Scribd
Upload
4 views7 pages

Practice Network 4

The analysis of the WEBSTRIKE.pcap file reveals that an IP from Tianjin, China, has been reported 13 times for malicious activity. By examining TCP streams and HTTP request methods in Wireshark, it was found that the attacker successfully uploaded a file to the server while bypassing a denial on a previous request. Additionally, the attacker accessed the 'passwd' file through traffic on port 8080.

Uploaded by

Manuel Montana
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
4 views7 pages

Practice Network 4

The analysis of the WEBSTRIKE.pcap file reveals that an IP from Tianjin, China, has been reported 13 times for malicious activity. By examining TCP streams and HTTP request methods in Wireshark, it was found that the attacker successfully uploaded a file to the server while bypassing a denial on a previous request. Additionally, the attacker accessed the 'passwd' file through traffic on port 8080.

Uploaded by

Manuel Montana
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Reviewing the WEBSTRIKE.

pcap file we see the WireShark network traffic and copy the IP
to verify it in abuseip

We note that this IP has been reported 13 times and comes from Tianjin China
Using follow TCP Stream in Wireshark we can observe much more information about the
attacker
or we could also use the command search [Link] == GET in Wireshark and in
the hypertext section it would give us more information about the attacker
Usually when you try to upload a file to a server we use the "POST" method so we look in
Wireshark [Link] == POST and we see that there are two requests that match
the attacker's IP address.

This is because one request was denied and the other was able to upload the file by
applying a bypass method.
Reviewing the network traffic we see how the attacker uploads the file to the
/reviews/uploads/ folder
PORT 8080
Using the filter ([Link]==8080) && ([Link]==[Link]) in Wireshark we can see that it
marks a different colored packet and upon closer inspection we see that the attacker gained
access to the "passwd" file.

You might also like