Unit 8: Scans, beacons and leaks · Lesson 5 of 6 · 18 min
Large uploads
Confirm an upload in packets, name the service it went to and measure exactly what left.
mission
- You are
- The analyst confirming a data loss alert.
- Situation
- Flow records flagged a 2 MB upload from laptop-rpatel. upload.pcap holds the packets from that window.
- Goal
- Confirm the upload, name the receiving service and measure it in both directions.
- Hand in
- The service name and the kilobytes sent.
Weighing what leaves
Measure every conversation
Compare the -> bytes (from the laptop) with the <- bytes (to the laptop) on every row.
tshark -r upload.pcap -q -z conv,ip
================================================================================
IPv4 Conversations
Filter:<No Filter>
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
10.10.0.57 <-> 198.51.100.200 11 3949 bytes 1509 2181 kB 1520 2185 kB 120.000000000 0.3305
10.10.0.31 <-> 198.51.100.80 306 438 kB 8 1427 bytes 314 440 kB 50.000000000 0.0812
10.10.0.23 <-> 198.51.100.20 211 268 kB 48 7832 bytes 259 276 kB 0.000000000 185.0290
================================================================================
you should see Two laptops downloaded. One uploaded 2,181 kB and got 4 kB back.
Name the service
The Client Hello names where the data went.
tshark -r upload.pcap -Y 'tls.handshake.type==1 && ip.src==10.10.0.57' -T fields -e ip.dst -e tls.handshake.extensions_server_name
198.51.100.200 files.share-drop.example
you should see A public file sharing service.
defender tip The size of the encrypted upload is close to the size of the files, so you can estimate how much data left even without seeing it.
Download and upload
10.10.0.57 -> files.share-drop.example out 2181 kB, in 4 kB
Data leaving. Ask what and why.
10.10.0.31 <- updates.example.org out 1 kB, in 438 kB
Normal. Software updates come in.
Time the transfer
How long the capture lasted tells you how fast the data left.
capinfos -u upload.pcap
File name: upload.pcap
Capture duration: 185.029002 seconds
you should see About three minutes.
Count the connections
One long connection moving lots of data looks different from many short ones.
tshark -r upload.pcap -q -z conv,tcp | grep -c '<->'
8
you should see A single TCP conversation carried the upload.
What a defender takes away
- 1Bytes out versus bytes in is the quickest upload test.
- 2SNI names the destination even when the content is sealed.
- 3This laptop also beaconed and tunnelled DNS: put the findings together before you report.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.