2:03
S… Speaker 1 (2026-04-13 01-09-23)
normally you're going to see DNS traffic is going to be on UDP
2:08
S… Speaker 2 (2026-04-13 01-09-23)
port 53.
2:09
S… Speaker 1 (2026-04-13 01-09-23)
If you see it on using TCP 53,
2:12
S… Speaker 1 (2026-04-13 01-09-23)
that could be a reason to be suspicious about the traffic.
2:16
S… Speaker 1 (2026-04-13 01-09-23)
Again, it's going to depend on your network and if there are legitimate reasons
2:21
S… Speaker 2 (2026-04-13 01-09-23)
to see it.
2:22
S… Speaker 1 (2026-04-13 01-09-23)
Again, one of those legitimate reasons would be larger responses.
2:26
S… Speaker 1 (2026-04-13 01-09-23)
that need TCP connectivity instead of UDP.
2:29
S… Speaker 2 (2026-04-13 01-09-23)
Normally,
2:30
S… Speaker 1 (2026-04-13 01-09-23)
your DNS traffic should only be going to DNS servers.
2:35
S… Speaker 1 (2026-04-13 01-09-23)
However, it'll come from any client at all,
2:39
S… Speaker 1 (2026-04-13 01-09-23)
including other DNS servers.
2:42
S… Speaker 1 (2026-04-13 01-09-23)
If that traffic is not going to a DNS server,
2:45
S… Speaker 1 (2026-04-13 01-09-23)
then you could be suspicious in nature.
2:49
S… Speaker 1 (2026-04-13 01-09-23)
Why would DNS queries or DNS traffic be going somewhere
2:54
S… Speaker 1 (2026-04-13 01-09-23)
that isn't a DNS server?
2:55
S… Speaker 2 (2026-04-13 01-09-23)
Unless,
2:56
S… Speaker 1 (2026-04-13 01-09-23)
of course, this is a response to a
3:00
S… Speaker 1 (2026-04-13 01-09-23)
query.
3:01
S… Speaker 1 (2026-04-13 01-09-23)
If it's coming from a DNS server back to the client
3:05
S… Speaker 1 (2026-04-13 01-09-23)
that requested it,
3:06
S… Speaker 1 (2026-04-13 01-09-23)
well, that's perfectly normal.
3:08
S… Speaker 1 (2026-04-13 01-09-23)
If you have DNS queries or DNS traffic going from a non -DNS
3:12
S… Speaker 1 (2026-04-13 01-09-23)
server to a non -DNS server,
3:15
S… Speaker 1 (2026-04-13 01-09-23)
that should be cause for alarm and require additional investigation.
3:21
S… Speaker 1 (2026-04-13 01-09-23)
Also,
3:22
S… Speaker 1 (2026-04-13 01-09-23)
when we're looking at DNS traffic,
3:24
S… Speaker 1 (2026-04-13 01-09-23)
I mentioned at the beginning,
3:25
S… Speaker 1 (2026-04-13 01-09-23)
it is a query and response protocol.
3:27
S… Speaker 1 (2026-04-13 01-09-23)
Normally with DNS,
3:29
S… Speaker 1 (2026-04-13 01-09-23)
there will be some sort of query from a client and then a server
3:34
S… Speaker 1 (2026-04-13 01-09-23)
sending a response to that query.
3:37
S… Speaker 1 (2026-04-13 01-09-23)
Even if the client is requesting information about a domain
3:41
S… Speaker 1 (2026-04-13 01-09-23)
that doesn't exist,
3:42
S… Speaker 1 (2026-04-13 01-09-23)
that response will still say that the domain doesn't exist.
3:47
S… Speaker 1 (2026-04-13 01-09-23)
As far as suspicious traffic there,
3:50
S… Speaker 1 (2026-04-13 01-09-23)
if you're seeing a lot of queries with no responses coming back
3:54
S… Speaker 2 (2026-04-13 01-09-23)
at all, well,
3:55
S… Speaker 1 (2026-04-13 01-09-23)
that could mean that the DNS server it's trying to talk to is maybe down.
3:58
S… Speaker 1 (2026-04-13 01-09-23)
That's a possibility,
3:59
S… Speaker 1 (2026-04-13 01-09-23)
and there's no other backups that are in place for redundancy.
4:02
S… Speaker 1 (2026-04-13 01-09-23)
Or maybe that DNS traffic isn't going to a DNS server.
4:07
S… Speaker 1 (2026-04-13 01-09-23)
Also,
4:08
S… Speaker 1 (2026-04-13 01-09-23)
if you have a lot of responses to DNS,
4:13
S… Speaker 1 (2026-04-13 01-09-23)
We'll see what a response looks like when we take a look at it in Wireshark here in a second.
4:17
S… Speaker 1 (2026-04-13 01-09-23)
But there's no associated queries with those responses.
4:20
S… Speaker 1 (2026-04-13 01-09-23)
That could be suspicious as well.
4:23
S… Speaker 1 (2026-04-13 01-09-23)
Again, remember,
4:24
S… Speaker 1 (2026-04-13 01-09-23)
suspicious is going to require
4:28
S… Speaker 1 (2026-04-13 01-09-23)
the context of what is going on on the network and
4:32
S… Speaker 1 (2026-04-13 01-09-23)
what's normal in the network as well.
4:35
S… Speaker 1 (2026-04-13 01-09-23)
So let's take a look over in our lab at Wireshark about what some of
4:39
S… Speaker 1 (2026-04-13 01-09-23)
these DNS packets actually look like,
4:42
S… Speaker 1 (2026-04-13 01-09-23)
what normal looks like,
4:44
S… Speaker 1 (2026-04-13 01-09-23)
so you know how to recognize abnormal.
4:46
S… Speaker 1 (2026-04-13 01-09-23)
And switching over to our lab environment,
4:50
S… Speaker 1 (2026-04-13 01-09-23)
got Wireshark pulled up with some DNS traffic.
4:53
S… Speaker 1 (2026-04-13 01-09-23)
There's a few different types of queries and responses here.
4:57
S… Speaker 1 (2026-04-13 01-09-23)
So let's take a look at the first one I've got highlighted.
5:00
S… Speaker 2 (2026-04-13 01-09-23)
So we can see this is Wireshark recognizes the protocol
5:04
S… Speaker 2 (2026-04-13 01-09-23)
as DNS right here,
5:05
S… Speaker 2 (2026-04-13 01-09-23)
and we see it's just going to all of them including the responses will say standard
5:10
S… Speaker 1 (2026-04-13 01-09-23)
query.
5:10
S… Speaker 2 (2026-04-13 01-09-23)
However, the responses will start out with the word response here to
5:15
S… Speaker 2 (2026-04-13 01-09-23)
easily kind of separate them out.
5:18
S… Speaker 2 (2026-04-13 01-09-23)
So what we have is the source IP address,
5:22
S… Speaker 2 (2026-04-13 01-09-23)
destination IP address.
5:23
S… Speaker 1 (2026-04-13 01-09-23)
In this case,
5:24
S… Speaker 2 (2026-04-13 01-09-23)
we see that there are responses to these queries.
5:27
S… Speaker 2 (2026-04-13 01-09-23)
So we can make the assumption that 192 .168 .17d20
5:31
S… Speaker 2 (2026-04-13 01-09-23)
is a DNS server.
5:33
S… Speaker 1 (2026-04-13 01-09-23)
So in this case,
5:34
S… Speaker 2 (2026-04-13 01-09-23)
we're requesting a text record,
5:36
S… Speaker 2 (2026-04-13 01-09-23)
txt is the type of request that's
5:40
S… Speaker 2 (2026-04-13 01-09-23)
going out, for google .com.
5:42
S… Speaker 1 (2026-04-13 01-09-23)
And if we go down here,
5:43
S… Speaker 2 (2026-04-13 01-09-23)
we can see in the query information pretty much the same information.
5:47
S… Speaker 2 (2026-04-13 01-09-23)
We're looking for a text type record for google .com,
5:51
S… Speaker 2 (2026-04-13 01-09-23)
and we see the destination port is 53,
5:55
S… Speaker 2 (2026-04-13 01-09-23)
and it is UDP as we see the user datagram
5:59
S… Speaker 2 (2026-04-13 01-09-23)
protocol right here.
6:01
S… Speaker 2 (2026-04-13 01-09-23)
So this is a normal text request for google .com.
6:05
S… Speaker 1 (2026-04-13 01-09-23)
We see, again,
6:06
S… Speaker 2 (2026-04-13 01-09-23)
UDP port 53.
6:08
S… Speaker 2 (2026-04-13 01-09-23)
And the response is kind of acknowledging the query and providing
6:12
S… Speaker 2 (2026-04-13 01-09-23)
the answers as well that we can expand and see additional
6:16
S… Speaker 2 (2026-04-13 01-09-23)
information here as well.
6:19
S… Speaker 2 (2026-04-13 01-09-23)
Very simplistic,
6:22
S… Speaker 2 (2026-04-13 01-09-23)
and we see what is in the text record that's being requested.
6:25
S… Speaker 2 (2026-04-13 01-09-23)
This appears to be an SPF record for email.
6:30
S… Speaker 2 (2026-04-13 01-09-23)
So that is a simple request and response,
6:35
S… Speaker 2 (2026-04-13 01-09-23)
and we have some additional types of requests.
6:37
S… Speaker 2 (2026-04-13 01-09-23)
They're all going to be somewhat formatted the same way in Wireshark
6:41
S… Speaker 1 (2026-04-13 01-09-23)
when we're looking at it.
6:42
S… Speaker 2 (2026-04-13 01-09-23)
This is an MX request,
6:43
S… Speaker 2 (2026-04-13 01-09-23)
and we see that down here as well,
6:45
S… Speaker 2 (2026-04-13 01-09-23)
type MX or mail exchange.
6:47
S… Speaker 2 (2026-04-13 01-09-23)
And the response provides a lot of information as
6:52
S… Speaker 2 (2026-04-13 01-09-23)
well for all of the MX records that are contained
6:56
S… Speaker 2 (2026-04-13 01-09-23)
in this record.
6:58
S… Speaker 2 (2026-04-13 01-09-23)
And we can see there are a good number of them.
7:01
S… Speaker 2 (2026-04-13 01-09-23)
And we see this is still using UDP port
7:06
S… Speaker 2 (2026-04-13 01-09-23)
53 as well.
7:08
S… Speaker 2 (2026-04-13 01-09-23)
We have some additional,
7:09
S… Speaker 2 (2026-04-13 01-09-23)
we have some A record requests.
7:12
S… Speaker 1 (2026-04-13 01-09-23)
Go down here,
7:13
S… Speaker 2 (2026-04-13 01-09-23)
we have a reverse record.
7:15
S… Speaker 2 (2026-04-13 01-09-23)
A PTR is a reverse request.
7:17
S… Speaker 2 (2026-04-13 01-09-23)
This is essentially what normal requests are going to
7:21
S… Speaker 1 (2026-04-13 01-09-23)
look like.
7:22
S… Speaker 2 (2026-04-13 01-09-23)
It's going to be the type of request and then what the request actually is.
7:26
S… Speaker 2 (2026-04-13 01-09-23)
Here's one for a name server request.
7:28
S… Speaker 2 (2026-04-13 01-09-23)
Basically, what name servers is this domain using?
7:32
S… Speaker 2 (2026-04-13 01-09-23)
We can see their responses down here as well.
7:36
S… Speaker 2 (2026-04-13 01-09-23)
Then we can also see what happens if there is a request for
7:40
S… Speaker 1 (2026-04-13 01-09-23)
a domain.
7:41
S… Speaker 1 (2026-04-13 01-09-23)
In this case,
7:41
S… Speaker 2 (2026-04-13 01-09-23)
an A record request for this domain name.
7:44
S… Speaker 2 (2026-04-13 01-09-23)
Basically, what's the IP address here?
7:46
S… Speaker 2 (2026-04-13 01-09-23)
And the response is actually,
7:47
S… Speaker 2 (2026-04-13 01-09-23)
well, there isn't one.
7:48
S… Speaker 2 (2026-04-13 01-09-23)
There is no such a record that exists.
7:52
S… Speaker 2 (2026-04-13 01-09-23)
So that's what it looks like when there is no record to return.
7:57
S… Speaker 2 (2026-04-13 01-09-23)
It's not going to be no response.
7:59
S… Speaker 2 (2026-04-13 01-09-23)
The DNS server will respond with,
8:03
S… Speaker 1 (2026-04-13 01-09-23)
we don't know,
8:04
S… Speaker 2 (2026-04-13 01-09-23)
we don't have that information.
8:06
S… Speaker 2 (2026-04-13 01-09-23)
So this is what normal DNS traffic looks like.
8:10
S… Speaker 2 (2026-04-13 01-09-23)
So really, if you're not seeing the equivalent of this,
8:13
S… Speaker 1 (2026-04-13 01-09-23)
again,
8:14
S… Speaker 2 (2026-04-13 01-09-23)
contextual information for what your network needs,
8:17
S… Speaker 2 (2026-04-13 01-09-23)
what your network is using,
8:19
S… Speaker 2 (2026-04-13 01-09-23)
then it is something that should be investigated a little further
8:23
S… Speaker 2 (2026-04-13 01-09-23)
if it needs to be,
8:25
S… Speaker 2 (2026-04-13 01-09-23)
again, based on what your network looks like.
8:28
S… Speaker 2 (2026-04-13 01-09-23)
So let's go ahead and move back and we'll take a look at HTTP
8:32
S… Speaker 2 (2026-04-13 01-09-23)
traffic now to see what normal
8:36
S… Speaker 2 (2026-04-13 01-09-23)
and abnormal looks like for that.
8:40
S… Speaker 2 (2026-04-13 01-09-23)
So similar to DNS,
8:42
S… Speaker 2 (2026-04-13 01-09-23)
HTTP traffic uses requests and responses.
8:47
S… Speaker 2 (2026-04-13 01-09-23)
Requests from the client to pull information from typically a
8:51
S… Speaker 2 (2026-04-13 01-09-23)
web server.
8:52
S… Speaker 2 (2026-04-13 01-09-23)
These are known as messages when we're talking about HTTP.
8:56
S… Speaker 2 (2026-04-13 01-09-23)
And the responses to those requests will
9:00
S… Speaker 2 (2026-04-13 01-09-23)
include some sort of three -digit,
9:03
S… Speaker 2 (2026-04-13 01-09-23)
what they call status code.
9:04
S… Speaker 2 (2026-04-13 01-09-23)
So anything in the 200 range.
9:07
S… Speaker 2 (2026-04-13 01-09-23)
means that the server is responding to it.
9:09
S… Speaker 1 (2026-04-13 01-09-23)
There's no problem.
9:10
S… Speaker 1 (2026-04-13 01-09-23)
There's no issues.
9:11
S… Speaker 2 (2026-04-13 01-09-23)
It's just sending the information back.
9:14
S… Speaker 2 (2026-04-13 01-09-23)
Something in the 300 range usually is some sort of a redirection
9:19
S… Speaker 2 (2026-04-13 01-09-23)
or something like that.
9:20
S… Speaker 2 (2026-04-13 01-09-23)
400 range is usually some sort of an error.
9:23
S… Speaker 2 (2026-04-13 01-09-23)
There's a number of different other codes that are used,
9:26
S… Speaker 2 (2026-04-13 01-09-23)
but those are some of the most common ones,
9:29
S… Speaker 2 (2026-04-13 01-09-23)
like 404 is page not found.
9:32
S… Speaker 2 (2026-04-13 01-09-23)
302 is a redirect,
9:33
S… Speaker 2 (2026-04-13 01-09-23)
things like that.
9:34
S… Speaker 2 (2026-04-13 01-09-23)
Those are what the response codes mean.
9:36
S… Speaker 2 (2026-04-13 01-09-23)
If you're looking for more information on that,
9:38
S… Speaker 2 (2026-04-13 01-09-23)
there is plenty of information to be able to see what all the response codes are,
9:42
S… Speaker 2 (2026-04-13 01-09-23)
and there's a lot of response codes.
9:45
S… Speaker 2 (2026-04-13 01-09-23)
These HTTP messages will also include a
9:49
S… Speaker 2 (2026-04-13 01-09-23)
message header for just basic information about the transfer
9:54
S… Speaker 2 (2026-04-13 01-09-23)
and about the server and things like that,
9:56
S… Speaker 2 (2026-04-13 01-09-23)
and then the message body,
9:57
S… Speaker 2 (2026-04-13 01-09-23)
which will usually be some sort of,
9:59
S… Speaker 1 (2026-04-13 01-09-23)
you know,
10:00
S… Speaker 1 (2026-04-13 01-09-23)
HTML code or CSS,
10:01
S… Speaker 1 (2026-04-13 01-09-23)
JavaScript,
10:02
S… Speaker 1 (2026-04-13 01-09-23)
whatever else like that.
10:03
S… Speaker 1 (2026-04-13 01-09-23)
And then there are methods in HTTP that are used
10:08
S… Speaker 1 (2026-04-13 01-09-23)
to just do different things,
10:10
S… Speaker 1 (2026-04-13 01-09-23)
perform various options or operations,
10:13
S… Speaker 1 (2026-04-13 01-09-23)
excuse me, on the server.
10:14
S… Speaker 1 (2026-04-13 01-09-23)
Things like there are,
10:17
S… Speaker 1 (2026-04-13 01-09-23)
well, first of all,
10:18
S… Speaker 1 (2026-04-13 01-09-23)
there are nine current methods that are in place,
10:21
S… Speaker 1 (2026-04-13 01-09-23)
and these do change sometimes as the
10:25
S… Speaker 1 (2026-04-13 01-09-23)
technology changes.
10:27
S… Speaker 2 (2026-04-13 01-09-23)
But at the moment,
10:28
S… Speaker 1 (2026-04-13 01-09-23)
at the time of recording,
10:29
S… Speaker 1 (2026-04-13 01-09-23)
there are nine different methods.
10:30
S… Speaker 1 (2026-04-13 01-09-23)
Some of those commonly used ones are get,
10:33
S… Speaker 1 (2026-04-13 01-09-23)
which is one that's used when a client is basically just trying to get
10:37
S… Speaker 1 (2026-04-13 01-09-23)
information from the server.
10:38
S… Speaker 1 (2026-04-13 01-09-23)
That's one that's very commonly used just when it's pulling down different
10:42
S… Speaker 1 (2026-04-13 01-09-23)
web pages,
10:43
S… Speaker 1 (2026-04-13 01-09-23)
JavaScript,
10:44
S… Speaker 1 (2026-04-13 01-09-23)
CSS,
10:44
S… Speaker 1 (2026-04-13 01-09-23)
things like that.
10:45
S… Speaker 1 (2026-04-13 01-09-23)
You have put,
10:47
S… Speaker 1 (2026-04-13 01-09-23)
which is used to upload information to a server.
10:49
S… Speaker 1 (2026-04-13 01-09-23)
Post, that is usually used.
10:51
S… Speaker 1 (2026-04-13 01-09-23)
for form filling activities.
10:54
S… Speaker 1 (2026-04-13 01-09-23)
There's several other different methods.
10:57
S… Speaker 1 (2026-04-13 01-09-23)
But just keep in mind,
10:58
S… Speaker 1 (2026-04-13 01-09-23)
as of right now,
10:58
S… Speaker 1 (2026-04-13 01-09-23)
there are nine different methods.
11:00
S… Speaker 1 (2026-04-13 01-09-23)
And it's important to be familiar with what they do,
11:03
S… Speaker 1 (2026-04-13 01-09-23)
especially if you're troubleshooting any kind of HTTP status codes.
11:08
S… Speaker 2 (2026-04-13 01-09-23)
Now with HTTP,
11:09
S… Speaker 1 (2026-04-13 01-09-23)
it can be a little more difficult to spot
11:14
S… Speaker 1 (2026-04-13 01-09-23)
or detect malicious traffic.
11:15
S… Speaker 1 (2026-04-13 01-09-23)
It does require a bit more digging into the actual
11:20
S… Speaker 1 (2026-04-13 01-09-23)
application information of the packets because HTTP packets
11:25
S… Speaker 1 (2026-04-13 01-09-23)
and HTTP traffic.
11:27
S… Speaker 1 (2026-04-13 01-09-23)
in general just relays a lot more information and
11:31
S… Speaker 1 (2026-04-13 01-09-23)
this is where the follow stream feature will really come in
11:35
S… Speaker 1 (2026-04-13 01-09-23)
handy in Wireshark,
11:37
S… Speaker 1 (2026-04-13 01-09-23)
assuming you're using Wireshark for any of your threat hunting,
11:39
S… Speaker 1 (2026-04-13 01-09-23)
to be able to follow the stream and follow the information a
11:44
S… Speaker 1 (2026-04-13 01-09-23)
lot easier and just be able to view the information a lot easier
11:48
S… Speaker 1 (2026-04-13 01-09-23)
as well.
11:48
S… Speaker 1 (2026-04-13 01-09-23)
So we'll take a look at normal versus suspicious
11:53
S… Speaker 1 (2026-04-13 01-09-23)
HTTP now.
11:55
S… Speaker 1 (2026-04-13 01-09-23)
Normal ports that you'll see HTTP traffic on,
11:58
S… Speaker 1 (2026-04-13 01-09-23)
and we're talking about unencrypted traffic right now.
12:01
S… Speaker 1 (2026-04-13 01-09-23)
We are not talking about HTTPS yet.
12:04
S… Speaker 1 (2026-04-13 01-09-23)
We will in a minute.
12:05
S… Speaker 2 (2026-04-13 01-09-23)
Normally,
12:07
S… Speaker 1 (2026-04-13 01-09-23)
HTTP traffic will be on port 80.
12:09
S… Speaker 1 (2026-04-13 01-09-23)
That is the standard TCP port for this traffic.
12:14
S… Speaker 1 (2026-04-13 01-09-23)
It's not uncommon to see it on other ports like port 8080
12:18
S… Speaker 1 (2026-04-13 01-09-23)
or 8088.
12:19
S… Speaker 1 (2026-04-13 01-09-23)
For public traffic,
12:22
S… Speaker 1 (2026-04-13 01-09-23)
it's almost always going to be on port 80.
12:25
S… Speaker 1 (2026-04-13 01-09-23)
There are a lot of other ports that can be used,
12:29
S… Speaker 1 (2026-04-13 01-09-23)
and this may be suspicious.
12:32
S… Speaker 1 (2026-04-13 01-09-23)
It really just depends.
12:34
S… Speaker 1 (2026-04-13 01-09-23)
Those standard ports can still be used
12:38
S… Speaker 1 (2026-04-13 01-09-23)
by attackers,
12:39
S… Speaker 1 (2026-04-13 01-09-23)
though, and are often very frequently used by attackers because
12:43
S… Speaker 1 (2026-04-13 01-09-23)
they're typically not blocked on network firewalls because
12:48
S… Speaker 1 (2026-04-13 01-09-23)
these ports are
12:49
S… Speaker 1 (2026-04-13 01-09-23)
you know, especially port 80 is required for like
12:53
S… Speaker 1 (2026-04-13 01-09-23)
normal web and internet traffic and attackers will take advantage of
12:58
S… Speaker 1 (2026-04-13 01-09-23)
that because they're typically not blocked.
13:01
S… Speaker 1 (2026-04-13 01-09-23)
With normal HTTP traffic,
13:03
S… Speaker 1 (2026-04-13 01-09-23)
this is going to be plain text traffic.
13:06
S… Speaker 1 (2026-04-13 01-09-23)
If you see encrypted information on port 80 or
13:10
S… Speaker 1 (2026-04-13 01-09-23)
another port that is using your standard HTTP headers,
13:14
S… Speaker 1 (2026-04-13 01-09-23)
and you see encrypted traffic there,
13:16
S… Speaker 1 (2026-04-13 01-09-23)
again, not HTTPS,
13:18
S… Speaker 1 (2026-04-13 01-09-23)
that is suspicious as well.
13:21
S… Speaker 1 (2026-04-13 01-09-23)
This HTTP traffic should always be plain text.
13:26
S… Speaker 1 (2026-04-13 01-09-23)
And normally when a workstation,
13:28
S… Speaker 1 (2026-04-13 01-09-23)
a browser,
13:29
S… Speaker 1 (2026-04-13 01-09-23)
anything like that is making a connection to a web server,
13:33
S… Speaker 1 (2026-04-13 01-09-23)
it's going to be using a fully qualified domain name.
13:37
S… Speaker 1 (2026-04-13 01-09-23)
We're talking about external connections to public
13:41
S… Speaker 1 (2026-04-13 01-09-23)
web servers.
13:42
S… Speaker 1 (2026-04-13 01-09-23)
On your internal enterprise network,
13:46
S… Speaker 1 (2026-04-13 01-09-23)
sometimes there may be connections to IP addresses.
13:49
S… Speaker 1 (2026-04-13 01-09-23)
Again,
13:50
S… Speaker 1 (2026-04-13 01-09-23)
this is where context of your own network is going to be important.
13:55
S… Speaker 1 (2026-04-13 01-09-23)
However,
13:55
S… Speaker 1 (2026-04-13 01-09-23)
if you see IP -based connections to external web
14:00
S… Speaker 1 (2026-04-13 01-09-23)
servers,
14:01
S… Speaker 1 (2026-04-13 01-09-23)
That is a little suspicious because that is not something
14:05
S… Speaker 1 (2026-04-13 01-09-23)
that will normally happen.
14:07
S… Speaker 1 (2026-04-13 01-09-23)
Normally, users aren't going to type in an IP address in their browser.
14:11
S… Speaker 1 (2026-04-13 01-09-23)
They're going to type in a fully qualified domain
14:15
S… Speaker 1 (2026-04-13 01-09-23)
name.
14:16
S… Speaker 1 (2026-04-13 01-09-23)
I guarantee your users don't know what IP addresses
14:20
S… Speaker 1 (2026-04-13 01-09-23)
are, and I don't know about them,
14:22
S… Speaker 1 (2026-04-13 01-09-23)
but I certainly don't remember IP addresses for Google .com
14:26
S… Speaker 1 (2026-04-13 01-09-23)
or anything like that.
14:28
S… Speaker 1 (2026-04-13 01-09-23)
So if you see HTTP connections,
14:31
S… Speaker 1 (2026-04-13 01-09-23)
especially to external servers,
14:33
S… Speaker 1 (2026-04-13 01-09-23)
using just IP addresses,
14:37
S… Speaker 1 (2026-04-13 01-09-23)
that is potentially suspicious.
14:39
S… Speaker 1 (2026-04-13 01-09-23)
And again,
14:40
S… Speaker 1 (2026-04-13 01-09-23)
not all of these are going to be definite indications of something
14:44
S… Speaker 1 (2026-04-13 01-09-23)
malicious.
14:45
S… Speaker 1 (2026-04-13 01-09-23)
A lot of your internal systems on your network may use
14:49
S… Speaker 1 (2026-04-13 01-09-23)
your non -standard ports or might use your IP -based connections
14:54
S… Speaker 1 (2026-04-13 01-09-23)
instead of fully qualified domain names.
14:56
S… Speaker 1 (2026-04-13 01-09-23)
Context is everything here.
15:00
S… Speaker 2 (2026-04-13 01-09-23)
what is important.
15:01
S… Speaker 1 (2026-04-13 01-09-23)
All right let's switch back over to our lab once again and we'll take a look
15:06
S… Speaker 2 (2026-04-13 01-09-23)
in Wireshark at what normal HTTP traffic
15:10
S… Speaker 2 (2026-04-13 01-09-23)
looks like.
15:12
S… Speaker 1 (2026-04-13 01-09-23)
Moving over to our lab,
15:14
S… Speaker 2 (2026-04-13 01-09-23)
here is a packet capture of an HTTP communication.
15:19
S… Speaker 2 (2026-04-13 01-09-23)
So because this is TCP,
15:21
S… Speaker 2 (2026-04-13 01-09-23)
we start out the very first thing with our three -way handshake.
15:25
S… Speaker 1 (2026-04-13 01-09-23)
So we have our SYN,
15:26
S… Speaker 2 (2026-04-13 01-09-23)
and we see we are going to port 80 here.
15:29
S… Speaker 2 (2026-04-13 01-09-23)
Again, that's the standard port to use,
15:31
S… Speaker 2 (2026-04-13 01-09-23)
but it doesn't necessarily mean it's always going to be that way.
15:34
S… Speaker 1 (2026-04-13 01-09-23)
So we see our three -way handshake,
15:36
S… Speaker 1 (2026-04-13 01-09-23)
SYN, SYN,
15:37
S… Speaker 1 (2026-04-13 01-09-23)
AC, AC.
15:38
S… Speaker 2 (2026-04-13 01-09-23)
Very first three packets we see in our TCP communication,
15:41
S… Speaker 2 (2026-04-13 01-09-23)
and then we immediately see our HTTP method of
15:45
S… Speaker 2 (2026-04-13 01-09-23)
get, where we are getting a specific HTML file.
15:50
S… Speaker 1 (2026-04-13 01-09-23)
So again,
15:51
S… Speaker 2 (2026-04-13 01-09-23)
using port 80 here,
15:53
S… Speaker 2 (2026-04-13 01-09-23)
we see the destination port is 80.
15:55
S… Speaker 2 (2026-04-13 01-09-23)
Source port is going to be a randomly generated port.
15:58
S… Speaker 1 (2026-04-13 01-09-23)
And we scroll down,
15:59
S… Speaker 2 (2026-04-13 01-09-23)
and we can see the actual request here.
16:02
S… Speaker 2 (2026-04-13 01-09-23)
So we are getting download .html,
16:04
S… Speaker 2 (2026-04-13 01-09-23)
and we can see additional headers that are being sent with this request.
16:09
S… Speaker 2 (2026-04-13 01-09-23)
So the host we're talking to,
16:11
S… Speaker 2 (2026-04-13 01-09-23)
the user agent.
16:13
S… Speaker 1 (2026-04-13 01-09-23)
So in this case,
16:13
S… Speaker 1 (2026-04-13 01-09-23)
we see this is a...
16:15
S… Speaker 2 (2026-04-13 01-09-23)
Probably going to be a Firefox or Mozilla -based browser on a Windows machine.
16:22
S… Speaker 2 (2026-04-13 01-09-23)
various encoding information,
16:23
S… Speaker 2 (2026-04-13 01-09-23)
language information,
16:25
S… Speaker 2 (2026-04-13 01-09-23)
things like that.
16:26
S… Speaker 2 (2026-04-13 01-09-23)
And again,
16:27
S… Speaker 2 (2026-04-13 01-09-23)
we were the referrer of where we came from,
16:30
S… Speaker 2 (2026-04-13 01-09-23)
what page we were on when we clicked on this link,
16:32
S… Speaker 2 (2026-04-13 01-09-23)
and so forth.
16:33
S… Speaker 2 (2026-04-13 01-09-23)
So a lot of the request information that is sent with the
16:37
S… Speaker 2 (2026-04-13 01-09-23)
HTTP GET request.
16:39
S… Speaker 1 (2026-04-13 01-09-23)
Now it's,
16:41
S… Speaker 2 (2026-04-13 01-09-23)
again, it can be a little difficult to follow this communication in this view.
16:45
S… Speaker 2 (2026-04-13 01-09-23)
So if we look down here,
16:47
S… Speaker 1 (2026-04-13 01-09-23)
Let's see,
16:48
S… Speaker 1 (2026-04-13 01-09-23)
scrolling through,
16:49
S… Speaker 2 (2026-04-13 01-09-23)
we see some more header information here.
16:54
S… Speaker 1 (2026-04-13 01-09-23)
And now it seems like here,
16:56
S… Speaker 2 (2026-04-13 01-09-23)
because we're looking on the side over here,
16:58
S… Speaker 2 (2026-04-13 01-09-23)
we can see we're looking at some HTML code right here potentially.
17:01
S… Speaker 2 (2026-04-13 01-09-23)
But again, a little difficult to view in this view.
17:05
S… Speaker 2 (2026-04-13 01-09-23)
So one thing I recommend,
17:07
S… Speaker 2 (2026-04-13 01-09-23)
and we've talked about this in other videos,
17:09
S… Speaker 2 (2026-04-13 01-09-23)
is to use the follow feature in Wireshark.
17:12
S… Speaker 2 (2026-04-13 01-09-23)
So we're going to follow the HTTP stream.
17:15
S… Speaker 1 (2026-04-13 01-09-23)
And we see again,
17:16
S… Speaker 2 (2026-04-13 01-09-23)
we're starting with this get download,
17:18
S… Speaker 2 (2026-04-13 01-09-23)
all the same header and request information we saw.
17:21
S… Speaker 2 (2026-04-13 01-09-23)
And then we see the HTTP response,
17:24
S… Speaker 2 (2026-04-13 01-09-23)
the 200 code,
17:26
S… Speaker 2 (2026-04-13 01-09-23)
which means here's your page,
17:27
S… Speaker 1 (2026-04-13 01-09-23)
essentially.
17:28
S… Speaker 2 (2026-04-13 01-09-23)
And then the HTML code of the page that
17:32
S… Speaker 2 (2026-04-13 01-09-23)
was requested.
17:33
S… Speaker 2 (2026-04-13 01-09-23)
And we can just keep scrolling down.
17:35
S… Speaker 1 (2026-04-13 01-09-23)
And this is everything,
17:36
S… Speaker 2 (2026-04-13 01-09-23)
again, that you would see if you right -clicked on a page and hit View
17:40
S… Speaker 1 (2026-04-13 01-09-23)
Source.
17:42
S… Speaker 2 (2026-04-13 01-09-23)
This is the easy way to view HTTP and
17:46
S… Speaker 2 (2026-04-13 01-09-23)
HTML information within Wireshark.
17:50
S… Speaker 2 (2026-04-13 01-09-23)
That is the easy way to do it.
17:52
S… Speaker 2 (2026-04-13 01-09-23)
Now, if you want to follow the entire TCP stream,
17:56
S… Speaker 2 (2026-04-13 01-09-23)
you can do that as well just by following TCP stream.
18:00
S… Speaker 1 (2026-04-13 01-09-23)
And you're going to see pretty much the same information,
18:03
S… Speaker 1 (2026-04-13 01-09-23)
at least in this case,
18:05
S… Speaker 2 (2026-04-13 01-09-23)
you'll see the same information because this TCP stream...
18:08
S… Speaker 2 (2026-04-13 01-09-23)
It was pretty much just this HTML request.
18:12
S… Speaker 1 (2026-04-13 01-09-23)
So that is the kind of simple
18:16
S… Speaker 2 (2026-04-13 01-09-23)
way to view the information.
18:18
S… Speaker 1 (2026-04-13 01-09-23)
And we can, again,
18:19
S… Speaker 2 (2026-04-13 01-09-23)
get additional information using Wireshark about what information
18:23
S… Speaker 2 (2026-04-13 01-09-23)
is in this packet capture.
18:25
S… Speaker 2 (2026-04-13 01-09-23)
We can show some of the individual information.
18:28
S… Speaker 2 (2026-04-13 01-09-23)
We can show where the communication was between.
18:30
S… Speaker 2 (2026-04-13 01-09-23)
We can see that it was HTML,
18:33
S… Speaker 1 (2026-04-13 01-09-23)
or excuse me,
18:34
S… Speaker 2 (2026-04-13 01-09-23)
we can see that it was using port 80,
18:36
S… Speaker 1 (2026-04-13 01-09-23)
using TCP.
18:37
S… Speaker 2 (2026-04-13 01-09-23)
The assumption there is going to be that it was HTTP traffic.
18:41
S… Speaker 2 (2026-04-13 01-09-23)
That doesn't necessarily mean it will be,
18:44
S… Speaker 2 (2026-04-13 01-09-23)
but that's the assumption we can make just by glancing at the
18:49
S… Speaker 1 (2026-04-13 01-09-23)
data.
18:49
S… Speaker 1 (2026-04-13 01-09-23)
And then we can also,
18:51
S… Speaker 1 (2026-04-13 01-09-23)
because it's HTML,
18:52
S… Speaker 2 (2026-04-13 01-09-23)
we can come over here to file.
18:54
S… Speaker 2 (2026-04-13 01-09-23)
export objects and look at our HTTP objects to see what
18:59
S… Speaker 2 (2026-04-13 01-09-23)
information we can pull,
19:00
S… Speaker 2 (2026-04-13 01-09-23)
and we see our download .html.
19:02
S… Speaker 1 (2026-04-13 01-09-23)
We can save this file and easily be able to view the
19:07
S… Speaker 2 (2026-04-13 01-09-23)
HTML code outside of Wireshark if we wanted to perform further
19:11
S… Speaker 2 (2026-04-13 01-09-23)
analysis during the threat hunt.
19:13
S… Speaker 2 (2026-04-13 01-09-23)
So there's a lot of information you can pull from Wireshark,
19:16
S… Speaker 1 (2026-04-13 01-09-23)
and that's...
19:18
S… Speaker 1 (2026-04-13 01-09-23)
A very simplistic example of what your HTTP
19:22
S… Speaker 2 (2026-04-13 01-09-23)
traffic will look like.
19:23
S… Speaker 2 (2026-04-13 01-09-23)
And again, we're talking about unencrypted plain text HTTP
19:28
S… Speaker 1 (2026-04-13 01-09-23)
traffic,
19:29
S… Speaker 2 (2026-04-13 01-09-23)
not HTTPS traffic.
19:32
S… Speaker 2 (2026-04-13 01-09-23)
So now that we've looked at what normal traffic looks like with this
19:36
S… Speaker 2 (2026-04-13 01-09-23)
protocol, what does abnormal traffic look like?
19:40
S… Speaker 2 (2026-04-13 01-09-23)
So here is a screenshot of some additional HTTP
19:45
S… Speaker 1 (2026-04-13 01-09-23)
traffic.
19:46
S… Speaker 1 (2026-04-13 01-09-23)
That's very similar,
19:47
S… Speaker 1 (2026-04-13 01-09-23)
and at first glance,
19:48
S… Speaker 2 (2026-04-13 01-09-23)
it may look pretty much the same.
19:51
S… Speaker 2 (2026-04-13 01-09-23)
We have our GET request starting right here.
19:54
S… Speaker 2 (2026-04-13 01-09-23)
We see we have a couple other GET requests.
19:57
S… Speaker 2 (2026-04-13 01-09-23)
There's a news .php.
20:00
S… Speaker 1 (2026-04-13 01-09-23)
This appears to be fairly standard.
20:02
S… Speaker 1 (2026-04-13 01-09-23)
There's some HTTP responses here.
20:06
S… Speaker 1 (2026-04-13 01-09-23)
There's a 200 OK.
20:07
S… Speaker 1 (2026-04-13 01-09-23)
This looks pretty normal.
20:10
S… Speaker 1 (2026-04-13 01-09-23)
However, there's one thing that kind of jumps out at us
20:14
S… Speaker 1 (2026-04-13 01-09-23)
when we're taking a deeper look at this.
20:16
S… Speaker 1 (2026-04-13 01-09-23)
And that's this section right here.
20:19
S… Speaker 1 (2026-04-13 01-09-23)
Getting news details dot PHP.
20:21
S… Speaker 1 (2026-04-13 01-09-23)
Then we have a query with an ID with a number
20:25
S… Speaker 1 (2026-04-13 01-09-23)
and then a percent 27.
20:29
S… Speaker 1 (2026-04-13 01-09-23)
When looking at HTTP and HTML and URLs specifically,
20:34
S… Speaker 1 (2026-04-13 01-09-23)
%27 is used with what's known as URL encoding.
20:38
S… Speaker 1 (2026-04-13 01-09-23)
This exact code,
20:41
S… Speaker 1 (2026-04-13 01-09-23)
%27,
20:43
S… Speaker 1 (2026-04-13 01-09-23)
decodes to a single quote.
20:46
S… Speaker 1 (2026-04-13 01-09-23)
This is a common tactic and a typical behavior when
20:51
S… Speaker 1 (2026-04-13 01-09-23)
an attacker is trying to probe for a possible SQL
20:55
S… Speaker 1 (2026-04-13 01-09-23)
injection attack.
20:56
S… Speaker 2 (2026-04-13 01-09-23)
However,
20:57
S… Speaker 1 (2026-04-13 01-09-23)
we only see this one instance here so far.
21:00
S… Speaker 1 (2026-04-13 01-09-23)
So maybe it was a typo.
21:03
S… Speaker 1 (2026-04-13 01-09-23)
Maybe they accidentally hit the button on the keyboard.
21:06
S… Speaker 1 (2026-04-13 01-09-23)
That's possible.
21:07
S… Speaker 1 (2026-04-13 01-09-23)
But it is something to be suspicious about and something that
21:11
S… Speaker 1 (2026-04-13 01-09-23)
requires additional hunting.
21:13
S… Speaker 1 (2026-04-13 01-09-23)
within this packet capture.
21:15
S… Speaker 1 (2026-04-13 01-09-23)
So we see that in there.
21:16
S… Speaker 1 (2026-04-13 01-09-23)
Let's move on within the file.
21:19
S… Speaker 1 (2026-04-13 01-09-23)
So we're taking a look here and we're seeing some additional instances
21:23
S… Speaker 1 (2026-04-13 01-09-23)
of the same thing and they're getting a little more complicated
21:28
S… Speaker 1 (2026-04-13 01-09-23)
as well.
21:29
S… Speaker 1 (2026-04-13 01-09-23)
This one specifically,
21:31
S… Speaker 1 (2026-04-13 01-09-23)
we're seeing a lot more URL coding.
21:34
S… Speaker 1 (2026-04-13 01-09-23)
One thing that jumps out at me here is %20,
21:38
S… Speaker 1 (2026-04-13 01-09-23)
which is a URL code for a space.
21:40
S… Speaker 1 (2026-04-13 01-09-23)
So we have AND,
21:43
S… Speaker 1 (2026-04-13 01-09-23)
and then we have the spaces on either side of an AND.
21:45
S… Speaker 1 (2026-04-13 01-09-23)
1 equals 1 and a semicolon.
21:48
S… Speaker 1 (2026-04-13 01-09-23)
That is a very typical way to
21:52
S… Speaker 1 (2026-04-13 01-09-23)
test for SQL injection vulnerabilities.
21:56
S… Speaker 1 (2026-04-13 01-09-23)
And we have something similar at the bottom here with a 1 equals 2
22:01
S… Speaker 1 (2026-04-13 01-09-23)
as well.
22:02
S… Speaker 1 (2026-04-13 01-09-23)
So we're seeing some definite instances that this
22:06
S… Speaker 1 (2026-04-13 01-09-23)
is a probe for a SQL injection attack.
22:10
S… Speaker 2 (2026-04-13 01-09-23)
Now,
22:11
S… Speaker 1 (2026-04-13 01-09-23)
these are not typos.
22:12
S… Speaker 1 (2026-04-13 01-09-23)
You're not going to accidentally type the word and 1 equals 1.
22:16
S… Speaker 1 (2026-04-13 01-09-23)
That's not going to be a typo.
22:18
S… Speaker 1 (2026-04-13 01-09-23)
This is definitely suspicious.
22:22
S… Speaker 1 (2026-04-13 01-09-23)
Our next step as part of the threat hunt here would be to continue
22:26
S… Speaker 1 (2026-04-13 01-09-23)
to figure out what's going on.
22:28
S… Speaker 1 (2026-04-13 01-09-23)
Is this a manual attack or is this a tool -based
22:32
S… Speaker 1 (2026-04-13 01-09-23)
attack?
22:33
S… Speaker 1 (2026-04-13 01-09-23)
So looking at some more of the information,
22:37
S… Speaker 1 (2026-04-13 01-09-23)
we see again,
22:38
S… Speaker 1 (2026-04-13 01-09-23)
we have the,
22:40
S… Speaker 1 (2026-04-13 01-09-23)
let's see,
22:42
S… Speaker 1 (2026-04-13 01-09-23)
this is the one equals two section right here that we see
22:46
S… Speaker 1 (2026-04-13 01-09-23)
in the request details.

תעתיק זה נוצר על ידי AI (הכרה אוטומטית של דיבור). ייתכן שיש בו שגיאות אשר מאשרות את השמע המקורי לשימוש קריטי. מדיניות AI

❤️ אוהבים את STT.ai? ספרו לחברים שלכם!
תקציר
לחץ לסכם כדי ליצור סיכום AI של תעתיק זה.
מסכם...
שאל את אל על התעתיק הזה.
שאל כל דבר על התמליל הזה, הבינה המלאכותית תמצא חלקים רלוונטיים ותענה.
תמלול נוסף