Unit 7: Reading captures in Wireshark · Lesson 2 of 6 · 18 min
Following a conversation
Rebuild a whole TCP conversation and see why plain HTTP exposes passwords.
mission
- You are
- The analyst gathering evidence for a password reset.
- Situation
- IT agreed to reset jlee's password, but wants proof of what was exposed and which session to kill.
- Goal
- Rebuild the login conversation as text and pull out the credentials and session.
- Hand in
- The username sent and the session cookie the server set.
Following a stream
Number the conversations
tshark gives every TCP connection a stream index starting at 0. Print it next to each request.
tshark -r http.pcap -Y http.request -T fields -e tcp.stream -e http.request.method -e http.request.uri
0 GET /login
1 POST /login
2 GET /dashboard
you should see The login POST is stream 1.
Follow the stream
-z follow,tcp,ascii,N prints both directions of stream N as text. In Wireshark: right-click, Follow, TCP Stream.
tshark -r http.pcap -q -z follow,tcp,ascii,1 | sed -n '/^POST/,$p' | head -n 14
POST /login HTTP/1.1
Host: intranet.corp.example
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 40
username=jlee&password=Lab-Only-Pass-99!
116
HTTP/1.1 302 Found
Server: nginx
Location: /dashboard
Set-Cookie: session=4f1c2a9e; Path=/
Content-Length: 0
you should see The request with the password, then the server's reply with the session cookie. The indented number is the size of the server's part.
defender tip Put this exact output in the ticket. It is the evidence for the reset and for expiring the session.
Who can read plain HTTP
- Laptop10.10.0.23
- Office switchanyone mirroring a port
- Routeranyone on the path
- Intranet10.20.0.40:80
Count the conversations
Each TCP conversation is one stream you could follow.
tshark -r http.pcap -q -z conv,tcp | grep -c '<->'
3
you should see Three conversations, one per page.
Follow the next conversation
After login, the browser's later requests carry the session cookie instead of the password.
tshark -r http.pcap -q -z follow,tcp,ascii,2 | grep -E '^(GET|Cookie)'
GET /dashboard HTTP/1.1
Cookie: session=4f1c2a9e
you should see The dashboard request carries the session cookie in clear text.
What a defender takes away
- 1Following a stream turns packets back into the conversation both programs had.
- 2Stream numbers make findings repeatable.
- 3Expose, then fix: reset the password, kill the session, move the site to HTTPS.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.