# Wireshark tricks

## Wireshark tricks

<details>

<summary>📝<a href="https://www.twitch.tv/hacktricks_live/schedule"> </a><mark style="color:blue;"><strong>Breached Write Content</strong></mark><strong> Wednesdays</strong></summary>

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).

</details>

## Improve your Wireshark skills

### Tutorials

The following tutorials are amazing to learn some cool basic tricks:

* <https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/>
* <https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/>
* <https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/>
* <https://unit42.paloaltonetworks.com/using-wireshark-exporting-objects-from-a-pcap/>

### Analysed Information

**Expert Information**

Clicking on ***Analyze** --> **Expert Information*** you will have an **overview** of what is happening in the packets **analyzed**:

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(570\).png)

**Resolved Addresses**

Under ***Statistics --> Resolved Addresses*** you can find several **information** that was "**resolved**" by wireshark like port/transport to protocol, MAC to the manufacturer, etc. It is interesting to know what is implicated in the communication.

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(571\).png)

**Protocol Hierarchy**

Under ***Statistics --> Protocol Hierarchy*** you can find the **protocols** **involved** in the communication and data about them.

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(572\).png)

**Conversations**

Under ***Statistics --> Conversations*** you can find a **summary of the conversations** in the communication and data about them.

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(573\).png)

**Endpoints**

Under ***Statistics --> Endpoints*** you can find a **summary of the endpoints** in the communication and data about each of them.

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(575\).png)

**DNS info**

Under ***Statistics --> DNS*** you can find statistics about the DNS request captured.

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(577\).png)

**I/O Graph**

Under ***Statistics --> I/O Graph*** you can find a **graph of the communication.**

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(574\).png)

### Filters

Here you can find wireshark filter depending on the protocol: <https://www.wireshark.org/docs/dfref/>\
Other interesting filters:

* `(http.request or ssl.handshake.type == 1) and !(udp.port eq 1900)`
  * HTTP and initial HTTPS traffic
* `(http.request or ssl.handshake.type == 1 or tcp.flags eq 0x0002) and !(udp.port eq 1900)`
  * HTTP and initial HTTPS traffic + TCP SYN
* `(http.request or ssl.handshake.type == 1 or tcp.flags eq 0x0002 or dns) and !(udp.port eq 1900)`
  * HTTP and initial HTTPS traffic + TCP SYN + DNS requests

### Search

If you want to **search** for **content** inside the **packets** of the sessions press *CTRL+f*. You can add new layers to the main information bar (No., Time, Source, etc.) by pressing the right button and then the edit column.

Practice: [https://www.malware-traffic-analysis.net/](https://www.malware-traffic-analysis.net)

## Identifying Domains

You can add a column that shows the Host HTTP header:

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(403\).png)

And a column that add the Server name from an initiating HTTPS connection (**ssl.handshake.type == 1**):

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(408\)%20\(1\).png)

## Identifying local hostnames

### From DHCP

In current Wireshark instead of `bootp` you need to search for `DHCP`

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(404\).png)

### From NBNS

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(405\).png)

## Decrypting TLS

### Decrypting https traffic with server private key

*edit>preference>protocol>ssl>*

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(98\).png)

Press *Edit* and add all the data of the server and the private key (*IP, Port, Protocol, Key file and password*)

### Decrypting https traffic with symmetric session keys

It turns out that Firefox and Chrome both support logging the symmetric session key used to encrypt TLS traffic to a file. You can then point Wireshark at said file and presto! decrypted TLS traffic. More in: <https://redflagsecurity.net/2019/03/10/decrypting-tls-wireshark/>\
To detect this search inside the environment for to variable `SSLKEYLOGFILE`

A file of shared keys will look like this:

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(99\).png)

To import this in wireshark go to \_edit > preference > protocol > ssl > and import it in (Pre)-Master-Secret log filename:

![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(100\).png)

## ADB communication

Extract an APK from an ADB communication where the APK was sent:

```python
from scapy.all import *

pcap = rdpcap("final2.pcapng")

def rm_data(data):
    splitted = data.split(b"DATA")
    if len(splitted) == 1:
        return data
    else:
        return splitted[0]+splitted[1][4:]

all_bytes = b""
for pkt in pcap:
    if Raw in pkt:
        a = pkt[Raw]
        if b"WRTE" == bytes(a)[:4]:
            all_bytes += rm_data(bytes(a)[24:])
        else:
            all_bytes += rm_data(bytes(a))
print(all_bytes)

f = open('all_bytes.data', 'w+b')
f.write(all_bytes)
f.close()
```

<details>

<summary>📝<a href="https://www.twitch.tv/hacktricks_live/schedule"> </a><mark style="color:blue;"><strong>Breached Write Content</strong></mark><strong> Wednesdays</strong></summary>

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).

</details>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://breached.gitbook.io/dashboard/generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.