diff --git a/security/wireshark/README.md b/security/wireshark/README.md new file mode 100644 index 00000000..e15712b9 --- /dev/null +++ b/security/wireshark/README.md @@ -0,0 +1,83 @@ +# Workshop - Wireshark Network Analysis + +✔ What is Wireshark + +✔ Analyze network traffic and protocols + +✔ Master packet capture and analysis techniques + +## Introduction in a few lines + +### What is Wireshark? + +**Wireshark** is a **free and open-source network protocol analyzer** that allows you to **capture** and **inspect** network traffic in real-time or from saved capture files. It is one of the most widely used tools for **network troubleshooting**, **security analysis**, and **protocol development**. Wireshark enables you to **see what's happening** on your network at a microscopic level, examining individual packets and their contents. + +### Why it is useful? + +The **primary advantage** of Wireshark lies in its ability to **deeply analyze network communications** and **troubleshoot network issues**. This tool **provides visibility** into network traffic that is otherwise invisible, allowing developers, network administrators, and security professionals to **understand network behavior**, **identify performance problems**, **detect security threats**, and **verify protocol implementations**. Whether you're debugging a web application, investigating a security incident, or learning how network protocols work, Wireshark gives you the **insights needed** to understand what's happening on the wire. + +### What technology is used to do this? + +**Wireshark** uses **packet capture libraries** (such as libpcap on Linux/Unix and WinPcap/Npcap on Windows) to **intercept network traffic** from network interfaces. It then **parses hundreds of protocols** and **displays packet contents** in a human-readable format. The tool supports **deep packet inspection**, **statistical analysis**, and **filtering capabilities** that enable users to **focus on specific traffic patterns** or **protocols of interest**. If you've never used Wireshark before, please refer to the [SETUP.md](./SETUP.md) file to configure it properly and securely. + +## Step 0 - Setup + +Please refer to the [SETUP.md](./SETUP.md) file. + +## Workshop Exercises + +This workshop includes several hands-on exercises to help you master Wireshark: + +- **Exercise 1**: Basic HTTP analysis - Understanding HTTP requests and responses +- **Exercise 2**: HTTP Headers - Analyzing authentication mechanisms +- **Exercise 3**: HTTPS - Understanding encryption and certificates +- **Exercise 4**: GSM protocol analysis +- **Exercise 5**: TCP streams and conversations +- **Exercise 6**: USB traffic analysis +- **Exercise 7**: Forensic analysis - Real-world traffic investigation + +You just completed the Wireshark workshop, well done! During this workshop, you learned what Wireshark is and how to use it to analyze various network protocols and traffic patterns. You can find more resources and documentation on the [official Wireshark website](https://www.wireshark.org/), if you want to continue exploring advanced features and techniques. + +I hope you enjoyed the workshop! + +## To go further + +You have discovered the basics of Wireshark but there are still many other concepts to explore, here are some examples: + +- Advanced filtering techniques and display filters +- Custom protocol dissectors development +- Network performance analysis and statistics +- Wireless network analysis (Wi-Fi, Bluetooth) +- VoIP analysis (SIP, RTP) +- Malware traffic analysis and threat hunting + +## Authors + +| [
Timothée Pasteau-Berthaud](https://github.com/t1m0t-p) | +| :-----------------------------------------------------------------------------------------------------------------: | +

+Organization +

+
+

+ + LinkedIn logo + + + Instagram logo + + + Twitter logo + + + Discord logo + +

+

+ + Website logo + +

+ +> 🚀 Don't hesitate to follow us on our different networks, and put a star 🌟 on `PoC's` repositories. \ No newline at end of file diff --git a/security/wireshark/exo0-setup/setup.md b/security/wireshark/exo0-setup/setup.md new file mode 100644 index 00000000..243893bb --- /dev/null +++ b/security/wireshark/exo0-setup/setup.md @@ -0,0 +1,199 @@ +# Workshop Wireshark - Setup + +> ⚠️ **Warning : The risks of misconfiguring Wireshark** +> +> A misconfigured installation doesn’t only lead to technical problems. Wireshark is a powerful tool that, if improperly set up, can : +> +> 1. **Exposing your system** : giving overly broad permissions (for example permanent `root` access) makes your computer more vulnerable to exploits or malware. +> * 🔗 [Official Wireshark security guide](https://wiki.wireshark.org/Security) +> * 🔗 [Wireshark Security Advisories](https://www.wireshark.org/security/) +> +> 2. **Creating security holes** : an improperly protected dumpcap binary can be exploited to gain network or administrator privileges. +> * 🔗 [CVE-2023-1991](https://nvd.nist.gov/vuln/detail/CVE-2023-1991) +> * 🔗 [CVE Details – List of vulnerabilities](https://www.cvedetails.com/product/8292/Wireshark-Wireshark.html?vendor_id=4861) +> +> 3. **Inadvertently capturing sensitive data** (passwords, cookies, authentication tokens) and store this data unencrypted. +> * 🔗 [Discussion on Wireshark capture risks (Reddit)](https://www.reddit.com/r/AskNetsec/comments/xwhec1/wireshark_security_risks_when_installed_on_a/) +> +> 4. **Breaking legal rules** : sniffing traffic on a third-party network without authorization is illegal and may result in prosecution. +> * 🔗 [CNIL – Surveillance and cybersecurity](https://www.cnil.fr/fr/les-travaux-de-surveillance-des-reseaux-informatiques) | [GDPR and data collection](https://gdpr-info.eu/art-32-gdpr/) + +> This guide aims to secure the installation so that Wireshark can be used **without exposing your system** and **within a legal framework**. + + +## 🧭 Summary + +1. [Introduction](#introduction) +2. [Prerequisites & Best Practices](#prerequisites--best-practices) +3. [Step 1: Check the installation](#step-1--check-the-installation) +4. [Step 2 : Configure the permissions](#step-2--configure-the-permissions) +5. [Step 3 : Lancer Wireshark](#step-3--launch-wireshark) +6. [Step 4 : First capture](#step-4--first-capture) +7. [Security summary](#security-summary) + + +## Introduction + +To use Wireshark safely, you must : + +* **Limit privileges** to only what’s strictly necessary.. +* **Configure `dumpcap` properly** so you can capture packets without running Wireshark as `root`. +* **Know what you’re capturing** : avoid saving sensitive data unless it’s absolutely needed. + + +## Prerequisites & Best Practices + +* Work with a **standard account**, not root. +* Capture only **your own network** or an authorized lab. +* Read **the documentation** (always a good idea 😉) +* **Filter before you capture** — otherwise you’ll end up with a .pcap bigger than the entire GitHub codebase. + + +## Step 1 : Check the installation + +```bash +wireshark -v +``` + +If not installed : + +```bash +# Debian/Ubuntu +sudo apt update && sudo apt install wireshark + +# Fedora +sudo dnf install wireshark wireshark-cli + +# Arch/Manjaro +sudo pacman -Syu wireshark-qt wireshark-cli + +# Mac OS +brew install --cask wireshark +``` + + +## Step 2 : Configure the permissions + +### Linux + +2.1 - Configuring user groups + +```bash +# Add your user to the ‘wireshark’ group to capture packets without using root. +sudo usermod -aG wireshark "$USER" + +# Applique immédiatement le changement de groupe sans redémarrer ta session +newgrp wireshark +``` +2.2 - Assigning minimum network capabilities to dumpcap + +`dumpcap` is the **network capture program** used by Wireshark : +* It **listens on network interfaces** and saves packets to .pcap files. +* Wireshark only **analyzes and displays** these packets — dumpcap handles the actual capture. +* You give it **only the network permissions it needs**, instead of running Wireshark as root, to **reduce the risk of privilege escalation**. + +```bash +# Gives ‘dumpcap’ (Wireshark capture binary) the minimum network capabilities +sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/dumpcap +``` +* **cap_net_raw** : allows raw access to network packets +* **cap_net_admin** : allows certain advanced network actions (sniffing, interface configuration) +* **+eip** : applies these capabilities at execution time + +2.3 - Verifying capabilities + +```bash +getcap /usr/bin/dumpcap +``` + +Expected : +``` +/usr/bin/dumpcap cap_net_admin,cap_net_raw=eip +``` + +### MacOS + +2.1 - Check for the helper / `access_bpf` group + +```bash +# Check if the access_bpf group exists (shows its members if present) +dscacheutil -q group -a name access_bpf + +# More verbose alternative +dscl . -read /Groups/access_bpf +``` + +2.2 - Add your user to the `access_bpf` group + +`dumpcap` is the **network capture program** used by Wireshark : +* It **listens on network interfaces** and saves packets to .pcap files. +* Wireshark only **analyzes and displays** these packets — dumpcap handles the actual capture. +* You give it **only the network permissions it needs**, instead of running Wireshark as root, to **reduce the risk of privilege escalation**. + +```bash +# Add the current user to the access_bpf group +sudo dseditgroup -o edit -a $(whoami) -t user access_bpf +``` + +2.3 - Verifying capabilities + +```bash +groups $(whoami) +``` + +Expected : +``` +staff everyone access_bpf +``` + +### Conclusion + +✅ With this setup, Wireshark can capture packets **without running as root**. + +⚠️ NEVER : +* Launch Wireshark with `sudo wireshark` (high risk of privilege escalation through the GUI). +🔗 [Explanation on Wireshark privileges](https://wiki.wireshark.org/CaptureSetup/CapturePrivileges?utm_source=chatgpt.com) + + +## Step 3 : Launch Wireshark + +```bash +wireshark & +``` + +Check that : + +* The application starts **without asking for your root password**. +* Network interfaces appear and show activity. + + +## Step 4 : First capture + +* Choose your network interface (Wi-Fi or Ethernet). +* Start the capture. +* Generate some traffic: + +```bash +ping -c 4 1.1.1.1 +``` + +Apply an ICMP filter in Wireshark + +_You should see 4 ICMP requests (Echo Request) and 4 responses (Echo Reply)_ + +## Security Summary + +* **Ne pas utiliser root** : Wireshark est une application graphique, donc potentiellement vulnérable. `dumpcap` est conçu pour limiter le risque. +* **Limiter les captures** : Utilise des filtres pour réduire la surface d’exposition. +* **Respect de la loi** : Capture uniquement sur les réseaux dont tu as l’autorisation. +* **Séparer les environnements** : Pour analyser des fichiers suspects, utilise une VM ou une machine de lab. + + +Avec cette configuration, ton setup est **sécurisé, fonctionnel et prêt pour les challenges du workshop**. + +* **Do not use root** : Wireshark is a GUI application and could be exploited. dumpcap is designed to limit this risk. +* **Limit captures** : use filters to reduce exposure. +* **Follow the law** : capture only on networks you are authorized to monitor. +* **Separate environments** : analyze suspicious files in a VM or lab machine. + +With this configuration, your setup is **secure, functional, and ready for workshop challenges**. \ No newline at end of file diff --git a/security/wireshark/exo01-basic_http/README.md b/security/wireshark/exo01-basic_http/README.md deleted file mode 100644 index 2118abf6..00000000 --- a/security/wireshark/exo01-basic_http/README.md +++ /dev/null @@ -1 +0,0 @@ -What was the user trying to do ? What did he get in response ? diff --git a/security/wireshark/exo02-header_http/README.md b/security/wireshark/exo02-header_http/README.md deleted file mode 100644 index a44e8d8b..00000000 --- a/security/wireshark/exo02-header_http/README.md +++ /dev/null @@ -1 +0,0 @@ -Find the username and the password of the user who made those requests ! diff --git a/security/wireshark/exo03-https/README.md b/security/wireshark/exo03-https/README.md deleted file mode 100644 index 2c038c15..00000000 --- a/security/wireshark/exo03-https/README.md +++ /dev/null @@ -1,4 +0,0 @@ -### There is no flag to find in this challenge ! - -The purpose here is to understand why the content is unreadable. -Your explaination should contain the notion of HTTPS and certificate. diff --git a/security/wireshark/exo04-gsm/README.md b/security/wireshark/exo04-gsm/README.md deleted file mode 100644 index ef422388..00000000 --- a/security/wireshark/exo04-gsm/README.md +++ /dev/null @@ -1,3 +0,0 @@ -Analyze a capture of gsm traffic. You have to find something understandable, even if at first sight some pieces of information appear to be missing... - -Source: root-me.org diff --git a/security/wireshark/exo04-gsm/gsm.pcap b/security/wireshark/exo04-gsm/gsm.pcap deleted file mode 100644 index e1ed1713..00000000 Binary files a/security/wireshark/exo04-gsm/gsm.pcap and /dev/null differ diff --git a/security/wireshark/exo05-tcp/README.md b/security/wireshark/exo05-tcp/README.md deleted file mode 100644 index 9d74582e..00000000 --- a/security/wireshark/exo05-tcp/README.md +++ /dev/null @@ -1,2 +0,0 @@ -Well, -Just find the flag :) diff --git a/security/wireshark/exo06-usb/README.md b/security/wireshark/exo06-usb/README.md deleted file mode 100644 index fb3afe2b..00000000 --- a/security/wireshark/exo06-usb/README.md +++ /dev/null @@ -1 +0,0 @@ -We've intercepted some USB communication from the mouse and keyboard of an employee. Find out what he wrote ! diff --git a/security/wireshark/exo07-forensic/README.md b/security/wireshark/exo07-forensic/README.md deleted file mode 100644 index 865a5ea1..00000000 --- a/security/wireshark/exo07-forensic/README.md +++ /dev/null @@ -1,10 +0,0 @@ -Based on the pcap, figure out what other blunder Edward has made. Do a quick incident report that includes the following info: - -* Date and start time of the malicious activity in UTC (GMT). -* IP address of the affected Windows host. -* Mac address of the affected Windows host. -* Host name of the affected Windows host. -* User account name on the affected Windows host. -* A short summary of what happened. - -# HF diff --git a/security/wireshark/exo07-forensic/conv.png b/security/wireshark/exo07-forensic/conv.png deleted file mode 100644 index c98e9d33..00000000 Binary files a/security/wireshark/exo07-forensic/conv.png and /dev/null differ diff --git a/security/wireshark/exo1-basic_http/basic.md b/security/wireshark/exo1-basic_http/basic.md new file mode 100644 index 00000000..5fd8667a --- /dev/null +++ b/security/wireshark/exo1-basic_http/basic.md @@ -0,0 +1,14 @@ +# 🕵️ Challenge 1 — Basic HTTP + +## 📖 Contexte + +You captured a simple HTTP exchange. + +## 🎯 Goal + +Find out what the user is trying to do and what they received in response. + + +## 📂 File provided + +* `introduction.pcapng` diff --git a/security/wireshark/exo01-basic_http/introduction.pcapng b/security/wireshark/exo1-basic_http/introduction_basic.pcapng similarity index 100% rename from security/wireshark/exo01-basic_http/introduction.pcapng rename to security/wireshark/exo1-basic_http/introduction_basic.pcapng diff --git a/security/wireshark/exo2-header_http/header.md b/security/wireshark/exo2-header_http/header.md new file mode 100644 index 00000000..7fe6c8e9 --- /dev/null +++ b/security/wireshark/exo2-header_http/header.md @@ -0,0 +1,21 @@ +# 🕵️ Challenge 2 — HTTP Headers + +## 📖 Context + +This time, the server requests HTTP Basic authentication. + +Reminder: **Basic authentication is not secure**. +Credentials are not encrypted, only encoded in Base64. + +## 🎯 Goal + +Find the username and password of the user who made these requests! + +Answer expected: +``` +titi:toto +``` + +## 📂 File provided + +* `introduction_headers.pcapng` diff --git a/security/wireshark/exo02-header_http/introduction_headers.pcapng b/security/wireshark/exo2-header_http/introduction_headers.pcapng similarity index 100% rename from security/wireshark/exo02-header_http/introduction_headers.pcapng rename to security/wireshark/exo2-header_http/introduction_headers.pcapng diff --git a/security/wireshark/exo3-https/https.md b/security/wireshark/exo3-https/https.md new file mode 100644 index 00000000..4e65d7ec --- /dev/null +++ b/security/wireshark/exo3-https/https.md @@ -0,0 +1,17 @@ +# 🕵️ Challenge 3 — HTTPS + +## 📖 Context + +This time, the credentials are not sent in the headers but in the **body of the POST request**. The application sends a JSON containing the credentials. + + +## 🎯 Goal + +**There is no flag to find in this challenge !** + +The purpose here is to understand why the content is unreadable. +> HTTP and certificates notions should be helpful ;) + +## 📂 File provided + +* `introduction_https.pcapng` diff --git a/security/wireshark/exo03-https/introduction_https.pcapng b/security/wireshark/exo3-https/introduction_https.pcapng similarity index 100% rename from security/wireshark/exo03-https/introduction_https.pcapng rename to security/wireshark/exo3-https/introduction_https.pcapng diff --git a/security/wireshark/exo4-gsm/gsm.md b/security/wireshark/exo4-gsm/gsm.md new file mode 100644 index 00000000..fc99b5e2 --- /dev/null +++ b/security/wireshark/exo4-gsm/gsm.md @@ -0,0 +1,20 @@ +# 🕵️ Challenge 4 — GSM + +## 📖 Context + +An SMS was transmitted in encapsulated GSM traffic. + +## 🎯 Goal + +What is the message hidden, the number sending it and the recipient ? + +_You should probably what GSMTAP et TP-UD are ;)_ + +**Answer Expected** : +>FROM : +33XXXXXXXXX +>TO : +33XXXXXXXXX +>MESSAGE : It's cool ! + +## 📂 File provided + +* `gsm.pcap` diff --git a/security/wireshark/exo4-gsm/gsm.pcap b/security/wireshark/exo4-gsm/gsm.pcap new file mode 100644 index 00000000..b74612e1 Binary files /dev/null and b/security/wireshark/exo4-gsm/gsm.pcap differ diff --git a/security/wireshark/exo05-tcp/foren_trade.pcap b/security/wireshark/exo5-tcp/foren_trade.pcap similarity index 100% rename from security/wireshark/exo05-tcp/foren_trade.pcap rename to security/wireshark/exo5-tcp/foren_trade.pcap diff --git a/security/wireshark/exo5-tcp/tcp.md b/security/wireshark/exo5-tcp/tcp.md new file mode 100644 index 00000000..8e0a2456 --- /dev/null +++ b/security/wireshark/exo5-tcp/tcp.md @@ -0,0 +1,16 @@ +# 🕵️ Challenge 5 — TCP + +## 🎯 Goal + +Well, Just find the flag :) + +_Check out the Conversations / TCP Streams_ + +Answer expected : +``` +securinets{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx} +``` + +## 📂 File provided + +* `foren.pcap` diff --git a/security/wireshark/exo06-usb/keyboard.pcap b/security/wireshark/exo6-usb/keyboard.pcap similarity index 100% rename from security/wireshark/exo06-usb/keyboard.pcap rename to security/wireshark/exo6-usb/keyboard.pcap diff --git a/security/wireshark/exo6-usb/usb.md b/security/wireshark/exo6-usb/usb.md new file mode 100644 index 00000000..7d0cdd38 --- /dev/null +++ b/security/wireshark/exo6-usb/usb.md @@ -0,0 +1,25 @@ +# 🕵️ Challenge 6 — USB + +## 📖 Context + +We've intercepted some USB communication from the mouse and keyboard (azerty) of an employee. + +--- + +## 🎯 Goal + +Find out what he wrote ! + +_There are some very interesting tools for decoding USB traffic, it would be worth taking a look :)_ + +**Answer expected** : +``` +hey_le_rock +``` + + +## 📂 File provided + +* `keyboard.pcap` + +--- \ No newline at end of file diff --git a/security/wireshark/exo7-forensic/forensic.md b/security/wireshark/exo7-forensic/forensic.md new file mode 100644 index 00000000..2054d037 --- /dev/null +++ b/security/wireshark/exo7-forensic/forensic.md @@ -0,0 +1,22 @@ +# 🕵️ Challenge 7 — Forensic + +## 🎯 Goal + +Based on the pcap, figure out what other blunder Edward has made. Do a quick incident report that includes the following info: + +* **Date and start time** of the malicious activity in UTC (GMT). +* **IP address** of the affected Windows host. +* **Mac address** of the affected Windows host. +* **Host name** of the affected Windows host. +* **User account name** on the affected Windows host. +* A short **summary of what happened**. + +Here's an interesting link about the **malicious activity** : [Gozi-ISFB](https://isc.sans.edu/diary/23245) + +Answer expected : +> * **IP Address** : `10.100.14.xxx` +> * **MAC Address** : `aa:bb:cc:dd:ee:ff` +> * **Hostname** : `Example-Host-PC` +> * **User Account Name** : `User Account Name` +> * **Date and Start Time** : `2018-01-16 22:32:42 UTC (GMT)` +> * **Summary of What Happened** : Well, just what happened in details \ No newline at end of file diff --git a/security/wireshark/exo07-forensic/traffic-analysis.pcap b/security/wireshark/exo7-forensic/traffic-analysis.pcap similarity index 100% rename from security/wireshark/exo07-forensic/traffic-analysis.pcap rename to security/wireshark/exo7-forensic/traffic-analysis.pcap diff --git a/security/wireshark/info-encryption.md b/security/wireshark/info-encryption.md deleted file mode 100644 index db87da6c..00000000 --- a/security/wireshark/info-encryption.md +++ /dev/null @@ -1,28 +0,0 @@ -Different type of encryptions and encodings - -sha1 -154e419298935c6d807abdc907a198cdfce28702 - -sha256 -1439490fa4821a2fcabbcded71f600b50636e967e9c491f36f9ee818a824c81e - -sha512 -f65e3b64fac759663f44ce6747dbc7e5448e6dde80d3432d49099ec6a7a8eec603af3e018cd9852647939ee7de20de918860cc532c4d4f7421e81bde1cdfbcd4 - -shake256 -6c56540bc8b647851b9c48654d013bfdf3497f10428f0e9f2a908ea32e7ad41943eb5550933e006c296119e8edefaa5792f986b565d8e660a502f5000a0e80f6 - -md5 -b4152b493aaf99db25a673b92ab155f6 - -CRC-32 -dd24be09 - -base32 -OR2SA5DPOVZG4ZLTBI====== - -base64 -dHUgdG91cm5lcwo= - -base91 -g8=Cj>;Nn$a.B diff --git a/security/wireshark/setup.md b/security/wireshark/setup.md new file mode 100644 index 00000000..243893bb --- /dev/null +++ b/security/wireshark/setup.md @@ -0,0 +1,199 @@ +# Workshop Wireshark - Setup + +> ⚠️ **Warning : The risks of misconfiguring Wireshark** +> +> A misconfigured installation doesn’t only lead to technical problems. Wireshark is a powerful tool that, if improperly set up, can : +> +> 1. **Exposing your system** : giving overly broad permissions (for example permanent `root` access) makes your computer more vulnerable to exploits or malware. +> * 🔗 [Official Wireshark security guide](https://wiki.wireshark.org/Security) +> * 🔗 [Wireshark Security Advisories](https://www.wireshark.org/security/) +> +> 2. **Creating security holes** : an improperly protected dumpcap binary can be exploited to gain network or administrator privileges. +> * 🔗 [CVE-2023-1991](https://nvd.nist.gov/vuln/detail/CVE-2023-1991) +> * 🔗 [CVE Details – List of vulnerabilities](https://www.cvedetails.com/product/8292/Wireshark-Wireshark.html?vendor_id=4861) +> +> 3. **Inadvertently capturing sensitive data** (passwords, cookies, authentication tokens) and store this data unencrypted. +> * 🔗 [Discussion on Wireshark capture risks (Reddit)](https://www.reddit.com/r/AskNetsec/comments/xwhec1/wireshark_security_risks_when_installed_on_a/) +> +> 4. **Breaking legal rules** : sniffing traffic on a third-party network without authorization is illegal and may result in prosecution. +> * 🔗 [CNIL – Surveillance and cybersecurity](https://www.cnil.fr/fr/les-travaux-de-surveillance-des-reseaux-informatiques) | [GDPR and data collection](https://gdpr-info.eu/art-32-gdpr/) + +> This guide aims to secure the installation so that Wireshark can be used **without exposing your system** and **within a legal framework**. + + +## 🧭 Summary + +1. [Introduction](#introduction) +2. [Prerequisites & Best Practices](#prerequisites--best-practices) +3. [Step 1: Check the installation](#step-1--check-the-installation) +4. [Step 2 : Configure the permissions](#step-2--configure-the-permissions) +5. [Step 3 : Lancer Wireshark](#step-3--launch-wireshark) +6. [Step 4 : First capture](#step-4--first-capture) +7. [Security summary](#security-summary) + + +## Introduction + +To use Wireshark safely, you must : + +* **Limit privileges** to only what’s strictly necessary.. +* **Configure `dumpcap` properly** so you can capture packets without running Wireshark as `root`. +* **Know what you’re capturing** : avoid saving sensitive data unless it’s absolutely needed. + + +## Prerequisites & Best Practices + +* Work with a **standard account**, not root. +* Capture only **your own network** or an authorized lab. +* Read **the documentation** (always a good idea 😉) +* **Filter before you capture** — otherwise you’ll end up with a .pcap bigger than the entire GitHub codebase. + + +## Step 1 : Check the installation + +```bash +wireshark -v +``` + +If not installed : + +```bash +# Debian/Ubuntu +sudo apt update && sudo apt install wireshark + +# Fedora +sudo dnf install wireshark wireshark-cli + +# Arch/Manjaro +sudo pacman -Syu wireshark-qt wireshark-cli + +# Mac OS +brew install --cask wireshark +``` + + +## Step 2 : Configure the permissions + +### Linux + +2.1 - Configuring user groups + +```bash +# Add your user to the ‘wireshark’ group to capture packets without using root. +sudo usermod -aG wireshark "$USER" + +# Applique immédiatement le changement de groupe sans redémarrer ta session +newgrp wireshark +``` +2.2 - Assigning minimum network capabilities to dumpcap + +`dumpcap` is the **network capture program** used by Wireshark : +* It **listens on network interfaces** and saves packets to .pcap files. +* Wireshark only **analyzes and displays** these packets — dumpcap handles the actual capture. +* You give it **only the network permissions it needs**, instead of running Wireshark as root, to **reduce the risk of privilege escalation**. + +```bash +# Gives ‘dumpcap’ (Wireshark capture binary) the minimum network capabilities +sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/dumpcap +``` +* **cap_net_raw** : allows raw access to network packets +* **cap_net_admin** : allows certain advanced network actions (sniffing, interface configuration) +* **+eip** : applies these capabilities at execution time + +2.3 - Verifying capabilities + +```bash +getcap /usr/bin/dumpcap +``` + +Expected : +``` +/usr/bin/dumpcap cap_net_admin,cap_net_raw=eip +``` + +### MacOS + +2.1 - Check for the helper / `access_bpf` group + +```bash +# Check if the access_bpf group exists (shows its members if present) +dscacheutil -q group -a name access_bpf + +# More verbose alternative +dscl . -read /Groups/access_bpf +``` + +2.2 - Add your user to the `access_bpf` group + +`dumpcap` is the **network capture program** used by Wireshark : +* It **listens on network interfaces** and saves packets to .pcap files. +* Wireshark only **analyzes and displays** these packets — dumpcap handles the actual capture. +* You give it **only the network permissions it needs**, instead of running Wireshark as root, to **reduce the risk of privilege escalation**. + +```bash +# Add the current user to the access_bpf group +sudo dseditgroup -o edit -a $(whoami) -t user access_bpf +``` + +2.3 - Verifying capabilities + +```bash +groups $(whoami) +``` + +Expected : +``` +staff everyone access_bpf +``` + +### Conclusion + +✅ With this setup, Wireshark can capture packets **without running as root**. + +⚠️ NEVER : +* Launch Wireshark with `sudo wireshark` (high risk of privilege escalation through the GUI). +🔗 [Explanation on Wireshark privileges](https://wiki.wireshark.org/CaptureSetup/CapturePrivileges?utm_source=chatgpt.com) + + +## Step 3 : Launch Wireshark + +```bash +wireshark & +``` + +Check that : + +* The application starts **without asking for your root password**. +* Network interfaces appear and show activity. + + +## Step 4 : First capture + +* Choose your network interface (Wi-Fi or Ethernet). +* Start the capture. +* Generate some traffic: + +```bash +ping -c 4 1.1.1.1 +``` + +Apply an ICMP filter in Wireshark + +_You should see 4 ICMP requests (Echo Request) and 4 responses (Echo Reply)_ + +## Security Summary + +* **Ne pas utiliser root** : Wireshark est une application graphique, donc potentiellement vulnérable. `dumpcap` est conçu pour limiter le risque. +* **Limiter les captures** : Utilise des filtres pour réduire la surface d’exposition. +* **Respect de la loi** : Capture uniquement sur les réseaux dont tu as l’autorisation. +* **Séparer les environnements** : Pour analyser des fichiers suspects, utilise une VM ou une machine de lab. + + +Avec cette configuration, ton setup est **sécurisé, fonctionnel et prêt pour les challenges du workshop**. + +* **Do not use root** : Wireshark is a GUI application and could be exploited. dumpcap is designed to limit this risk. +* **Limit captures** : use filters to reduce exposure. +* **Follow the law** : capture only on networks you are authorized to monitor. +* **Separate environments** : analyze suspicious files in a VM or lab machine. + +With this configuration, your setup is **secure, functional, and ready for workshop challenges**. \ No newline at end of file