The following questions may help form you report:. Successful buffer overflow of webserver with ISS_USR privileges One of several failed buffer overflow attempt of Webserver The table shown here is an example only and is NOT RELATED to your investigation. Hint – what is port 443 used for? Is there anything unusual here? If so what?Ģ.2 Recommendation: Create a table with headings as shown in the following example and multiple entries related to your investigation. These will be useful when creating filters in Wireshark. Make a note of empirical and destination port numbers and relevant IP addresses.

Document everything that looks suspicious and try to explain why it occurred. In summary, why did they fire? What are the crucial components in packet headers? What is the vulnerability the syntax is trying to protect and what is the compromise?Ģ.1 Recommendation: Use a session analysis tool which creates a time ordered list useful for session reconstruction. Identify the main attack alerts and record your findings.ĭocument and analyse the packet metadata using Wireshark. You should attempt to answer all the questions specified.Īnalyse the assignment.pcap file using Wireshark. It is suggested you adopt the following approach. You may find others if so, feel free to document those too. You should specifically be looking for 2 main disparate attacks, from separate IP addresses.

Identify and explain ARP requests, Responses.

You must use Wireshark as the mail tool but, it’s likely you will want to use others too, but that is optional.īy using Wireshark, you will to apply different features and comment on the following using Traffic Analysis Tools:.

To do this you will be using the distribution Security Onion. In short, your assignment is to analyse and interpret this traffic and to identify malicious activity. The traffic into and out of the honey pot was captured as a packet capture file (pcap). The honey pot was compromised several times. An organisation set up a honey pot in the hope of catching persistent hackers on their network.

Wireshark usage in forensic science