Now based on the feedback that I've received I'm going to show you some additional python scripts and
show you how you can leverage pi shock to capture usernames and passwords automatically off the wire.
In this example I've got an O SPF script I've gotten fifty P scripts and I've got a telnet script.
These are python scripts so I'll show you in a moment how you can use both pi shock which leverages
t shock to capture traffic off the wire in real time and then look for something in that capture such
as 0 SPF and then print something.
Now I've expanded my Jena 3 topology slightly I've still got my boon to client which is connected in
this example to a Cisco switch which in turn is connected to an ether switch which is connected to the
Internet.
I've got a bunch to two P.C. and I've got a toolbox.
P.S. running here what I have done on the Cisco switch is enable port span or mirroring so on the Ethernet
switch show run scroll down all the way to the bottom
notice I've got these monitor sessions I'm monitoring traffic from this source interface gigabit 0 1
and I'm copying that to interface gigabit 00 so all traffic that's been received on gigabit 0 1.
This interface to the broader is gonna be copied to this interface.
In other words to my Ubuntu client where I'm running t shock and Pi shock.
So again source interface gigabit 01 destination interface gigabit 00.
I've got to this tool box server it's running an empty piece of TFT piece of web server and so forth.
What I'll do as an example is copy the config of the router to the tool box over using FCP and using
this FCP script I should be able to see the username and the password dynamically captured using pi
shock you know in previous videos I've shown you how to install pi shock but all demonstrated again
here.
If you're happy with the installation of T shock and Pi shock then skip the rest of this video and go
to the next video we'll show you the first script which is always P.F. OK so only continue watching.
If you want to see how to install this ingenious 3 there is a problem downloading traffic from the Internet
through a Cisco switch.
So I'm gonna get this boon to client to connect to the Internet directly via the ether switch.
That's just so that I can install the software so on the Ubuntu client IP config shows me my IP address.
First thing I'll do.
Per my sort of list of Scripts is app.
Get updates update Ubuntu references
okay.
So that's done.
Next thing to do is to install t shock py shock a leverage is t shock.
It basically is a rapper 40 shock so you can get it to do anything that t shock does so through a python
script you can manipulate stuff in t shock.
You can extract information from t shock in the same way as if you were using it manually but we're
doing that through python.
Okay.
The next thing I'll do is install Python 3 Pip so apt get install Python 3 pip install that
that actually installed Python at the same time so Python 3 will be installed as well.
And then I'll install pi shock using Pip 3.
So basically you could just copy these commands onto a boon to host and install the software yourself.
I have shown you how to do this previously but I just want to show you the full process of how to get
this setup.
Okay that's done.
So the last step is Pip install pi shock okay and that's done as well.
So Python 3 that works ti shock.
Hopefully we'll see some captures.
There you go.
So t shock is now installed pie shock is installed so I mean to delete that link and connect the P.C.
directly to gigabit 00 on the switch because Port merging is happening from this interface to this interface.
So let's go back to the client and make sure that it's seeing the traffic so ti shock.
Are we seeing any packets.
Yes we are.
There is no SPF packet as an example.
There's EAI GOP and on the road.
As an example if I pinged one on 2 1 6 8 122 2 5 4 that's the net cloud we should see ICMP traffic assuming
that that's working properly.
We don't see that let's do a Let's do a ping to 2 5 5 seeming that I'm doing it right.
Here you can see the broadcast traffic so the ICMP traffic is being sent so that's great.
What I'll do is a lost test is ping from the tool box to the broader and make sure that that is seen
by the T shock application so the right has got this IP address.
I'm going to.
Well let's do it from the boon to host from a boon to to so on a boon to to I should be able to paying
1 on 2 1 6 8 1 22 and the IP address of the router which is 80 to so the ping succeeds and on a boon
to one we should see
those ICMP packets and there you go.
Notice I can see the ICMP messages.
So that works great.
Okay.
So in the next video I'll show you how we use these python scripts to capture traffic.