2026-04-13 01-09-23
स्पीकर
अध्याय
-
0:06
In this video, we're going to take a look at both DNS and HTTP traffic and how to potentially recognize some of the abnormal traffic you may see while threat hunting for both of those. So first of all, we're going to start looking at DNS. D…
-
5:10अध्याय 2: query. However, the responses will start out with the word response here to easily kind of separate them out. 302s · Speaker 1
query. However, the responses will start out with the word response here to easily kind of separate them out. So what we have is the source IP address, destination IP address. In this case, we see that there are responses to these queries. …
-
10:13अध्याय 3: excuse me, on the server. 301s · Speaker 1
excuse me, on the server. Things like there are, well, first of all, there are nine current methods that are in place, and these do change sometimes as the technology changes. But at the moment, at the time of recording, there are nine diff…
-
15:14अध्याय 4: here is a packet capture of an HTTP communication. 301s · Speaker 2
here is a packet capture of an HTTP communication. So because this is TCP, we start out the very first thing with our three -way handshake. So we have our SYN, and we see we are going to port 80 here. Again, that's the standard port to use,…
-
20:16अध्याय 5: And that's this section right here. 302s · Speaker 1
And that's this section right here. Getting news details dot PHP. Then we have a query with an ID with a number and then a percent 27. When looking at HTTP and HTML and URLs specifically, %27 is used with what's known as URL encoding. This …
-
25:19अध्याय 6: to be able to figure out what this is. 304s · Speaker 1
to be able to figure out what this is. So this is just one example of suspicious HTTP traffic. Now, I said we're going to talk about it. Let's start taking a look at HTTPS in traffic now as well. Now, when we're talking about HTTPS traffic,…
-
30:23अध्याय 7: traffic and try to export files and information, well, there's no HTTP objects to export. 154s · Speaker 1
traffic and try to export files and information, well, there's no HTTP objects to export. Again, all the traffic is encrypted. We can't see anything. However, in this example, we do have access to the private keys. And in Wireshark, you can…