---
description: Network Forensics Lab
---

# PoisonedCredentials Lab

## 1-First of All to detect the Miss-typed Query I added The Ip in filter to and also Saw The Protocol We All our Work is for LLMNR Protocol so here is the query&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fsfy97uXg9ESPcOsfujQv%2FScreenshot%202024-09-07%20101302.png?alt=media&#x26;token=51665dd8-6c5b-4987-8429-c65649b3ca51" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fczt3mXGVBDHhWJMq35n1%2FScreenshot%202024-09-07%20101325.png?alt=media&#x26;token=7a20b10e-dc4e-403a-bf52-97a9288c0400" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FSPkarFLbLiWYqfdJEI9R%2Fimage.png?alt=media&#x26;token=d07bce92-8a0b-44b0-8026-29a4fa1dfabb" alt=""><figcaption></figcaption></figure>

## 2-After the Respond of the Query we Easily seen that the Ip Source Of The Query is Defiantly The Ip of the Attacker &#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fa4b2Er4haW5JALMJRPGc%2FScreenshot%202024-09-07%20114430.png?alt=media&#x26;token=ca9ba7c5-4d34-466b-97aa-79bbbed9f328" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FFImPTG24Be21LA9hVpnc%2Fimage.png?alt=media&#x26;token=adf5ee4e-8330-478a-bd28-00769cc9ced4" alt=""><figcaption></figcaption></figure>

## 3- And As same as the Previous Question The Query respond From the Second rogue Ip&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FRquWKuUDQ68ZOnrtWBIJ%2FScreenshot%202024-09-07%20114755.png?alt=media&#x26;token=af7f5afe-3e13-49fc-8dd4-bf706734f91e" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FVVK2hx6wXWQzRqN94W6Q%2Fimage.png?alt=media&#x26;token=b31f0e0e-b748-4594-8dbc-ba613acf8859" alt=""><figcaption></figcaption></figure>

## 4- To Identify the UserName I use Network Miner and Simply in the Credentials Tab here it\`s

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FaaVEbp4QG0VVXsiwhckv%2FScreenshot%202024-09-07%20120228.png?alt=media&#x26;token=cb3946eb-b0e1-4112-be96-a61f5249016b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FFdxXVH1itagT8itYOrfo%2Fimage.png?alt=media&#x26;token=7549c0cc-0f59-46e3-ade0-e7eca24c330c" alt=""><figcaption></figcaption></figure>

## 5-To Determine the Hostname  I started to look up in the packet For User Cybercactus.local and This hostname i get it from Network miner so when i found it directly follow the tcp stram and here we go&#x20;



<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FHwKmEowt8qK2GXgW6jyU%2FScreenshot%202024-09-07%20121038.png?alt=media&#x26;token=14b64d35-68bc-439e-8454-838b511bf295" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FJsoJVg3rC2Is7jpFFWuU%2FScreenshot%202024-09-07%20120824.png?alt=media&#x26;token=47527993-62da-40a0-bbda-2f6f4b2a444c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fe4EhKg236UUdI2imAI6s%2Fimage.png?alt=media&#x26;token=68ea2344-e12c-4574-a931-9af36247cf7f" alt=""><figcaption></figcaption></figure>

