retour aux outils back to tools Ducklings

Wireshark

Analyseur de protocoles réseau de référence. Indispensable pour la capture de paquets, l'inspection du trafic et le sniffing de credentials. Industry-standard network protocol analyzer. Essential for packet capture, traffic inspection, and credential sniffing.

↗ https://www.wireshark.org

Overview

Wireshark captures and dissects network traffic at the packet level. In pentesting it’s used to capture cleartext credentials, analyse protocols, inspect captured traffic from other tools, and troubleshoot.

Useful Display Filters

# Filter by protocol
http
dns
smb
ftp
telnet

# Credentials in cleartext
http.authbasic
ftp.request.command == "PASS"

# HTTP POST requests (potential login forms)
http.request.method == "POST"

# DNS queries
dns.qry.name contains "target.com"

# Follow a TCP stream — right-click → Follow → TCP Stream

# Filter by IP
ip.addr == 10.10.10.1
ip.src == 10.10.10.1
ip.dst == 10.10.10.1

# Exclude noise
not (arp or dns or icmp)

Command Line (tshark)

Capture on interface

tshark -i eth0 -w capture.pcap

Read and filter a pcap

tshark -r capture.pcap -Y "http.request.method == POST"

Extract credentials from HTTP Basic Auth

tshark -r capture.pcap -Y "http.authbasic" -T fields -e http.authbasic

Show only FTP passwords

tshark -r capture.pcap -Y "ftp.request.command == PASS" -T fields -e ftp.request.arg

Help / Man page

tshark [options] ...

CAPTURE:
  -i <interface>    Capture interface
  -f <filter>       Capture filter (BPF syntax)
  -w <file>         Write packets to file
  -c <count>        Stop after N packets
  -a duration:<N>   Stop after N seconds

READING:
  -r <file>         Read from capture file
  -Y <filter>       Display filter (Wireshark syntax)
  -R <filter>       Read filter

OUTPUT:
  -T fields         Output specific fields
  -e <field>        Field to output (with -T fields)
  -T json           JSON output
  -T pdml           XML output

USEFUL FIELDS:
  ip.src / ip.dst   Source/dest IP
  tcp.port          TCP port
  http.host         HTTP Host header
  http.request.uri  HTTP URI
  http.authbasic    Basic auth credentials
  dns.qry.name      DNS query name
  ftp.request.arg   FTP command argument

COMMON CAPTURE FILTERS (BPF):
  port 80           Traffic on port 80
  host 10.10.10.1   Traffic to/from host
  not port 22       Exclude SSH

Vue d’ensemble

Wireshark capture et dissèque le trafic réseau au niveau des paquets. En pentest, il sert à capturer des credentials en clair, analyser des protocoles, inspecter le trafic capturé par d’autres outils, et résoudre des problèmes.

Filtres d’affichage utiles

# Filtrer par protocole
http
dns
smb
ftp
telnet

# Credentials en clair
http.authbasic
ftp.request.command == "PASS"

# Requêtes HTTP POST (formulaires de connexion potentiels)
http.request.method == "POST"

# Requêtes DNS
dns.qry.name contains "target.com"

# Suivre un flux TCP : clic droit → Follow → TCP Stream

# Filtrer par IP
ip.addr == 10.10.10.1
ip.src == 10.10.10.1
ip.dst == 10.10.10.1

# Exclure le bruit
not (arp or dns or icmp)

Ligne de commande (tshark)

# Capturer sur une interface
tshark -i eth0 -w capture.pcap

# Lire et filtrer un pcap
tshark -r capture.pcap -Y "http.request.method == POST"

# Extraire les credentials depuis HTTP Basic Auth
tshark -r capture.pcap -Y "http.authbasic" -T fields -e http.authbasic

# Afficher uniquement les mots de passe FTP
tshark -r capture.pcap -Y "ftp.request.command == PASS" -T fields -e ftp.request.arg

Aide / Page de manuel

tshark [options] ...

CAPTURE:
  -i <interface>    Capture interface
  -f <filter>       Capture filter (BPF syntax)
  -w <file>         Write packets to file
  -c <count>        Stop after N packets
  -a duration:<N>   Stop after N seconds

READING:
  -r <file>         Read from capture file
  -Y <filter>       Display filter (Wireshark syntax)
  -R <filter>       Read filter

OUTPUT:
  -T fields         Output specific fields
  -e <field>        Field to output (with -T fields)
  -T json           JSON output
  -T pdml           XML output

USEFUL FIELDS:
  ip.src / ip.dst   Source/dest IP
  tcp.port          TCP port
  http.host         HTTP Host header
  http.request.uri  HTTP URI
  http.authbasic    Basic auth credentials
  dns.qry.name      DNS query name
  ftp.request.arg   FTP command argument

COMMON CAPTURE FILTERS (BPF):
  port 80           Traffic on port 80
  host 10.10.10.1   Traffic to/from host
  not port 22       Exclude SSH