HackBlue

Tools · Workbench

Network tools

Lessons on captures and discovery: what an interface was allowed to see, and how that record becomes a finding.

  • 24 lessons
  • 6 h of reading
  • 4 topics
Start with lesson 1All workbenches

These are the network capture and discovery tools. A capture records frames from an interface you are allowed to listen on. A discovery pass reports hosts and ports. Either one is an observation until it names an asset, who can reach it, and what should change.

Use these tools on ranges named in a scope, or on hosts you own, or on a file the owner already handed you. The lessons below cover tcpdump, TShark, Zeek, and NetworkMiner.

tcpdump

6 lessons

  1. 01tcpdump: what a capture file actually holdstcpdump records frames from an interface you are allowed to listen on, or reads a pcap you already have. The file is evidence: who talked, when, and how much, plus any bytes the protocol left in the clear.14 min
  2. 02tcpdump: pull one conversation and read the flagsA conversation filter names both hosts and the port. -nn, -tttt, and -r control how the lines look. The flag letters tell you which side sent SYN, ACK, data, FIN, or RST.16 min
  3. 03tcpdump: handshake, reset, and a SYN that nobody answersThree patterns decide the next step: a finished handshake, a reset, or a SYN with no reply. Each one points at a different log, and only one of them looks like a silent filter.15 min
  4. 04tcpdump: DNS questions and answers on the wireUDP port 53 lines show the name a lab host asked for and the address the resolver returned. That is how you check a wrong destination before you blame the service that never saw a connection.14 min
  5. 05tcpdump: who sent the bytes, and how manyThe arrow shows direction. length shows application bytes in that frame. A lab host that suddenly sends a long run of large frames to an unexpected address is a data-movement question, even when TLS hides the contents.14 min
  6. 06tcpdump: keep the file small, private, and ready to hand offA useful capture is bounded, flushed to disk, and stored like any other sensitive note. tcpdump is the wrong place to hunt for an application field once you know which conversation matters.13 min

TShark

6 lessons

  1. 01tshark: read a capture without opening a GUItshark is Wireshark's terminal reader. Point -r at the lab pcap, keep the first pass short with -c, and add -2 only when the field you need depends on a later frame.14 min
  2. 02tshark: pull the fields that answer one questionA display filter chooses frames. -T fields and one -e per column turn those frames into a table. Header row on, and the table is something you can diff against the ticket without reading a hex pane.16 min
  3. 03tshark: display filters, and the capture filter you already usedBPF decides what a live capture bothers to store. A display filter decides which stored frames a read will print. Mixing the two spellings is the usual reason a command errors or, worse, prints the wrong set.14 min
  4. 04tshark: conversations, endpoints, and the protocol treeStatistics answer who talked to whom and how much, without printing every frame. -q keeps the packet list out of the way so the table is the whole result.15 min
  5. 05tshark: TLS metadata while the payload stays opaqueA Client Hello carries the name the lab client asked for. Certificates and versions are metadata. The application bytes stay unreadable unless the owner already gave you a key log for that lab service.15 min
  6. 06tshark: cleartext HTTP fields in a lab captureWhen the lab service really is HTTP, method, host, path, and status are ordinary fields. A secret in a path or a header is the finding. The fix is to stop putting it there and to move the service to TLS.15 min

Zeek

6 lessons

  1. 01Zeek: turn a lab pcap into logsZeek reads a capture and writes one log per protocol instead of one line per frame. conn.log, dns.log, and http.log are the three a defender opens first. The uid column is how those files point at the same connection.15 min
  2. 02Zeek: what a defender reads in conn.logconn.log is one row per connection. The defender looks at who started it, who answered, the state, the history letters, and which side sent the application bytes.16 min
  3. 03Zeek: what a defender reads in dns.logdns.log records the name, the type, the response code, and the answers. A defender compares answers to the runbook, watches for a resolver that should not be answering, and treats a burst of strange names from one host as a question about that host.15 min
  4. 04Zeek: what a defender reads in http.loghttp.log is one row per cleartext HTTP request, with the method, host, URI, status, and user agent. A populated password column, or a secret in the URI, means the lab still has a cleartext hop.15 min
  5. 05Zeek: one uid across conn, dns, and httpThe uid is Zeek's join key. A DNS answer, the connection that followed it, and a cleartext request are three rows that share an identifier when they are the same flow. That is how a defender checks a story without rereading the pcap.15 min
  6. 06Zeek: notices, weird events, and what you escalatenotice.log is Zeek's judgment. weird.log is a protocol oddity. Both are leads tied to a uid. A defender confirms them in conn.log before paging anyone, and treats a file-wide checksum weirdness as a capture problem.14 min

NetworkMiner

6 lessons

  1. 01NetworkMiner: open a capture as a host inventoryNetworkMiner reads a pcap and sorts it into hosts, sessions, and artifacts. It is a case tool for a file you already have. The free build is a graphical program. You confirm it is a capture before you open it.14 min
  2. 02NetworkMiner: the hosts view, and which guesses to trustThe hosts view mixes observations and guesses. An address, a name heard on the wire, and a MAC vendor are observations. An operating-system fingerprint is a guess you confirm with the owner's inventory.15 min
  3. 03NetworkMiner: the files view without running anythingThe files view reconstructs objects from cleartext protocols the parser understands. You hash them, you record which host sent them, and you do not execute them. A file that rode inside TLS will not be sitting there as a document.15 min
  4. 04NetworkMiner: a credential row means the channel was cleartextThe credentials tab lists authentication that a parsed protocol carried in the clear, such as HTTP basic or FTP. The row is a defect report. You rotate the lab secret and turn on TLS. You do not reuse the value or paste it into the ticket.14 min
  5. 05NetworkMiner: sessions, DNS, and parametersSessions summarize who talked. DNS lists the names in the file. Parameters lists cleartext fields. Together they are a map of the case. A single flag or a byte in one frame still belongs to tshark.14 min
  6. 06NetworkMiner: when it is the wrong toolNetworkMiner is the right first look for hosts, cleartext files, and cleartext credentials in a pcap you already have. It is the wrong tool for a single frame, a week of sensors, or a document that never left TLS.14 min