← retour aux outils back to tools

# Wireshark

Analyseur de protocoles réseau de référence. Indispensable pour la capture de paquets, l'inspection du trafic et le sniffing de credentials. Industry-standard network protocol analyzer. Essential for packet capture, traffic inspection, and credential sniffing.

↗ https://www.wireshark.org

## Overview

Wireshark captures and dissects network traffic at the packet level. In pentesting it’s used to capture cleartext credentials, analyse protocols, inspect captured traffic from other tools, and troubleshoot.

## Useful Display Filters

    # Filter by protocol
    http
    dns
    smb
    ftp
    telnet

    # Credentials in cleartext
    http.authbasic
    ftp.request.command == "PASS"

    # HTTP POST requests (potential login forms)
    http.request.method == "POST"

    # DNS queries
    dns.qry.name contains "target.com"

    # Follow a TCP stream — right-click → Follow → TCP Stream

    # Filter by IP
    ip.addr == 10.10.10.1
    ip.src == 10.10.10.1
    ip.dst == 10.10.10.1

    # Exclude noise
    not (arp or dns or icmp)

## Command Line (tshark)

Capture on interface

    tshark -i eth0 -w capture.pcap

Read and filter a pcap

    tshark -r capture.pcap -Y "http.request.method == POST"

Extract credentials from HTTP Basic Auth

    tshark -r capture.pcap -Y "http.authbasic" -T fields -e http.authbasic

Show only FTP passwords

    tshark -r capture.pcap -Y "ftp.request.command == PASS" -T fields -e ftp.request.arg

Help / Man page

    tshark [options] ...

    CAPTURE:
      -i <interface>    Capture interface
      -f <filter>       Capture filter (BPF syntax)
      -w <file>         Write packets to file
      -c <count>        Stop after N packets
      -a duration:<N>   Stop after N seconds

    READING:
      -r <file>         Read from capture file
      -Y <filter>       Display filter (Wireshark syntax)
      -R <filter>       Read filter

    OUTPUT:
      -T fields         Output specific fields
      -e <field>        Field to output (with -T fields)
      -T json           JSON output
      -T pdml           XML output

    USEFUL FIELDS:
      ip.src / ip.dst   Source/dest IP
      tcp.port          TCP port
      http.host         HTTP Host header
      http.request.uri  HTTP URI
      http.authbasic    Basic auth credentials
      dns.qry.name      DNS query name
      ftp.request.arg   FTP command argument

    COMMON CAPTURE FILTERS (BPF):
      port 80           Traffic on port 80
      host 10.10.10.1   Traffic to/from host
      not port 22       Exclude SSH

## Vue d’ensemble

Wireshark capture et dissèque le trafic réseau au niveau des paquets. En pentest, il sert à capturer des credentials en clair, analyser des protocoles, inspecter le trafic capturé par d’autres outils, et résoudre des problèmes.

## Filtres d’affichage utiles

    # Filtrer par protocole
    http
    dns
    smb
    ftp
    telnet

    # Credentials en clair
    http.authbasic
    ftp.request.command == "PASS"

    # Requêtes HTTP POST (formulaires de connexion potentiels)
    http.request.method == "POST"

    # Requêtes DNS
    dns.qry.name contains "target.com"

    # Suivre un flux TCP : clic droit → Follow → TCP Stream

    # Filtrer par IP
    ip.addr == 10.10.10.1
    ip.src == 10.10.10.1
    ip.dst == 10.10.10.1

    # Exclure le bruit
    not (arp or dns or icmp)

## Ligne de commande (tshark)

    # Capturer sur une interface
    tshark -i eth0 -w capture.pcap

    # Lire et filtrer un pcap
    tshark -r capture.pcap -Y "http.request.method == POST"

    # Extraire les credentials depuis HTTP Basic Auth
    tshark -r capture.pcap -Y "http.authbasic" -T fields -e http.authbasic

    # Afficher uniquement les mots de passe FTP
    tshark -r capture.pcap -Y "ftp.request.command == PASS" -T fields -e ftp.request.arg

Aide / Page de manuel

    tshark [options] ...

    CAPTURE:
      -i <interface>    Capture interface
      -f <filter>       Capture filter (BPF syntax)
      -w <file>         Write packets to file
      -c <count>        Stop after N packets
      -a duration:<N>   Stop after N seconds

    READING:
      -r <file>         Read from capture file
      -Y <filter>       Display filter (Wireshark syntax)
      -R <filter>       Read filter

    OUTPUT:
      -T fields         Output specific fields
      -e <field>        Field to output (with -T fields)
      -T json           JSON output
      -T pdml           XML output

    USEFUL FIELDS:
      ip.src / ip.dst   Source/dest IP
      tcp.port          TCP port
      http.host         HTTP Host header
      http.request.uri  HTTP URI
      http.authbasic    Basic auth credentials
      dns.qry.name      DNS query name
      ftp.request.arg   FTP command argument

    COMMON CAPTURE FILTERS (BPF):
      port 80           Traffic on port 80
      host 10.10.10.1   Traffic to/from host
      not port 22       Exclude SSH