Analysing FTP traffic using Wireshark - The Logical Kid

Hello! I am back with the new post, and this deals with analysis of FTP traffic using Wireshark.
We will be dealing with identification of data sent/received over FTP and retrieval of files (if any downloaded/uploaded).

Pre-requisites:
* Wireshark

* a PCAP file which may have FTP traffic captured. I have got my own, and if you do not have, you can download it from here.

Note: Click on the images to enlarge

Let's begin!

1. Open the pcap file in Wireshark.

2. To find out if there is any FTP traffic in it, just apply the filter 'ftp' in the display filter.

3. Now when you see FTP traffic, find out if any data was downloaded by a user. To find out, just apply the display filter ftp.request.command=="RETR"

4. You can see a retrieve (RETR) request by a few frames, let us see the frame number 767 which was the first instance.

5. Now clear the filters and scroll down to a couple of packets before frame 767. If you look at the frame number 762, the "info" tab gives some information. If you click on the "packet details" pane and on "File Transfer Protocol (FTP)" as shown in the picture below, you will find a field called "passive port". Note down the port number of that field and also the source IP Address of the same.

 We found that the IP Address is 149.20.20.135 and the port number is 30893

6. Now we need to find out any activity to/from the IP address 149.20.20.135 over the port 30893.

To achieve the same, apply the following filter in Wireshark: ip.src==149.20.20.135 and tcp.port==30893

We get the following output.

7. What next?  Observe the frame number 765? We can see some activity over the port 30893 from the source IP 149.20.20.135. Lets "Follow TCP stream"

8.  Select the data from the source (149.20.20.135) to the destination.

9. In step 3 we have seen that user had requested for download of a .rpm file, so let us assume it to be the same for the mean time. Let us save the stream content as "something.rpm"

That's it! Your work is done (well, almost). Now do not try executing the file yourself directly as we are not sure about its nature; can be a malware too. Anyways you can try executing in a sandbox environment isolated from network just in case you are curious to know.

Hope this was informative and I didn't waste either of our time.

Will be back soon with a new post.

Until then, keep reading and keep spreading the word.

Regards,
itsmeRiF
The Logical Kid

The Power of Social Media in dealing with day-to-day problems! - The Logical Kid

Hello! A warm welcome to the blog once again. Today I am going to talk neither about Technology nor about Philosophy but something which is relevant though.

My last post was about Social media where I had focused on detecting fake content which was spreading virally over various social (media) platforms.

This post is about my personal experience in dealing with one of many daily problems solved using the social media

tl;dr (long story short) I was conned by two petrol pump employees, and then action was taken on them by the concerned department, thanks to the power of social media.


This starts with the day I happened to re-fuel my bike at a Petrol Station at Barkatpura, Hyderabad. I was always suspicious about this place, but as this station was the first one on my way to office I often used to re-fuel my bike here.

The modus operandi of those people was as follows:
When a person used to ask for re-fuel, the pump operator used to stand in front of the meter apparently to block the meter reading, and the other (cashier) would stand opposite to the operator. As the re-fueling process would start, the cashier would wait for some time and distract the customer asking him to re-fill air in his vehicle and as soon as the person got distracted and set his eyes off the meter, the operator would stop filling and reset the meter and would claim that he had completed filling.

One morning, as usual I went to this petrol station and asked the operator to fill petrol for 100 Rupees. I (with the suspicion in mind) started staring at the meter with full concentration, but somehow the cashier distracted me by shaking my bike and telling me to fill air. After that I turned back to see it was reading '70' on the meter, and I told the operator to fill the remaining 30, and whoosh! The meter was suddenly reset to '0' and the operator told me "It was 100 and not 70" and I (feeling angry, and helpless at same time) was not having any evidence to prove my point as the meter was already reset.

I moved on, and reached office thinking to be careful from next time, but this guilt of a loss of 30 Rupees per 100 Rupees was bothering me and I didn't want this to happen to anybody else too. I had to do something about this.
I had a couple of things in my mind: First, I had not taken any bill so that I could relate it to my transaction. Second, there was no CCTV installed in the premises of that station, atleast not around the pump.

I discussed this with a colleague at Office and he explained me how for every transaction at pump, logs are generated which contain the details of the amount for which petrol was filled in every session, with date and time stamps.

Then came an idea. We have heard a lot about good governance using social media, now it was time to put it to litmus test. I searched for the complaints board on the official site of HP, found their complaints section and posted my complaint there.

I wasn't satisfied because the complaint section was limited to just about 200 characters and I couldn't elaborate everything.
So, I found out the official handle of Hindustan Petroleum on Twitter and tweeted them my complaint to see if I could bring it into their notice as early as possible.

To my surprise, I received a reply within 15 minutes from their twitter handle.

I e-mailed them the details at the above mentioned e-mail ID.

I then sat back and waited to get an update from the concerned department.
After 5 days from the date of reporting I received call from the Deputy Manager (Vigilance) of HP for Hyderabad and she asked me to elaborate the incidence and also informed me that those (two) employees were proven guilty and were fired. The Manager had also apologized for the inconvenience.

Response time: 5 days

Believe in the power of Social Media. Use it for the good. Things take time to get sorted, but give it a try.
That's all folks!
This post was to show how Social Media can be put to use to deal with our real life problems and not only for dealing with candy crush requests.

I rest my case.
If you have any queries, you can simply comment below, or can mail me at itsmerif[at]thelogicalkid.in

See you soon with a new post!

Regards,

itsmeRiF
The Logical Kid