What do I need?

• An old laptop with an Ethernet port and a Wireless adapter
• Ubuntu running on the old laptop. Any Linux will do, but this guide will show you with Ubuntu 14.04
• Burp running on any computer on your local network

Here is how it works

Step 1. Configure the laptop as a Wireless Router

Hook the laptop up to the local network using the Ethernet adapter and make sure you can browse the Internet (using the Ethernet adapter).

Follow these steps to configure using Network Manager a new wireless network in infrastructure mode;

1. Untick the enable wifi option to temporarily disable the WIFI
2. Select edit connections
3. Add new wireless network (set ssid and mode to infrastructure)

4. Name the access point (mytestingaccesspoint)
5. In IPv4 change method to "Shared to other computers", this is a quick way to sort out DHCP and NAT for your new wireless network.

6. Set security (set a password)

Edit the file /etc/NetworkManager/system-connections/mytestingaccesspoint

Find the line that has mode=infrastructure and change it to mode=ap. This is required as AP is not an option in Network Manager. Note that not all wireless cards support the AP mode.

Once you have this network (mytestingaccesspoint) enabled, your wireless devices should be able to see it and connect using the password you have set.

If you can browse the network from your mobile device, on your laptop you will see two different IP ranges for your wireless adapter (wlan0) and the ethernet (eth0) adapter. The Ubuntu laptop is forwarding the traffic from the new wireless network onto the Ethernet network and out to the internet.

Try tcpdump -i wlan0 on the laptop. Fire up some apps on your phone or a browser. You should see traffic; this is your mobile device traffic. If your wireless device is not wlan0 you will need to use the correct device in the forward rule below so make sure this works.

That concludes the first part of the guide, getting the mobile device traffic to route through a Linux enabled system.

Step 2. Forward Traffic to Burp for Transparent Proxying

In the second part of the guide we will use an iptables NAT table rule to forward all HTTP port 80 traffic to the Burp Proxy running on another system.

Once we get the HTTP traffic into the Burp proxy server we can view, intercept and even inject on HTTP requests.

It only takes one line, on your Linux based router (the laptop).

iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j DNAT --to 192.168.1.100:8080

Now in Burp you need to set the proxy to listen on all IP addresses and there are two other options that are required for transparent proxying.

1. Select the Proxy Tab | Options | Edit the Running Proxy | Change to Bind All interfaces

2. While you are here select "Request Handling" and tick the option to Support invisible proxying (if you need this). Without it you will likely get an error when you attempt to proxy the HTTP traffic transparently.

3. Still on the Proxy Options Tab, scroll down to the bottom and select the "Allow Requests to web interface using fully qualified DNS hostnames"

dd-wrt as an alternative

If you have a compatible router you might be able to use dd-wrt or other firmware project to install Linux on your SOHO router. With Linux on your router you could use a similar port forward rule to push port 80 traffic to burp. There are lots of options available, one of the advantages of the old laptop method is if you mess up on the Laptop the rest of the household can still use the Internet (unless of course you really mess it up). Have fun...

The post Proxy your Phone to Burp appeared first on HackerTarget.com.

tshark is a packet capture tool that also has powerful reading and parsing features for pcap analysis.

Rather than repeat the information in the extensive man page and on the wireshark.org documentation archive, this tutorial will provide practical examples to get started using tshark and begin carving valuable information from the wire.

Tshark examples

Use these as the basis for starting to build extraction commands.The syntax for capturing and reading a pcap is very similar to tcpdump.

Capture Packets with Tshark

tshark -i wlan0 -w capture-output.pcap

Read a Pcap with Tshark

tshark -r capture-output.pcap

HTTP Analysis with Tshark

The following example extracts data from any HTTP requests that are seen. Using the -T specifies we want to extract fields. The -e option identifies which fields to extract.

tshark -i wlan0 -Y http.request -T fields -e http.host -e http.user_agent

searchdns.netcraft.com	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:36.0) Gecko/20100101 Firefox/36.0
searchdns.netcraft.com	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:36.0) Gecko/20100101 Firefox/36.0
ads.netcraft.com	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:36.0) Gecko/20100101 Firefox/36.0

The default separator for the fields in the output above is TAB. We could also use the parameter -E seperator=, to change the delimiter to a comma.

Parse User Agents and Frequency with Standard Shell Commands

Using the previous command to extract http.user_agent, this time extracting from a pcap rather than off the live interface. Note in this example, combining with standard shell commands allows us to sort and count the occurrences of the http.user_agent.

tshark -r example.pcap -Y http.request -T fields -e http.host -e http.user_agent | sort | uniq -c | sort -n

Using this, we can quickly parse a pcap, even if it is very large and get a summary of all the user agents seen. This can be used to detect malware, old browsers on your network and scripts.

Using additional HTTP filters in Analysis

We could perform a similar analysis with the request URL in place of the user agent -e http.request.full_uri. Other fields we could include in the output are -e ip.dst and -e http.request.method. By combing different filters and output fields, it is possible to create very complex data extraction commands for tshark that can be used to find interesting things within a capture.

tshark -r example.pcap -Y http.request -T fields -e http.host -e ip.dst -e http.request.full_uri

DNS Analysis with Tshark

Here is an example that extracts both the DNS query and the response address.

tshark -i wlan0 -f "src port 53" -n -T fields -e dns.qry.name -e dns.resp.addr

68 campus-map.stanford.edu	171.64.144.142
www.google.com	
itunes.apple.com	104.74.40.29
71 itunes.apple.com	
campus-map.stanford.edu	
admission.stanford.edu	171.67.215.200
74 financialaid.stanford.edu	171.67.215.200
admission.stanford.edu	

Add time and source / destination IP addresses -e frame.time -e ip.src -e ip.dst to your output.

tshark -i wlan0 -f "src port 53" -n -T fields -e frame.time -e ip.src -e ip.dst -e dns.qry.name -e dns.resp.addr

Apr 22, 2015 23:20:16.922103000 8.8.8.8 192.168.1.7 wprecon.com	198.74.56.127
1 Apr 22, 2015 23:20:17.314244000 8.8.8.8 192.168.1.7 wprecon.com	
2 Apr 22, 2015 23:20:18.090110000 8.8.8.8 192.168.1.7 code.jquery.com

Let's get passwords.... in a HTTP post. By not specifying the fields option as above we receive the full TCP stream of the HTTP Post. If we add the filter tcp contains "password" and grep for that password we will just get the actual POST data line.

tshark -i wlan0 -Y 'http.request.method == POST and tcp contains "password"' | grep password

csrfmiddlewaretoken=VkRzURF2EFYb4Q4qgDusBz0AWMrBXqN3&password=abc123

For our Next Trick

The latest version of Tshark 2.4 includes a number of useful new features. To install the latest version on Ubuntu 16.04 or 17.04 use the following commands to add the package repository.

sudo add-apt-repository ppa:dreibh/ppa
sudo apt-get update && sudo apt-get install wireshark tshark

Extract Files from PCAP using Tshark

An excellent feature of tshark is the ability to export objects (files) from pcaps using the command line.

The export objects feature has been available in wireshark for a long time now. Having this ability available on the command line is an excellent addition to tshark.

You will need version 2.3.0 or higher for the export objects parameter to be available to tshark.

This command will extract files from an SMB stream and extract them to the location tmpfolder.

tshark -nr test.pcap --export-objects smb,tmpfolder

This command will do the same except from HTTP, extracting all the files seen in the pcap.

tshark -nr test.pcap --export-objects http,tmpfolder

It is a quick and easy way to get all the images, html, js and other HTTP objects from a pcap containing HTTP traffic.

Hopefully this tutorial has given you a quick taste of the useful features that are available to you when using tshark for extracting data from the wire or from pcaps.

The post tshark tutorial and filter examples appeared first on HackerTarget.com.