---
description: Network Forensics lab
---

# WebStrike Blue Team Lab

## 1- Firstly to detect the attacker Let\`s check Conversations tab on Wireshark and after get it i check ipgeolocation website to detect the city&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FKzbmdI69whY1q7ONkFQZ%2FScreenshot%202024-08-17%20132605.png?alt=media&#x26;token=916f4dbd-95c5-44cd-b404-a0df2abc4ca5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FIqglRYufCOd9CyI77Zas%2FScreenshot%202024-08-17%20132617.png?alt=media&#x26;token=293f9e1c-1bfe-4816-aa71-950e66e3c88b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Foy6jfbfeg281tRkwwzI8%2FScreenshot%202024-08-17%20132624.png?alt=media&#x26;token=edbf9531-e191-4b1b-8965-5e11dd3d3b6a" alt=""><figcaption></figcaption></figure>

### 2- As in the Scenario the attacker use a script i add the attacker ip as a filter and search for admin wish is the most common word use in the script and analyze the request to detect the user agent&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FKPRsFqCJ2MWIf4fTAYXw%2FScreenshot%202024-08-17%20133249.png?alt=media&#x26;token=6ae54cd3-f277-4601-b546-46cb8af24d23" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fwl5jj1hNw4qCYzHJCWwY%2FScreenshot%202024-08-17%20133302.png?alt=media&#x26;token=375b5617-3d12-4a47-be60-fda1ea880e14" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FuHtc52UK99l2rk2aBbFd%2FScreenshot%202024-08-17%20133309.png?alt=media&#x26;token=57719a41-c8c2-487a-bd66-b511bad9c42a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fz3tfadqqybWXGz6Rk2ph%2FScreenshot%202024-08-17%20133316.png?alt=media&#x26;token=23abe0f5-6ea1-49a2-8b95-8e282a948c80" alt=""><figcaption></figcaption></figure>



## 3-To detect the script name i Check requests tab and it\` s easy by the way&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F5HUN0beB6q6P2f4qgNNF%2FScreenshot%202024-08-17%20135652.png?alt=media&#x26;token=9c85c6a3-35b3-466d-911e-80005a866ea6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fp5OxV5LDOvnexOmxIV5r%2FScreenshot%202024-08-17%20135713.png?alt=media&#x26;token=58cab7a2-c66b-46b7-a3a1-6c215fea365d" alt=""><figcaption></figcaption></figure>

## 4-To Detect the the directory i used a filter the destination port and the request method GET

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FyvblyyH32LPqdI7aKnTP%2FScreenshot%202024-08-17%20140320.png?alt=media&#x26;token=dae194b2-54e2-46c5-8a70-f5d9021702c2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FV6aTlfJNVnDbeClUfNKR%2FScreenshot%202024-08-17%20140516.png?alt=media&#x26;token=0fb25c6f-69d2-4a09-bf7f-17dfbbabd82e" alt=""><figcaption></figcaption></figure>

## 5-let\`s detect the port and i reverse the filter to make it Source not Destination and this is for know witch port is communicated with this script&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FCqkcgEbczgPLNiaABsYz%2FScreenshot%202024-08-17%20140743.png?alt=media&#x26;token=ea893763-b9e4-404c-ade4-8a1f3dd1d59f" alt=""><figcaption></figcaption></figure>

## 6-To Identify wich file the attacker try exfiltrate i follow the tcp stream and increase the stream sequence till reach the fill wich is Passwd a this is a serious attacker by the way (:

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FbpjTFtYyRit8tRIP9HV6%2FScreenshot%202024-08-17%20141522.png?alt=media&#x26;token=64f641c2-164c-4662-bece-209651a2d5e5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F9Lu6p9acWMAeeGY1gQN5%2FScreenshot%202024-08-17%20140516.png?alt=media&#x26;token=c5bcab55-7edc-43f6-baaf-471c43935a0a" alt=""><figcaption></figcaption></figure>

