![Просмотр интерфейсов
$ sudo tcpdump -D
1.wlan0 [Up, Running]
2.docker0 [Up, Running]
3.vboxnet0 [Up, Running]
4.vboxnet1 [Up, Running]
5.veth283f985 [Up, Running]
6.any (Pseudo-device that captures on all interfaces) [Up, Running]
7.lo [Up, Running, Loopback]
8.eth0 [Up]
9.bluetooth-monitor (Bluetooth Linux Monitor)
10.nflog (Linux netfilter log (NFLOG) interface)
11.nfqueue (Linux netfilter queue (NFQUEUE) interface)
12.usbmon1 (USB bus number 1)
13.usbmon2 (USB bus number 2)
6](https://image.slidesharecdn.com/main-160311175849/85/-6-320.jpg)
![Все запросы с интерфейса
$ sudo tcpdump -i wlan0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes
19:04:24.115872 STP 802.1d, Config, Flags [none], bridge-id 8000.bc:ae:c5:88:91:28.8
19:04:24.219665 IP Arkasha-PC.local.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Req
19:04:25.118303 IP x220t.local.32371 > google-public-dns-a.google.com.domain: 29524+
19:04:25.186526 IP google-public-dns-a.google.com.domain > x220t.local.32371: 29524
19:04:25.287550 IP6 fe80::120b:a9ff:fe0c:f638.mdns > ff02::fb.mdns: 0 PTR (QM)? 255.
^C19:04:25.287614 IP x220t.local.mdns > 224.0.0.251.mdns: 0 PTR (QM)? 255.255.255.25
6 packets captured
50 packets received by filter
0 packets dropped by kernel
7](https://image.slidesharecdn.com/main-160311175849/85/-7-320.jpg)
![Фильтр по хосту
$ sudo tcpdump host readthedocs.org
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes
19:08:24.734572 IP x220t.local.44169 > readthedocs.org.http: Flags [S], seq 16304875
19:08:24.900671 IP readthedocs.org.http > x220t.local.44169: Flags [S.], seq 2780774
19:08:24.900718 IP x220t.local.44169 > readthedocs.org.http: Flags [.], ack 1, win 1
19:08:24.900812 IP x220t.local.44169 > readthedocs.org.http: Flags [P.], seq 1:733,
...
19:08:28.524595 IP readthedocs.org.https > x220t.local.37282: Flags [.], ack 2254,
19:08:28.605826 IP x220t.local.37282 > readthedocs.org.https: Flags [.], ack 9767, w
^C
83 packets captured
89 packets received by filter
0 packets dropped by kernel
8](https://image.slidesharecdn.com/main-160311175849/85/-8-320.jpg)
Анализ трафика
- 1. Анализ трафика Основы Веб-программирования Кафедра Интеллектуальных Информационных Технологий, ИнФО, УрФУ 1
- 3. Классификация анализаторов • программные • программно-аппаратные 3
- 4. Способы перехвата • Обычным «прослушиванием» сетевого интерфейса; • Ответвлением (программным или аппаратным) трафика и направлением его копии на сниффер (Network tap); • Через анализ побочных электромагнитных излучений и восстановление таким образом прослушиваемого трафика; • Через атаку на канальном 2-ом (MAC-spoofing) уровне; • Через атаку на канальном сетевом 3-м (IP-spoofing) уровне. 4
- 5. tcpdump tcpdump — утилита UNIX (есть клон для Windows), позволяющая перехватывать и анализировать сетевой трафик, проходящий через компьютер, на котором запущена данная программа. 5
- 6. Просмотр интерфейсов $ sudo tcpdump -D 1.wlan0 [Up, Running] 2.docker0 [Up, Running] 3.vboxnet0 [Up, Running] 4.vboxnet1 [Up, Running] 5.veth283f985 [Up, Running] 6.any (Pseudo-device that captures on all interfaces) [Up, Running] 7.lo [Up, Running, Loopback] 8.eth0 [Up] 9.bluetooth-monitor (Bluetooth Linux Monitor) 10.nflog (Linux netfilter log (NFLOG) interface) 11.nfqueue (Linux netfilter queue (NFQUEUE) interface) 12.usbmon1 (USB bus number 1) 13.usbmon2 (USB bus number 2) 6
- 7. Все запросы с интерфейса $ sudo tcpdump -i wlan0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes 19:04:24.115872 STP 802.1d, Config, Flags [none], bridge-id 8000.bc:ae:c5:88:91:28.8 19:04:24.219665 IP Arkasha-PC.local.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Req 19:04:25.118303 IP x220t.local.32371 > google-public-dns-a.google.com.domain: 29524+ 19:04:25.186526 IP google-public-dns-a.google.com.domain > x220t.local.32371: 29524 19:04:25.287550 IP6 fe80::120b:a9ff:fe0c:f638.mdns > ff02::fb.mdns: 0 PTR (QM)? 255. ^C19:04:25.287614 IP x220t.local.mdns > 224.0.0.251.mdns: 0 PTR (QM)? 255.255.255.25 6 packets captured 50 packets received by filter 0 packets dropped by kernel 7
- 8. Фильтр по хосту $ sudo tcpdump host readthedocs.org tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes 19:08:24.734572 IP x220t.local.44169 > readthedocs.org.http: Flags [S], seq 16304875 19:08:24.900671 IP readthedocs.org.http > x220t.local.44169: Flags [S.], seq 2780774 19:08:24.900718 IP x220t.local.44169 > readthedocs.org.http: Flags [.], ack 1, win 1 19:08:24.900812 IP x220t.local.44169 > readthedocs.org.http: Flags [P.], seq 1:733, ... 19:08:28.524595 IP readthedocs.org.https > x220t.local.37282: Flags [.], ack 2254, 19:08:28.605826 IP x220t.local.37282 > readthedocs.org.https: Flags [.], ack 9767, w ^C 83 packets captured 89 packets received by filter 0 packets dropped by kernel 8
- 9. Ещё фильтры По протоколу: $ sudo tcpdump -n tcp По назначению: $ sudo tcpdump -n 'src 192.168.1.101' Только DNS пакеты: $ sudo tcpdump -n 'udp and dst port 53' tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes 19:22:52.089174 IP 192.168.1.101.17166 > 8.8.8.8.53: 44241+ A? www.google.ru. (31) 19:22:52.149972 IP 192.168.1.101.61715 > 8.8.8.8.53: 63972+ A? www.google.ru. (31) 19:22:52.157017 IP 192.168.1.101.12023 > 8.8.8.8.53: 17412+ AAAA? www.google.ru. (31 19:22:54.062859 IP 192.168.1.101.30447 > 8.8.8.8.53: 54230+ AAAA? www.google.ru. (31 9
- 10. Поиск хостов NetBIOS: $ nbtscan 192.168.1.0/24 Doing NBT name scan for addresses from 192.168.1.0/24 IP address NetBIOS Name Server User MAC address ------------------------------------------------------------------------------ 192.168.1.0 Sendto failed: Permission denied 192.168.1.101 X220T <server> X220T 00:00:00:00:00:00 192.168.1.23 <server> 00:00:00:00:00:00 192.168.1.22 ARKASHA-PC <server> <unknown> 00:1b:fc:6c:c2:12 192.168.1.255 Sendto failed: Permission denied Nmap: $ nmap -sP 192.168.1.* Starting Nmap 6.46 ( http://nmap.org ) at 2015-02-02 20:56 YEKT Nmap scan report for 192.168.1.1 Host is up (0.0068s latency). Nmap scan report for 192.168.1.20 10
- 11. Трафик между двух узлов сети Только ICMP пакеты (ping) $ sudo tcpdump 'src 192.168.1.101 and dst 192.168.1.23 and icmp' tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes 19:36:45.340321 IP x220t.local > 192.168.1.23: ICMP echo request, id 10305, seq 1, l 19:36:46.341472 IP x220t.local > 192.168.1.23: ICMP echo request, id 10305, seq 2, l 19:36:47.342180 IP x220t.local > 192.168.1.23: ICMP echo request, id 10305, seq 3, l 19:36:48.343557 IP x220t.local > 192.168.1.23: ICMP echo request, id 10305, seq 4, l ^C 4 packets captured 4 packets received by filter 0 packets dropped by kernel 11
- 12. Поиск в трафике HTTP ответы со статусом 200 $ sudo tcpdump -n -A | grep -e '200 OK' tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes A).)...sHTTP/1.1 200 OK A).9...vHTTP/1.1 200 OK 12
- 13. Поиск логинов и паролей $ sudo tcpdump -l -A -i lo | egrep -i 'pass=|pwd=|log=|login=|user= |username=|pw=|passw=|passwd=|password=|pass:|user:|username: |password:|login:|pass |user ' --color=auto --line-buffered -B20 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes Host: localhost:6543 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost:6543/login/ Cookie: csrftoken=pVVycxJs2YaTCS5vpKTob0TINGsKjAM4; _LOCALE_=ru; _ga=GA1.1.195145305 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 53 came_from=%2F&login=admin&password=123&submit=Sign+In 13
- 14. Wireshark 14