1 00:00:00,390 --> 00:00:05,980 OK so this video I'm going to show you how to capture FCP off the wire Using pi shock. 2 00:00:06,180 --> 00:00:10,400 So I'm using a Python script once again I'm importing pi shock. 3 00:00:10,470 --> 00:00:16,740 I'm doing a live capture on Ethan at zero so this a boon to host is going to be capturing traffic in 4 00:00:16,740 --> 00:00:18,170 real time off. 5 00:00:18,210 --> 00:00:19,510 Ethan at zero. 6 00:00:19,770 --> 00:00:25,730 And then I've got a loop here saying that for packaging capture if it's an FTE Pete packet. 7 00:00:25,740 --> 00:00:27,830 So look for ATP in the packet. 8 00:00:27,840 --> 00:00:31,530 In other words find out if it's an FTB packet. 9 00:00:31,530 --> 00:00:38,940 This is a try an exception rule which basically says try and do something if there's a problem with 10 00:00:38,940 --> 00:00:39,590 the output here. 11 00:00:39,600 --> 00:00:48,100 Then just continue with a script don't break the script so try and do the following output equals packaged 12 00:00:48,140 --> 00:00:48,770 ATP. 13 00:00:48,780 --> 00:00:50,960 So we're looking for an FTE packet. 14 00:00:51,090 --> 00:01:00,810 And then if we find a user in this output which I've made a string print username and then print the 15 00:01:00,810 --> 00:01:02,910 actual output as a string. 16 00:01:02,910 --> 00:01:10,320 Otherwise in other words else if look for past in the string and then print this output out. 17 00:01:10,320 --> 00:01:12,110 So it's actually gonna be easier just to show you. 18 00:01:12,110 --> 00:01:17,760 So let's run the script and then I'll show you what it's doing exactly again. 19 00:01:19,410 --> 00:01:23,640 So I'll create a script called F2 PD or P Y paste that script in. 20 00:01:24,600 --> 00:01:27,450 So this is a very basic script that I've written once again. 21 00:01:27,460 --> 00:01:32,250 A cat FCP dot P Y there's a very basic script. 22 00:01:32,250 --> 00:01:42,420 What I'll do now is run that scripts of Python TPD or P Y so Python 3 running FCP P Why nothing's happening 23 00:01:42,420 --> 00:01:52,350 at the moment but what I'll do is copy the running config from the router to the tool box server. 24 00:01:52,480 --> 00:01:59,450 So the first thing I need to do is specify a FTB username which in this case I'm going to specify is 25 00:01:59,460 --> 00:02:02,830 root and FTB password. 26 00:02:02,830 --> 00:02:05,420 In this case is going to be genus 3. 27 00:02:05,530 --> 00:02:11,740 That is the username and password that I need to use on the FTB server which is running on tool box 28 00:02:11,740 --> 00:02:12,860 1. 29 00:02:12,880 --> 00:02:18,900 So this is the FTB server ip address ends in 99. 30 00:02:19,060 --> 00:02:23,470 So let's get that a boon to console up here it is. 31 00:02:23,620 --> 00:02:33,480 And then on the router what I'll do now is copy the running config from the router to the FTB server 32 00:02:33,810 --> 00:02:42,960 ip address 1 1 2 1 6 8 122 9 9 that's the IP address of the tool box server config will be that this 33 00:02:42,960 --> 00:02:47,730 will then log into the FTB server and copy the config which it's done. 34 00:02:47,730 --> 00:02:52,100 Notice writing config that's been done but notice on my a boon to host. 35 00:02:52,110 --> 00:03:03,560 I can see username is root password is genius 3 I've just formatted the output nicely using this little 36 00:03:03,560 --> 00:03:04,630 script. 37 00:03:04,970 --> 00:03:13,590 So looking for user they would found it prints this output so prints username. 38 00:03:13,610 --> 00:03:18,220 There we go prints the output that's what it's captured. 39 00:03:18,260 --> 00:03:21,320 So the FTB layer. 40 00:03:21,320 --> 00:03:26,960 In other words in the 0 assigned model it's not Layer 2 it's not layer 3 it's highly is. 41 00:03:26,960 --> 00:03:33,650 So this is actually an application FTB runs on TTP so it's not layer to Ethan it not 3 which is IP not 42 00:03:33,650 --> 00:03:34,990 4 which is TTP. 43 00:03:35,060 --> 00:03:43,570 It's layers 5 to 7 FCP User username is this password is genus 3. 44 00:03:43,580 --> 00:03:45,420 You can see that in the output there. 45 00:03:45,530 --> 00:03:49,280 So it's looking for the username looking for the password and essentially printing it out. 46 00:03:49,370 --> 00:03:51,320 So let's do that again. 47 00:03:51,530 --> 00:03:55,740 Copy running config FCP FTB server is this. 48 00:03:55,940 --> 00:04:02,600 Notice once again that I'm copying the config from this writer to this tool box but because I'm running 49 00:04:02,600 --> 00:04:06,320 span here the boon to client is seeing this. 50 00:04:06,620 --> 00:04:13,220 Now you could use hacking tools like it to cap to poison the network or you could do other things such 51 00:04:13,220 --> 00:04:19,850 as set up a rogue DHEA piece over and default gateway to manipulate where traffic goes and I'll show 52 00:04:19,850 --> 00:04:24,120 you some of those using Kelly Linux in this course. 53 00:04:24,380 --> 00:04:29,310 So copy the config to the FTB server it's done. 54 00:04:29,360 --> 00:04:40,370 And notice there again is a username and password so you could once again run the script and simply 55 00:04:41,330 --> 00:04:47,990 get this running in the background and save it to a file or email it to you or do something else so 56 00:04:47,990 --> 00:04:50,540 that you get the username and password off the wire. 57 00:04:51,540 --> 00:04:53,420 Okay so that was an example of ATP. 58 00:04:53,470 --> 00:04:57,000 Let's try telnet telnet is not a good idea. 59 00:04:57,040 --> 00:05:00,880 Neither is FCP another clear text protocols in a network. 60 00:05:00,880 --> 00:05:03,460 We should use encrypted protocols whenever possible.