hello again everyone welcome back to another session of walkthrough for cyber security for pltw this is MrI again here and we are dealing with activity 3. 2. 4 analyzing and defending Network attacks now this is the third of three major parts in unit 3.
2 they all use the same Virtual Lab so for those of you that are actually watching this it would be strongly recommended again as always should be watching this on a separate computer because it is resource intensive most time when you're watching Youtube that takes up resources and then of course this particular activity going through the virtual servers with virtual servers also takes up a little bit so just be aware of that as always it's good to watch this as you pause possibly then do unpause if you get stuck Etc all right so moving along um we're going to start talking about the goals for this particular activity the we're going to analyze suspicious Network traffic using network topology documents and Baseline traffic we're also going to configure fire firewall rules to improve security so we do have an if tables reference sheet that we will use a little bit later on we also are going to spin up our Labs so go ahead and do that takes two or three minutes to do that and then it goes through this little review now with the review I'm going to spend a little bit more time talking about in the overview but basically it's pretty straightforward the last two activities you collected normal Baseline questionable perhaps suspicious traffic that's what we did so remember 3. 2. 2 we did the Baseline and the normal and then in 3.
2. 3 we did questionable or suspense suspicious traffic on this and what we're going to do is we're going to compare the two that's really all we're doing in this particular activity so if you look at this that's what they're showing you right here now the way that this works we have it says you have five Baseline capture files and three unknown or suspicious capture files stored on your machine you need to upload these to Target Windows host one now part of the problem is I've been doing these videos half of them at home half of them at work so half of my Baseline um sorry half of my pcap files are not here but I I just want to show you how to do this to get started and then I will go ahead and consolidate all of them to move forward and so you won't notice much of a difference in this because I'm going to try to keep the seamless as I go through the whole walk through but for right now if you're watching this for the very first time in 2023 you might only get the first part which is showing you how to zip the files and move them to your guac folder and then we're going to start doing some things okay so here we go first thing we do is on the local machine create a your name capture zip so here we go I'm going to go and what I pulled up here and I want to see if I can figure out there's the divider right there okay so this is my downloads folder so this is where I've been putting all of my my stuff so if you look I've got preview panes up I don't want the preview pane let's get rid of that and if you look I've got a bunch of bass lines so I've been doing this for a little bit but there's your unknown one two and three and then I have Baseline one and two there's my pump mind my PLC mons one um and then you'll see I've got by Baseline one and two for my pump monitor so right now I'm just going to show you how this works so we're going to create a new file now there's a couple of different ways you can do this they asked me to go ahead and create a your name capture zip file containing all eight so what I'm going to do is I'm going to take this this most recent one so let's take the Baseline here take this and I'm going to use the control button hold down control and select the ones that I want so there's Baseline one Baseline two for the pump bonds then I've got my pump PLC Baseline there's three then I've got my web 2 and my web 3 and then my unnote one two three right there now once I've got those all highlighted I'm going to right click with my mouse button and I'm going to send to compressed zip folder so this is what we're doing so we're going to compress zip folder alrighty so we did that and now we got to find the compressed zip folder so what I got to do is find out where the heck that is so I'm going to pause just for a second to find it and then we'll come back okay all right give me a second and we're back so real quick just let you know so it stayed in the downloads folder and it moved to my now I've got this set by by my extensions so it moved to the compressed zip folder now and then you'll see I've got 97 because I do a lot of CSA and CSE and CSP stuff but if you scroll down you'll notice that it's right there and it labeled with the last one which is web Baseline two now they want me to do this where they want me to take this and I just did a single clip on this to change I can right click and and change and rename this but I'm going to rename this as my last name and then captures okay which is what they asked me to do in step three it's right here they wanted me to do that so let's go ahead and go to the next one now it says the file is automatically downloaded and copied to the G guacamole folder so copy the zip to the desktop so they're telling me that it's already in my guacamole so let's take a look so now here's my virtual server so if I go in here that's not well we're starting out really well this is great this is not what I wanted to do I wanted file explorer and for some reason I pulled up Google it's just one of those mornings apologize for everybody so here's my guacamole so if I click on guacamole there's my downloads and if I go to my downloads it is empty so this is a problem right off the bat now why is it empty probably because I renamed it so let's see if I can do this where I can trick it so I'm going to right now I'm going to send this to my desktop send to my desktop let's see let's just take it and just drag it okay so we're going to move it to my desktop and then from my desktop you'll see that I've got all these fun things on here and there's my captures file and I'm going to move it down to my downloads no let's do this move it to my downloads there we go we moved it to the downloads minimize foreign it's still not there this is awesome okay let's figure out what's going on let's see if I can stop this pause it just a minute okay once again early morning it tells me that you're just dragging so let's try just dragging it so let's go to downloads folder let's go in here let's find iserloth and it says just drag it to the desktop let's see what happens well apparently if I read right we would be okay we could do this so everybody get a good laughing chuckle because apparently I can't read directions either so what this is supposed to do is it now put it in there now when I pop it up you'll notice it's not on the desktop it should be in my guacamole folder there it is it's been put in my guacamole folder so that's how you go ahead move it so you're gonna have to take it transfer it to the desktop all right so now if you look at it if you try to extract the files directly on the zip walls and you'll receive an error so you have to do it as a zip file and if I try to extract the files directly from the zip file where the guacamole folder is received so what I have to do is the files automatically download it on guacamole copy the zip file to the desktop all right so now I gotta copy the zip file to the desktop so what they want me to do is take this and they want me to copy it to the desktop there it is okay and at this point I now have it in two places in case I screw up so let's go ahead and take a look at what the next piece says and it says extract so right click extract all and then there's my destination it says extract all eight files and they want to go to administrator desktop capture files now there are two things here and this is really really really important the first one is expected error if you try to extract the files directly from the zip file so if you've ever used zip files before one of the things you can do is you can double click on them and then pull them out as you need they're telling you that if you do that you're going to get an error so what I have to do is I have to right click on it so let me go ahead and show you that again right click and I'm going to go down to the second one where it says extract all now at this point it says extract all and it'll tell you where you're supposed to go so if you look it's going to go right to the desktop so what that means is that when I hit this I should see all eight files load up right here on the desktop actually it'll show up in a folder called Heiser Loft captures and it'll be in there so here we go there it is and this is that folder right here you see that so this is how I get them onto my computer so now that I've got all of them in there I'm going to change this one's name so that it looks the same as everybody else is because this is really important all in that space is going to cause issues so let's get rid of that let's just do this right here okay so now we have our pump monitor Baseline one two our pump line PLC Baseline one we're missing two uh we've got the Baseline two with Baseline three here and then we got three unknowns all right so everything seems to appear to be in order moving on to step five step five says open a Target Windows one your first Baseline file so I have to open this in Wireshark so let's open up Wireshark here we go and it's going to take just a second or two again as I'm using zoom while I'm doing this and trying to use Wireshark at the same time it does slow down the processes so I apologize for the delays at this point if you're on a Chromebook it's going to be even slower okay registering finding local interfaces there we go we have this yay now what they want us to do is they want us to open the P CAP so let's go ahead and do this we're going to open up the P CAP so we're going to go to file open and then I'm going to look at desktop eiserloth capture files and they want pump base pump mod Baseline one there it is right there and I'm going to open there she is there's pump Baseline one she doesn't look as pretty as she did before but that's okay this is what pump Baseline one looks like now this is interesting so this is where it gets complicated and I want you to pay attention as we go through this because if you do this wrong it's going to screw it all up and you're going to be in trouble all right so from the file menu so file up here we're going to select the merge which is the third one down we're going to select merge and then select your next Baseline the um piece and they want us to do pump PLC Baseline one so they want us to take this pump PLC Baseline one and merge it so here we go and we're going to merge it and hit open so now you can see that it's changed yet again as now what you're seeing is you're going to see some overlap of time stamps you're going to see some other issues and basically what's going on is you've now taken your pump PLC and your pump Monitor and you put them together this is a pristine value this is the Baseline this is both the pump Monitor and the PLC working as intended with no problems and we've just merged them into one big wire shark and that's all we're dealing with right now okay and then what they say is the contents the merged file are appended to the packet list so you know they're added so this is how this works they're going to see this all go through now that is Step six so then it says step seven we want to save the merge file as full Baseline so here we go file save and we're going to go into save into we're going to change this to desktop and I'm going to go into my captures and I'm going to call this as eiserloff underscore full Baseline dot okay and then Baseline just like that and it's a TCP dump because it hasn't changed it took two TCP dumps and now when I want to merge it it automatically put it as a TCP dump as a pcap file so let's go ahead and save this and now when I go into my Heiser lock captures there she is right there okay that is Step seven now step eight says repeat the merge until you have all Baseline files in one p camp now this is a problem and where I'm going to have to pause the video because what I've got here is half of my stuff but what we need to do and I'm going to do this just to show you what it looks like is we're going to continue doing this now this is important repeat the merge until you have all Baseline files in one pcap file now remember in Step One it said way up there just before step one you have five Baseline capture files so how many times you can have to merge this that was one where it took number one and number two so that's the first merge now I got to take that full Baseline and I have to merge it with another pristine file so what we got to do is we've got to merge another Baseline file to this so what is the other baselines that I have now remember there's five right so I'm going to just show you what this looks like this is going to be a mess because it's not perfect but the next thing I need to do is I got to do them in the order I created them one through three and receiving with each merge so remember when we do this now this is where it's going to be a little tricky you're going to have to go back to 3. 2.
2 to see what happened now if you were good and you had all of this on your computer and you did this in the order that it was supposed to the date modified Stamps will be in proper order but because I'm jumping all over with computers I can't guarantee this look I'm using a pump PLC Baseline one from 2021. because my original 2023 is on my home computer so I'm relying something that I did prior so obviously when I redo this thing I'm going to have to do them all in order but just for right now just look I did one and two so let me show you how this works so this is one and two I've saved it now we gotta merge this one with number three which would be pump Baseline two right Baseline two we're going to open up this one and merge this and then I'm going to save this one so let's go ahead and save this and again this one I'm going to go back to desktop I'm going to go into my captures and this is going to be now this one I'm going to say different why am I saving it different because it's what we're every time we do this so let's save this as either law and we're going to do full Baseline but what I'm going to do here is right here I'm going to change this full Baseline to right and then we have two more where we're going to merge the web one and web 2. so we're going to merge with web Baseline right here we have web Baseline two and then save and again guys this may not be the price the right one I'm just showing you what we're doing and then again rinse and repeat we go through this I will do a better selection sorry I will do a better better job at this once I have all of my captures and I don't have all of my captures and I apologize but this gives you sufficient and then we do three now when I do this right so that one what have I done I've taken pump PLC the first Baseline is two of them the second one is a third the third one is a fourth so I've got one more to get all five so let's do this one more time we're gonna merge and this time we're going to merge with pump base line three and open and then save and we're going to go to desktop again Azure love captures and this is full Baseline four as we go through this okay there we go so this is all of my Baseline files from 322.
this is what we are supposed to do and now if you look when I go through this right so I've got the two files this is the three files four files and then five files so this is the one that I'm going to be using as my full Baseline now why did I do this so according to pltw these should just overwrite this into full Baseline but if you make a mistake you don't have to go all the way back this is why I did four different ones and then once I know full Baseline four works right then I can get rid of the others but right now I don't know so playing it safe just by Saving and if you look at the files it starts out with 39 kilobytes adding another one goes to 45 adding another one goes to 180 and then finally 365. so they are getting bigger because we're adding and adding and adding and adding so just keep that in mind so it looks appears to be right however I I'm not sure that I did the right files I would have to go back and look at all of those okay now it says Now open up your first unknown so we're going to do is we're going to go in and repeat the merge uh and it says open up your first unknown capture and repeat the merge process for your three questionable files saving the large cap view named file unknown okay so here we go and you're going to create a new one so let's do this so we're going to close this and we're going to open up a new one so here we go we're going to open up unknown one that we got three of them right oh known one there she is and I'm going to merge her with unknown 2. okay saving this as eiserloff let's go back in here title of captures and we're going to call this advisor Loft pull on known okay and then I'm going to merge the third one the last unknown here since there's only three of these files okay it's loading so this is a big one all right and we're going to save this as unknown one like that okay now when I look at this and I'm going to minimize my Wireshark right now when I look at this look at the size of unknown full unknown is 19 000 kilobytes now again not a big file that's only 19 megabytes that's less than a picture for those of you guys that are using jpegs and things like this but it's still quite big when you start talking about just raw data of bits okay so what they want us to do is they want us to take these two this unknown here and this on this Baseline here and they want us to take those two and download both of them to my machine okay so I'm going to take this full Baseline four and I'm going to right click put it over there I'm going to copy into my guacamole and then I'm going to do the same thing with my full unknown one P CAP to guacamole and if I did this right there they are full Baseline four okay and for the sake of argument once I figured out that I've done this right then I'm going to get rid of this 4 here I'm just going to call it full Baseline and this one's going to be wool unknown okay and they want to take both of these and they want us to move them to the local computer so I'm going to do one at a time and I'm just going to move it to the download there it is she popped up I'm going to do full unknown I'm going to go to the download and there she is and both of them are now into my system and it looks like something's running I'm not sure what's going on in the background but if I go to my downloads up near the top let's see I should see if I go to my pcap files let's pull this up pcap files are right there there's now 12 of them and there is my full Baseline and my full unknown right there and again this is one of those things that I want you to do for me is I want you to go ahead and screen cap this so take a screenshot of this showing me that you've actually got both of these into your downloads folder okay that takes you through step 10.
