Hacker hunting with Wireshark (even if SSL encrypted!)

Поделиться
HTML-код
  • Опубликовано: 2 янв 2025

Комментарии • 318

  • @davidbombal
    @davidbombal  2 года назад +120

    The packets don't lie. You can hide processes or logs, but you cannot hide packets. Malware is a major problem in today's networks. Chris Greer is the Wireshark master. He shows us how to use Wireshark to find Malware and suspicious traffic in our networks.
    // MENU //
    00:26 - Intro
    04:24 - Sharkfest / DEFCON
    05:55 - What is Threat Hunting?
    07:33 - Why threat hunt with Wireshark?
    10:05 - What are IOCs
    10:30 - Why should we care?
    12:23 - Packets/PCAPs
    18:48 - 'Low hanging fruit'
    21:10 - TCP Stream
    27:29 - Stream
    35:00 - How to know what to look for?
    37:49 - JA3 Client Fingerprint
    41:25 - ja3er.com
    48:08 - Brim
    52:20 - TSHARK
    58:50 - Large Data Example
    01:04:00 - Chris' Course
    01:06:20 - Outro
    // PCAP download //
    Get the pcap here: malware-traffic-analysis.net/2020/05/28/index.html
    // Websites mentioned //
    ja3: ja3er.com
    Malware Analysis pcaps: malware-traffic-analysis.net
    //CHRIS GREER //
    Udemy course: davidbombal.wiki/chriswireshark
    LinkedIn: www.linkedin.com/in/cgreer/
    RUclips: ruclips.net/user/ChrisGreer
    Twitter: twitter.com/packetpioneer
    // David SOCIAL //
    Discord: discord.com/invite/usKSyzb
    Twitter: twitter.com/davidbombal
    Instagram: instagram.com/davidbombal
    LinkedIn: www.linkedin.com/in/davidbombal
    Facebook: facebook.com/davidbombal.co
    TikTok: tiktok.com/@davidbombal
    RUclips: ruclips.net/user/davidbombal
    // MY STUFF //
    www.amazon.com/shop/davidbombal
    // SPONSORS //
    Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com
    Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!

    • @Twdsheikh2931
      @Twdsheikh2931 2 года назад +1

      Please make a video on how to install ubuntu 22.04 with gui in wsl2

    • @Twdsheikh2931
      @Twdsheikh2931 2 года назад

      Please make a video on how to install ubuntu 22.04 with gui in wsl2

    • @Twdsheikh2931
      @Twdsheikh2931 2 года назад

      Please make a video on how to install ubuntu 22.04 with gui in wsl2

    • @Twdsheikh2931
      @Twdsheikh2931 2 года назад

      Love from India
      Please make a video on how to install ubuntu 22.04 with gui in wsl2

    • @Twdsheikh2931
      @Twdsheikh2931 2 года назад

      Love from india

  • @ChrisGreer
    @ChrisGreer 2 года назад +154

    Wireshark is a great threat hunting tool! Had fun digging with David into the packets with this one.

    • @davidbombal
      @davidbombal  2 года назад +9

      Thanks so much for sharing your knowledge and experience with us Chris! Looking forward to more and especially the course :)

    • @mrskeptic9957
      @mrskeptic9957 2 года назад +4

      @@davidbombal Thank you both for everything you do :)

    • @JohnMandersonBM
      @JohnMandersonBM 2 года назад +3

      Hey Chris, how do you get endpoints to show country?

    • @ChrisGreer
      @ChrisGreer 2 года назад

      @@JohnMandersonBM Map IP Address Locations with Wireshark (Using GeoIP)
      ruclips.net/video/IlVppluWTHw/видео.html here is a video of how to do it.

    • @admar-nelson
      @admar-nelson 2 года назад +1

      Спасибо за урок!! Thanks for lesson!!! Obrigado pela lição. Não tenho palavras!!

  • @djdawso
    @djdawso 2 года назад +23

    I know Chris mentioned it a few times, but I think it's worth emphasizing that one of the most powerful skills in all Wireshark analysis is just scanning through a capture file looking for things that seem even a little bit unusual. Pretty much all the other smart Wireshark people, such as Kary Rogers, Jasper Bongertz, Hansang Bae, and Laura Chappell, preach this as well. This is one of the main reasons for just looking at a lot of capture files as Chris also suggests (even just normal traffic), since it gives you the experience to more quickly recognize more things that may be out of the ordinary. Yet another excellent video, David & Chris. Well done!!!
    Also one little note: "sort -u" does the same thing as "sort | uniq"

  • @francorreaccna
    @francorreaccna Год назад +8

    I love how professionals are both the way they talk and kind of complement each other with their personalities

  • @robtot1934
    @robtot1934 2 года назад +14

    David, you have managed to bring so many talented experts to your channel, including your experience accumulated over the years... Thank you for your contribution

  • @Ebi_J
    @Ebi_J 2 года назад +6

    Thank you David. I find that whether you are the one sharing or a guest, I always leave each video much more knowledgeable and wanting to know more.

  • @rustybolts8953
    @rustybolts8953 2 года назад +4

    I am old enough to recall the days when even at MIT, the password was usually "Password" or just hit enter. How far we have come since those days.. This is by far the best anti hacking videos I have seen so far. Thanks David.

  • @Stuloud
    @Stuloud Год назад +2

    Wow, This fascinates me. I have always thought that looking at what your machine or network is sending out is the key to finding whether you are compromised or not. I am an old newbie at this. David your channel ROCKS!

  • @the_graytest
    @the_graytest 2 года назад +4

    I think is absolutely necessary to understand packets in order to prevent new forms of malware, and not just with WireShark, NetScat or tools alike. But having a great knowledge abput network with these kind of tools should be great for counterattack and hunting, so I demand a full master course from this brilliant gentleman so I can put my own blue cap on :)

  • @SupItsJ
    @SupItsJ 2 года назад +22

    David, this channel is so underrated. You take real world threats and break them into understandable bits that average users can grasp. Whether or not they believe the threats are actually more common than not is another topic, but trust that this man is peeling back the layers of otherwise invisible crimes that are common. Taking a few easy steps can put off attackers to move on to easier prey, just takes some getting used to getting into new, safer habits.

    • @JonDoe-gi5zf
      @JonDoe-gi5zf Год назад +1

      How is it underrated? He has over 2 million subs 😂😂😂

    • @SupItsJ
      @SupItsJ Год назад

      Should be 20 million. As an IT security pro and graduate I have seen and attended lots of classes, but the planning in David's content is evident in the presentation and engagements.@@JonDoe-gi5zf

  • @billzade8158
    @billzade8158 Год назад +3

    The more I read and learn about Blue Hatting and Purple Hatting, the more I feel like that is where I want to go. Red Team is super cool, but all the blue team threat hunting stuff is intensely interesting and cool. I know that learning how to Pen Test is a vital part of really building a great defense, I am really excited to keep diving into Cyber Security. I'm going through a Software Development Degree in College, and I am seriously considering adding a Cyber Security minor. Thank you gentlemen for the excellent discussion and lesson

  • @tjmarx
    @tjmarx 2 года назад +1

    I like this cut much better than some of your earlier videos. Very frequently these interviews seem to ramble, get a little repetitive and unstructured.
    I really enjoyed how the cut improved that in this video. Whoever the editor is give them a big thumbs up.

  • @verolyn8459
    @verolyn8459 2 года назад +9

    David and his friend is giving us another level of knowledge again.

    • @davidbombal
      @davidbombal  2 года назад +2

      Thank you Verolyn! Chris is absolutely amazing! Grateful that he is sharing his knowledge with all of us :)

  • @onikira3115
    @onikira3115 2 года назад +3

    for some reason Wireshark was never one of the best tool I would have liked to use in the future but now my Perspective in viewing this tool has been far broadened😅 Thanks David and also much thanks to Chris

  • @pivot3india
    @pivot3india 2 года назад +2

    the extent to which we can analyse the packets and go deep inside is making me ready to take the course. thanks for all your efforts.

  • @OLDMANDOM42.Dominic
    @OLDMANDOM42.Dominic 2 года назад +2

    WOW! I have been in IT for over 25 years. This guy just got me interested in another facet of IT.. just splendid! Thanks!

  • @shadowcipher4068
    @shadowcipher4068 Год назад +3

    Good stuff. This guy Chris Greer is awesome. Thanks, both of you.

  • @cryptombt5880
    @cryptombt5880 Год назад +4

    Fantastic video, David. Thanks to Chris also. God, I learnt so much from this video. I'm frequently doing scans on my home network to what is I class as normal traffic etc. Just fantastic video

  • @criptovida
    @criptovida Год назад +5

    Thanks Chris and David putting this together, really amazing to brush up the packet analysis skills.

  • @bAd-sf7iu
    @bAd-sf7iu Год назад

    Thank you for your great lecture!! I and my friends and neighbors have been hacked by a hacking group. I can find a hacking clue, because Chris and David teach sophisticated method. I expect your next great teaching movie for hunting hackers!

  • @jasonb2221
    @jasonb2221 2 года назад +4

    Thank you David amd Chris, this was awesome! I don't know about you guys, but I can't wait to see Chris showcase his tshark custom scripts course.

  • @oshalabashiya9058
    @oshalabashiya9058 2 года назад +1

    I’m 14 minutes in and I’m so stoked that you guys are doing this video. There is nothing I would rather be doing right now. Thanks dudes!

  • @joerockhead7246
    @joerockhead7246 2 года назад +3

    Thanks, David, & Chris, this was a great episode. I really enjoy when you have Chris on.

    • @davidbombal
      @davidbombal  2 года назад +1

      Glad you enjoyed it Joe! Chris is amazing :)

  • @dokkin9549
    @dokkin9549 7 месяцев назад

    I'm a student and I really appreciate and understand this content. Im still longway to go to obtain such skill and knowledge. hope more vids like this

  • @angryb0b-f7n
    @angryb0b-f7n 2 года назад +2

    Brilliant video! Wireshark always seems overwhelming and somewhat intimidating to me, this at the very least shows you how you can effectively use it to threat hunt with some simple processes. Well done!

  • @MarathonMadeGalatians5-22
    @MarathonMadeGalatians5-22 10 месяцев назад

    watching this im thinking to my self and someone whos just started learning "I can learn and do this" :) thank you two for this video 1 year ago

  • @BobBob-qm2bm
    @BobBob-qm2bm 2 года назад +29

    Thanks David and Chris for sharing the knowledge and providing relevant content. Wirewatching is real and relevant separating the good beans from those that are bad👨‍💻

    • @davidbombal
      @davidbombal  2 года назад

      You're welcome! We can all learn so much from Chris :)

  • @duscraftphoto
    @duscraftphoto 2 года назад +3

    As always, amazing content from David and Chris. I found this one especially interesting because I’ve been working on writing malware (to see if I can ha ha) and seeing the traffic at the packet level is awesome.
    Keep it up and ROCK ON!

    • @davidbombal
      @davidbombal  2 года назад +1

      Thank you! Glad you enjoyed it Dustin :)

  • @francon9586
    @francon9586 Год назад +2

    Awesome video. Thanks Chris and David for putting this out there.

  • @upup5133
    @upup5133 2 года назад +1

    My man... This is awesome for those who has time to watch... Even for me cuz I can't wait to watch your another video. Content is amazing and I really like it, keep it going David!!!

  • @massterrbarber
    @massterrbarber 11 месяцев назад

    Great content and I’m a master barber 💈 and I have been on the edge of my seat from the very beginning to the end so this is how it gets done and it’s been interesting to watch so I’m thinking about doing this as fun 🤩 and like you said a beginner tech guy could get lucky 🍀 so my goal is to understand the hunt. Thanks 🙏 for being your self.

  • @isaacfalero
    @isaacfalero Год назад

    The quality of this video is off the charts! Thank you both for your work.

  • @augustedrifande6017
    @augustedrifande6017 Год назад

    It's really a superb video, obvious to someone with little experience, clear and audible, really great work, I love this kind of content, many thanks :-). (Addressed to David Bombal and Chris Greer).

  • @TS-jd6rh
    @TS-jd6rh Год назад +1

    David's podcasts are always fun, interesting and valuable topic thank you for inspiring to get back to learning about cyber security.

  • @factoidsandquotations
    @factoidsandquotations 2 года назад +1

    One of my favorite videos David, this guys good.

  • @centralscrutinizer5116
    @centralscrutinizer5116 2 года назад +1

    Hey David. Yet another great video. Just so you know, I watch MOST of your videos on the youtube app on my smart tv. Unfortunately, I can't like, subscribe or comment on videos when viewing them this way( I don't log into youtube there). Therefore, only about 1 in 10 videos get a like by me, but the truth is, I like them all!!!

  • @ronin2167
    @ronin2167 2 года назад +4

    I had a short course years ago in Wireshark with Laura Chappell. I have a signed copy of her book. It was an awesome class. She showed us how to set up all sorts of filters for Wireshark, but I never really used it and forgot it all. LOL

    • @davidbombal
      @davidbombal  2 года назад +1

      lol... Wireshark gives you a lot of power! Well worth learning how to use it.

  • @sidalexis
    @sidalexis 2 года назад +2

    Currently studying Chris Greer's Wireshark course on Udemy. Fantastic experience

  • @buraksahin7297
    @buraksahin7297 2 года назад +2

    Thank you so so much David and Chris. You are the best! Appreciate it :)

  • @MrBitviper
    @MrBitviper 2 года назад +1

    thanks for another insightful video David
    this is an awesome collaboration. hope we'd get to see more

  • @cwain96
    @cwain96 Год назад

    This is GOLD! Thanks to you both for the extraordinary work you do AND teach!

  • @temynator
    @temynator Год назад +1

    I'm liking that Shark 🦈 stuff man!! I'm actually taking the Google IT support certificate! 😅

  • @druzzzzzz
    @druzzzzzz 2 года назад +1

    This was a fantastic video! I could not see the JA3 fingerprint on my version of Wireshark, will be trying to figure out how to add it to the packets. I will definitely be looking for Chris Greers course on this, I had fun.

  • @davidgreening173
    @davidgreening173 2 года назад

    Nice channel. Fellow analyst pointed me here a few days ago. First thing I recognised, the SA accent.

  • @michelantoniovio934
    @michelantoniovio934 2 года назад +1

    @Chris Greer you're amazing. I'm always watching your videos. Congrats!!! David thanks a lot to share this content with us...

  • @xAngryDx
    @xAngryDx 2 года назад +3

    Amazing video, thank you Chris and David for this amazing content.

  • @Awooga765
    @Awooga765 2 года назад +2

    Whoa! I remember doing this level of analysis in graduate school. I loved it but was told by others that this wasn't an in-demand skill.

    • @lora4624
      @lora4624 2 года назад

      What?? Why wouldnt it be?

    • @jasonb2221
      @jasonb2221 2 года назад +1

      @@lora4624 I was thinking the exact same thing. Why wouldn't knowing how to detect malware and know how it operates in a deep level not relevant in today's cyber space?

  • @refaiabdeen5943
    @refaiabdeen5943 2 года назад +1

    Cheers Guys. That was Awesome and amazing to watch and understand as much as possible. Looking forward to more of this content.

  • @romemadali84
    @romemadali84 2 года назад +1

    i really love how Chris Greer explains pcap

  • @jesussaeta8383
    @jesussaeta8383 Год назад +1

    Great great stuff you guys, you’ve got my creative juices flowing……thank you both very much.

  • @fahmimohamadramadhan3978
    @fahmimohamadramadhan3978 2 года назад +2

    What a great video, helps A LOT in the beginning.

  • @jzk224
    @jzk224 Год назад +1

    Great video. I just spent months on a QUIC baddy for a big org.
    Thanks and I’ll definitely check out your channel

  • @bAd-sf7iu
    @bAd-sf7iu Год назад

    Thank you for your great lecture!! I am a victim of hacking. I can get hacking clue, because David and Chris taught sophisticatid method. I hope you upload further method for hunting hackers!

  • @Sound_Stable
    @Sound_Stable 2 года назад +15

    Using Wireshark on your home network will make you want to throw out all of your smart devices. So many apps on your smart devices request things like voice and camera data when they have absolutely no associated functionality or reason to be doing so. It's very alarming.

    • @GuardDog42
      @GuardDog42 2 года назад

      Thanks for the heads up dude

  • @dummyload7803
    @dummyload7803 Год назад +1

    wow, that was very interessting. People call me a hacker sometimes only because i know the "anykey" :) After this video i learned i know nothing. Never used wireshark however i am familiar with the programname. Too little time left to learn all the stuff that is out there

  • @Glenners
    @Glenners 2 года назад +5

    I love Chris! He's always got the nitty gritty useful info.

  • @meow-iskander
    @meow-iskander 2 года назад +2

    Thanks for the content! Chris is awesome!

  • @Pursuitdnb
    @Pursuitdnb 2 года назад +1

    Great video! Thanks David and Chris!

  • @coolboy288
    @coolboy288 2 года назад +1

    Thanks Chris and David for this very informative session.

  • @cacurazi
    @cacurazi Год назад +1

    Amazing content... Thanks David & Chris

  • @mo938
    @mo938 2 года назад +5

    Curl is not kernel level…..it’s a command line tool. It’s odd to see bc it’s a web request not coming from a browser.

  • @m3ntas
    @m3ntas Год назад +1

    Amazing video David!!! I learned a lot! :) Thanks Chris too, you are a Gigachad!

  • @majiddehbi9186
    @majiddehbi9186 2 года назад +1

    Great duo as always thx for ever and god bless u

  • @mahato-khushboo19
    @mahato-khushboo19 Год назад +2

    @chrisGreer,
    Thanks for the such a wonderful information. I am little bit confuse like if I use the Wireshark in production environment then how to capture the packets to analysis any malicious traffic on daily basis ? Is there any function in Wireshark so that we can analysis and filter out the all the malicious easily? And provide some kind of alert alram or notification something like that.

  • @eyup8267
    @eyup8267 2 года назад +1

    Thank's you David for informations 🌙

  • @ballons789
    @ballons789 Год назад +2

    Hi David. Recently passed my CCNA and started learning about wireshark by following Chris Greers videos. I wanted to learn more about networking at the packet level but now im hooked with threat hunting. Finding out what could be lurking in your network it’s exciting. Have you guys dropped the threat hunting course?

  • @alexandrohdez3982
    @alexandrohdez3982 2 года назад

    Previous video and this are GREAT. 👏👏👏👏👏

  • @rajneeshrai1781
    @rajneeshrai1781 2 года назад +8

    Another episode... Time to grab the packet cap 🧢 💯

    • @davidbombal
      @davidbombal  2 года назад +1

      Hope you enjoy the video Rajneesh!

  • @madankhatri2080
    @madankhatri2080 2 года назад +5

    Nice video David,
    Please invite digital forensic hackers

  • @Supahelt98
    @Supahelt98 Год назад

    Thanks to you both for creating such valuable content!

  • @tawabullas5058
    @tawabullas5058 2 года назад +4

    We need more contents like this

    • @davidbombal
      @davidbombal  2 года назад

      Chris is working on a full course :) Hopefully also get him back on the channel soon.

    • @Abdirahmaann
      @Abdirahmaann 2 года назад

      @@davidbombal What is that’s course David can you name that course Chris doing

  • @MichaelSmith-bi8pc
    @MichaelSmith-bi8pc Год назад

    A really useful video. Thesis is so powerful and every day is a learning day. Have an anan 8000fle. Glad I have not updated sunsdr2 software form vs2.only thing I miss on thesis is recording band activity and the ability to variably change FM rx bandwidth

  • @WTF-Producciones
    @WTF-Producciones 3 месяца назад

    Love wireshark and the mode monitor ever, is a open door to the real time traffic

  • @Uncle_Buzz
    @Uncle_Buzz 10 месяцев назад

    Chris Greer, putting the FUN in fundamentals.

    • @Uncle_Buzz
      @Uncle_Buzz 10 месяцев назад

      ... or is it the mental... ?

  • @anjanbora7943
    @anjanbora7943 Год назад +2

    Best hacker channel on RUclips ❤

  • @peacefulencounters9466
    @peacefulencounters9466 Год назад

    Great content David and Chris

  • @dustinhxc
    @dustinhxc Год назад +1

    Extremely entertaining and informative!

  • @williambarrett7108
    @williambarrett7108 2 года назад +1

    Thank you so much for these videos! How do you load P-caps into wire shark? That nuts and bolts kind of content would be great!

  • @evodefense
    @evodefense Год назад +1

    Amazing video thank you for this video!

  • @MrWwatsonn
    @MrWwatsonn 2 года назад +2

    Hi Chris, what did you install to show the country in wireshark ?

  • @nickadams2361
    @nickadams2361 2 года назад

    Second video I've watched on the channel. You def have a different style. The videos are longer but there's much more depth, I enjoy it better than 12 minute in your face videos with a strange thumbnail

  • @jmatuus
    @jmatuus 2 года назад +1

    This is public service! Thank you!

  • @privateinfo4820
    @privateinfo4820 2 года назад +1

    Trying to follow along.. and possibly purchase some of Chris' training, but I notice on my Wireshark installation VM on our domain (domain admin rights) my country columns aren't populated at all (when viewing endpoints to check for nefarious countries). Am I missing a cfg or something somewhere??? Thanks for this video - very helpful!!

  • @muhammadabdul7696
    @muhammadabdul7696 2 года назад +3

    Perfect Timing!

    • @davidbombal
      @davidbombal  2 года назад +1

      Hope you enjoy the video Muhammad!

    • @muhammadabdul7696
      @muhammadabdul7696 2 года назад

      @@davidbombal sure will do..
      Thanks a ton 🙂Chris and David

  • @handymangirl6018
    @handymangirl6018 Год назад

    This video was awesome. Question? When you found that malware threatbot thingy how do you then get rid of it

  • @royalhooks6810
    @royalhooks6810 6 месяцев назад

    Amazing methodology- very usable

  • @satoshiborishi6898
    @satoshiborishi6898 10 месяцев назад

    Great tutorial with a real life example!

  • @Twdsheikh2931
    @Twdsheikh2931 2 года назад

    @David Bombal Thanks , from india, myself farhan, studying in 10th std and also learning ethical hacking and Networking and coding my age is 17 , i am goona start learning linux and I think ubuntu is a very beginner Friendly linux Distribution , and also its gui is Fantastic, i don't wanna install it manually,
    Please Dear david sir,
    There are many People who want ubuntu 22.04 not 20.10 running in windows with wsl2
    Make sure you will make a video on it,
    Your content is helpful and awesome. I Always learn something new from your video
    Love from india,
    Farhan😍😍😍❤💓

  • @dirty9496
    @dirty9496 Год назад

    Love the videos! Can you guys make one that is dedicated to setting up Wireshark profiles?

  • @johnsnow1062
    @johnsnow1062 2 года назад +1

    Thank you so much for the lesson

  • @danjoseph5707
    @danjoseph5707 2 года назад +1

    Really informative video. Thank you

  • @harahatchi9923
    @harahatchi9923 2 года назад +1

    Great subject and wish to dive on similar subjects in future episodes.
    BTW I prefer wired earsets lool : D

  • @kialim
    @kialim 2 года назад +1

    Chris, what are your views on Network Detection & Response (NDR) solutions? What are your thoughts on enterprises moving to the cloud? How do you perform threat hunting in such an environment. Thanks!

  • @kveldulfpride
    @kveldulfpride 2 года назад

    Does the course cover pyshark and automation response?

  • @Batman1krr
    @Batman1krr 2 года назад +1

    I just started diving into wire shark and what do you know - this was posted. Thanks :)

  • @EricBrokeIt
    @EricBrokeIt 2 года назад +1

    As always, great stuff.

  • @sid8880
    @sid8880 2 года назад +1

    Hi David, thanks for setting this up with Chris, I’m just starting off with wire shark and have already purchased your Udemy core skills course, its on my to do list! Was just looking to purchase the joint one ‘getting started’ In which order do you recommend completing?

  • @gtoo9499
    @gtoo9499 Год назад

    OMG u Asome!
    Thank you for your video, this is really helpful =)

  • @skeptisch2751
    @skeptisch2751 2 года назад +1

    Chris can you show us how to capture packets from modem egress port? I am interested in all the outgoing traffics from LAN but wireshark captures only one NIC on my Desktop.

  • @Uncle_Buzz
    @Uncle_Buzz 10 месяцев назад

    Here's a question for Chris .... Can I use Wireshark to capture packets on my remote gateway through a VPN connection to that subnet? If so, what filters would you use? Thanks!