Investigate network traffic with Wireshark to identify attacker TTPs, extract XSS payloads and session tokens, and determine exploited web application vulnerabilities.

Category:

Network Forensics

Tactics:

ReconnaissanceInitial AccessExecutionCredential AccessDiscoveryLateral Movement

Tools:

WiresharkNetwork MinerBrim

In recent days, ShopSphere, a prominent online retail platform, has experienced unusual administrative login activity during late-night hours. These logins coincide with an influx of customer complaints about unexplained account anomalies, raising concerns about a potential security breach. Initial observations suggest unauthorized access to administrative accounts, potentially indicating deeper system compromise.

Your mission is to investigate the captured network traffic to determine the nature and source of the breach. Identifying how the attackers infiltrated the system and pinpointing their methods will be critical to understanding the attack's scope and mitigating its impact.

Walkthrough

We will be using Wireshark for this analysis, feel free to use any tool you are comfortable with!

Q.01 In the realm of cybersecurity, identifying the attacker's IP address is pivotal for mapping the attack's scope and strategizing an effective response. What is the IP address associated with the attacker?

As usual when analyzing packet captures, a helpful first step is to gain an overview of the situation. This includes identifying the endpoints involved, the protocols in use, and other relevant details. Since the question specifically asks for the attacker's IP address, starting by analyzing the present endpoints would be a logical approach.

To achieve this, load the RetailBreach.pcap file in Wireshark and open the Endpoints statistics window as follows:

1. Open Wireshark and load the RetailBreach.pcap file by navigating to File ➝ Open and selecting the capture file.
2. Once the capture is loaded, go to the Statistics menu at the top of the Wireshark window.
3. From the Statistics menu, select Endpoints. This will open the Endpoint Statistics window.
4. In the Endpoint Statistics window, you’ll be able to see a list of all the endpoints involved in the capture, including IP addresses, protocols, and other relevant information.