Question

the vulnerability in the host device. This week, we will further analyze the network traffic to gain more insights into the attack. To begin, open the PCAP file in Wireshark. As a reminder, the PCAP file can be found in the Week 6 course materials, and it is the same file as the one used in Week 5. This file contains the interactions between the host device and the potential attacker's device. We already know that the IP address of the host device is 192.150.11.111, and we determined last week that the attacker's IP address is 98.114.205.102. Now, let's delve into network forensics and examine the PCAP file in Wireshark. In our previous analysis, we discovered that the capture revealed an exploit called "DsRoleUpgradeDownlevelServer" that took advantage of a vulnerability in the host device. This week, we will continue to investigate the network traffic to gather more information about the attack. Please note that the above text has been corrected for spelling, typographical, grammatical, OCR, and mathematical errors.

          the vulnerability in the host device. This week, we will further analyze the network traffic to gain more insights into the attack.

To begin, open the PCAP file in Wireshark. As a reminder, the PCAP file can be found in the Week 6 course materials, and it is the same file as the one used in Week 5. This file contains the interactions between the host device and the potential attacker's device.

We already know that the IP address of the host device is 192.150.11.111, and we determined last week that the attacker's IP address is 98.114.205.102.

Now, let's delve into network forensics and examine the PCAP file in Wireshark. In our previous analysis, we discovered that the capture revealed an exploit called "DsRoleUpgradeDownlevelServer" that took advantage of a vulnerability in the host device. This week, we will continue to investigate the network traffic to gather more information about the attack.

Please note that the above text has been corrected for spelling, typographical, grammatical, OCR, and mathematical errors.

Show more…

Added by Pedro A.

Computer Science and Information Technology

Trishna Knowledge Systems 2018 Edition

Instant Answer

Solved by Expert Akash M

09/20/2023

Step 1

Step 1: Open the PCAP file in Wireshark. Show more…

Show all steps

lock

Thanks for your feedback!

the vulnerability in the host device. This week, we will further analyze the network traffic to gain more insights into the attack. To begin, open the PCAP file in Wireshark. As a reminder, the PCAP file can be found in the Week 6 course materials, and it is the same file as the one used in Week 5. This file contains the interactions between the host device and the potential attacker's device. We already know that the IP address of the host device is 192.150.11.111, and we determined last week that the attacker's IP address is 98.114.205.102. Now, let's delve into network forensics and examine the PCAP file in Wireshark. In our previous analysis, we discovered that the capture revealed an exploit called "DsRoleUpgradeDownlevelServer" that took advantage of a vulnerability in the host device. This week, we will continue to investigate the network traffic to gather more information about the attack. Please note that the above text has been corrected for spelling, typographical, grammatical, OCR, and mathematical errors.

Play audio

Feedback

Powered by NumerAI

Akash M and 63 other subject AP CS educators are ready to help you.

Ask a new question

Labs

Want to see this concept in action?

NEW

Explore this concept interactively to see how it behaves as you change inputs.

View Labs

Key Concepts

Recommended Videos

Recommended Textbooks

Transcript

00:01 Stabilizing php api files required a specialized work analysis tool like oilstart or cppdump.

00:14 This could provide a better usage in start -up network traffic.

00:19 And the third equation we will use is, so here's an overview of the oilstart equation.

00:25 So we start with page 1, that is, dump, url, and dump1.

00:41 The first thing is to identify the protocol used in dump1 and dump0.

00:53 You can use oilstart or oilstart similar tools to analyze the page, filter the page by protocol and examine the protocol header from one protocol in fields http, tcp, udp, etc.

01:20 Udp, the next endpoint is, read the type of device by examining the third -end, destination ip address and smsc address.

01:49 Each application connectivity can be identified by comparing the source and destination addressing in different frame.

02:00 Third point, identify the internet service provider isp by examining the dns traffic or looking for ip addresses associated with isp.

02:17 To find the router ip address and mac address and brand, search for arp request and respond for packets with destination mac address associated to router.

02:44 The packet payload might contain router information.

02:50 Fifth is, identify computers and their operating system by examining the ttl values, tcp or ip, text behavior, and os specific characteristics in the packet.

03:21 For sixth point, look for windows os packets and analyze their properties with their version.

03:30 You can use the ttl and os fingerprint, dhcp, etc.

03:59 And for seventh point, count the number of http users, etc.

04:27 To identify the frame browser used on 4 .8, investigate frame 1070 .1, look for its packets with their including source and destination ip address, ports, and payload.

04:50 Analyze the data exchanged in that frame.

05:05 Find a frame with pos0 and examine its payload to understand the content and context of the html frame.

05:27 Release the running application by identifying the case associated with the application protocol like http for web browser...

Ace is your personal tutor. It breaks down any question with clear steps so you can learn.

Start Using Ace

Continue solving this problem

Create a free account to:

View full step-by-step solution
Ask follow-up questions with Ace AI
Save progress and study later