Practical 7 : WIRESHARK (SNIFFER)
Aim :  Use Wireshark (Sniffer) to capture network traffic and analyze and thus check vulnerability of network systems.
Wireshark is a free, open-source network protocol analyzer. It acts as a "packet sniffer," allowing IT professionals and security analysts to capture, inspect, and deeply examine data traffic traveling across a computer network in real time. 
What is Wireshark?
Wireshark is a network packet analyzer. A network packet analyzer presents captured packet data in as much detail as possible.
You could think of a network packet analyzer as a measuring device for examining what’s happening inside a network cable, just like an electrician uses a voltmeter for examining what’s happening inside an electric cable (but at a higher level, of course).
In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, that has changed. Wireshark is available for free, is open source, and is one of the best packet analyzers available today.
Some intended purposes
Here are some reasons people use Wireshark:
Network administrators use it to troubleshoot network problems
Network security engineers use it to examine security problems
QA engineers use it to verify network applications
Developers use it to debug protocol implementations
People use it to learn network protocol internals
Wireshark can also be helpful in many other situations.
Features
The following are some of the many features Wireshark provides:
Available for UNIX and Windows.
Capture live packet data from a network interface.
Open files containing packet data captured with tcpdump/WinDump, Wireshark, and many other packet capture programs.
Import packets from text files containing hex dumps of packet data.
Display packets with very detailed protocol information.
Save packet data captured.
Export some or all packets in a number of capture file formats.
Filter packets on many criteria.
Search for packets on many criteria.
Colorize packet display based on filters.
Create various statistics.
…​and a lot more!
 Live capture from many different network media
Wireshark can capture traffic from many different network media types, including Ethernet, Wireless LAN, Bluetooth, USB, and more. The specific media types supported may be limited by several factors, including your hardware and operating system. 
Here are some things Wireshark does not provide:
Wireshark isn’t an intrusion detection system. It will not warn you when someone does strange things on your network that he/she isn’t allowed to do. However, if strange things happen, Wireshark might help you figure out what is really going on.
Wireshark will not manipulate things on the network, it will only “measure” things from it. Wireshark doesn’t send packets on the network or do other active things.
1.Inspect traffic for a specific IP address.
Filter : ip.addr==192.168.2.34
(Check the IP address of machine using ipconfig command in cmd line)
Output :
Comments :
~ The first image shows all the packets and network traffic being captured.
~ Second image shows the terminal.
~ Third image shows the Frame 1’s (transmission no. 1) all the details like – source, destination, arrival time, epoch time. Similarly if any other transmission is selected (Ex : Frame 15)  then the details regarding that frame/transmission are displayed.
~ Last image shows the output in the third window i.e. some hexadecimal digits marked in blue. These are the actual raw data carried by the frame from the source to the destination but in hexadecimal format.

 2.Sniff the credentials details from a vulnerable website: techpanda.com.
Filter : Keep scanning first. Goto website and then stop scanning and put filter “http”. Click the blue arrow at the side.
Output :
Comments : The new area in console Hypertext Transfer Protocol has appeared. It shows the host i.e. the website we logged in into, the user agent i.e. the browser that it works on and other details. While logging in, the get method was used. That too is seen.

 3.Check what user has typed in browser
   -http://www.techpanda.org/index.php
   Filter : http.referer contains "search"
Output :
Comments : The details for the search appear in the console.

 4.Check what string user has passed in google search engine.
   Filter : http.referer contains “search”
(here I used directly http as filter and then checked the console to get the details…see image 2 in output)
(First scan, then search on browser with word search in URL, then stop scanning and add filter)
Output :
Comments : Details regarding the search wherein “search” word was used during query put into browser, appears on wireshark. Sniffing is successful.

 5. Find out packets which are getting the response as PAGE
 NOT FOUND.
URL used : http://info.cern.ch/authentication
Filter : http.response.code==404
Output :
Browser search :
Comments :
404 code is for page not found. So thus when you search for the page, the browser throws a 404 not found error. Wireshark sniffs this as well and when we put the above filter details regarding the search appears.

 6.   Find out those packets which are getting responses.
Filter : http.response.code==200
Output :
Comments :
200 code is for page found/all ok. So thus when you search for the page, the browser returns the status of the page as 200 i.e. found the searched page. Wireshark sniffs this as well and when we put the above filter details regarding the search appears.

 7. Find Packets-: Browser Specific.
     Filter : http.user_agent contains Firefox
Output :
Browser search :
Codes for server.py and client.py :
Server.py :
import socket
s=socket.socket()
print("Socket created successfully !")
port=8080
s.bind(('localhost',port))
print("Socket binded to %s"%(port))
s.listen(5)
print("Socket is listening...")
while True:
    c,addr=s.accept()
    print("Got connection from ",addr)
    c.sendall('Thank you for connecting! '.encode())
    c.close()
Client.py :
import socket
s=socket.socket()
port=8080
s.connect(('localhost',port))
print(s.recv(1024).decode())
Comments :
The above filter finds browser specific packets. The request made to the browser and the browser’s response both are sniffed and captured by wireshark. In the above case it is seen that the request is captured in Frame (transmission no.) 546 and its response is given in frame no. 548. So these details are also given for easy understanding.

 8.Inspect traffic between specific source and destination
Filter : ip.aadr==192.168.0.107 && ip.addr==192.168.0.108
Output :
Comments :
The traffic i.e. data packets being sent between the two IPs is sniffed.

 9.To sniff communication between client and server
Filter :
Output :
Comments :
If we see the wireshark output, the 7th frame shows the ACK flag data packet being sent from server to client (443 to 23303) and then in 15th frame the other way round. Communication then happens. This is sniffed using wireshark. In Internet Protocol the source and destination also changes accordingly.
