SPYWARE Analysis with Wireshark - STOLEN LOGINS!

[@x0rZ15t]

These small videos of yours are so fun and informative. I didn't even know you could decode base64 inside Wireshark before 🤯

[@vq8gef32]

Just adding this side note, I watched the Unit42 Wireshark series, but the way Chris dives into this Wireshark is 360 degree different. This is my opinion but please watch and compare. Thank you so much Chris.

[@johnvardy9559]

@@vq8gef32 what you mean? which one is better to understand?

[@colinrogers9927]

Awesome vid! I am now intrigued enough that I will be analyzing much more malware. Thank you good sir!

[@rakeshn5070]

Wow Chris. This calls to for serious learning Wireshark. Damn how people steal logins using malware. Thanks for sharing the video and keep informing us.

[@yhytuncer]

These malicious pcap traffic analysis videos are awesome !

[@ChrisGreer]

Glad you like them! I gotta make some more then...

[@ScottPlude]

1% That's how much of your wireshark knowledge that I hope to retain some day! Just 1%! Amazing!

[@slip6699]

I love this content. Every time I learn something new. I have very little experience looking at logs but I'm picking stuff up. Thanks for sharing. I really need to try some of those real world examples. My eyes jumped to the port 80 right away and you basically got everything from smtp instead.

[@ChrisGreer]

I get it, it's easy to focus on the wrong thing... I do it all the time!

[@monh964]

Compressed and rich video. Thank you sir ✌️✌️✌️✌️✌️

[@TheKhirocks]

that base64 decode in wireshark was a great tip - i've been copy/pasting strings to external websites to do the same 👍

[@ChrisGreer]

Glad it helped! I was too... until someone showed me that lil' trick.

[@majiddehbi9186]

Woow Chris always a good subject and smart analyze thx and keep givin jsut question where to get any wirshark certificat Chris thx for u re help

[@Manavetri]

Excellent, I love this kind of videos with real files !... Keep going.

[@ChrisGreer]

Thanks, will do!

[@vq8gef32]

Chris , Chris, you are Master Shark! :) Big Thank you.

[@dbasslock]

Learning a ton of information from you, keep it up!

[@johnvardy9559]

all of these stuff included on your course?

[@stanleytomasetti1074]

please do more of these

[@clementyves6154]

very nice video ! thanks

[@Vipinkumarofficial]

Hi Chris, After clicking on follow stream, I got only binary code nothing readable. Anything I need to do to get readable data.

[@vq8gef32]

Hi Chris, If we try to open this PCAP file using Python Scapy library should we still be careful about it?

[@denza2843]

ty chris

[@justchecking12]

Love the content you made but here comes to my mind a question at the end. If smtp auth process had been done by user on port 465 with ssl, would we able to see the base64 encoded username and password?

[@ChrisGreer]

If it was encrypted over SSL/TLS then no, we wouldn't see the content, nor the base64 encoded username/passwords. To find suspect traffic in encrypted streams we would need to look for strange IP conversations (Which could possibly be spoofed), unusual port numbers, or other unusual conversation patterns. It can get tough these days! But I like showing the unencrypted pcaps because they are much better for learning how the spyware/malware works.

[@justchecking12]

@@ChrisGreer 👍

[@MrThumper001]

I am not able to download any pcap from this site. Please help

[@joerockhead7246]

nice. thank you.

[@YaserBasaad]

Thanks a lot , keep it up

[@ChrisGreer]

Thanks for the comment!

[@tanteckleng5062]

👍

[@vijay85cisco]

hi bro my client to server scenario TCP connection intermittently getting RESET from client side initiation after successful SYN first packet and SYN+ACK second packet received at my client machine. Then my client machine send sudden RESET to server instead of completing the 3-way handshake. on analysis Out of 100 TCP connection i can seen 25 RESET from my client machine to server. i believe something unusual at my CLIENT machine.. i differentiated all successful request and failed reset request. There i found whenever my client machine sent RESET above the wireshark line of each stream on received SYN+ACK delta time is above >500ms to 900ms... On all successful TCP request there syn+ACK received delta time on my client side wireshark shows below than >450ms . So i believe my side machine expecting that SYN+ACK packet receiving to my client machine should below the value of

[@Iowa25a]

thanks. smtp trick is a big help.