HomeWork 3_Wireshark Exam
1: File Transfer Protocol (FTP)
1. What username was used to login to the ftp server?
2. How many unsuccessful login attempts were made? What 3-digit response
code did the server use to i
...
HomeWork 3_Wireshark Exam
1: File Transfer Protocol (FTP)
1. What username was used to login to the ftp server?
2. How many unsuccessful login attempts were made? What 3-digit response
code did the server use to indicate failure to login? What passwords were
used?
530
The password was toor
3. What password was used in the successful login attempt? What 3-digit
response code did the server use to indicate a successful login?
230
4. What was the number of the TCP stream used for FTP commands? What
were the client and server ports used?
Client port: 21
Server Port: 48588
5. Which FTP commands did the client send to the server? How do
these commands correspond to what the user typed? For example,
when the user typed _cd_ their FTP client issued the command EWD to
the server. Some user actions, such as transferring a file, result in multiple
FTP protocol commands being send to the server.
SYST
LIST
CWD
PWD
6. Is the FTP session using active mode or passive mode? How did you
determine this fact?
The client send PASV
7. What file was transferred from the client to the server? What is the first line of
that file? Note that you can use the Follow TCP Stream feature from the right
click menu on an FTP datapacket, then select Raw format and do a Save As to
write the file to disk. Note that this technique will not work with our next
protocol—HTTP—as that protocol uses a single port for commands and data, so
saving an HTTP stream will save the protocol commands and headers from both
client and server as well as the file data.
8. What did the client learn about the server during this session? Your answer
should include all information, including file and directory names, as well as file
contents.
File Directory Name: c:\user\ASUS\Desktop\import_files\wire\ftp-session.pcapng
Length: 12 kb
Encapsulation:Eathernet
OS; Linux: 4.9.0-kali4-amd64
Packets captured: 91
Packet Display: 59
Capture Filter: none
Dropped Packer:0
2: HyperText Transport Protocol (HTTP)
1. http-google.pcapng
1. Identify the HTTP request method(s).
2. Identify the URL(s) requested (include all URL components available: protocol,
DNS name, path, query parameters).
DNS: www.google.com (74.125.68.102)
3. Identify the DNS name(s) of the server contacted according to the Host:
header.
[Show More]