Wireshark

# INSTALAR DVWA PARA PRÁCTICA
docker run --rm -d -p 8080:80 vulnerables/web-dvwa
sudo tcpdump -i any -w /tmp/sqli.pcap port 8080

# GENERAR TRÁFICO DE PRÁCTICA (otra terminal)
curl -b "security=low" "http://localhost:8080/vulnerabilities/sqli/?id=1'+OR+'1'='1"
curl -b "security=low" "http://localhost:8080/vulnerabilities/sqli/?id=1'+UNION+SELECT+user,password+FROM+users--"

# ANALIZAR CON TSHARK
# Buscar payloads SQLi:
tshark -r /tmp/sqli.pcap \
  -Y "http.request and http contains "union"" \
  -T fields -e ip.src -e http.request.uri 2>/dev/null

# Detectar SQLi automáticamente:
tshark -r /tmp/sqli.pcap \
  -Y "http.request" \
  -T fields -e ip.src -e http.request.uri \
  2>/dev/null | grep -iE "union|select|1=1|--$|%27|0x"

# ANÁLISIS EN WIRESHARK GUI
# 1. Abrir: wireshark /tmp/sqli.pcap
# 2. Filtro: http.request.method == "GET" && http.request.uri contains "id="
# 3. Clic derecho → Follow → TCP Stream
# Verás:
# GET /sqli/?id=1'+UNION+SELECT+user,password+FROM+users-- HTTP/1.1
# Respuesta: <td>admin</td><td>5f4dcc3b5aa765d61d8327deb882cf99</td>

# EXTRAER TODOS LOS POST DATA
tshark -r /tmp/sqli.pcap -Y "http.request.method == POST" \
  -T fields -e http.file_data 2>/dev/null | \
  python3 -c "import sys,urllib.parse; [print(urllib.parse.unquote_plus(l)) for l in sys.stdin]"

# ANÁLISIS DE BEACONING (Python)
python3 << 'PYEOF'
import subprocess
from collections import defaultdict
import statistics

result = subprocess.run(
    ['tshark', '-r', 'sample.pcap',
     '-Y', 'tcp.flags.syn == 1 and tcp.flags.ack == 0',
     '-T', 'fields', '-e', 'frame.time_epoch', '-e', 'ip.dst'],
    capture_output=True, text=True
)

connections = defaultdict(list)
for line in result.stdout.strip().split('
'):
    parts = line.split('	')
    if len(parts) == 2:
        connections[parts[1]].append(float(parts[0]))

print(f"{'IP':<20} {'Conn':>6} {'Intervalo':>10} {'Desv':>8} {'¿Beacon?'}")
print('-' * 60)
for ip, ts in sorted(connections.items(), key=lambda x: -len(x[1]))[:15]:
    if len(ts) < 3: continue
    intervals = [ts[i+1]-ts[i] for i in range(len(ts)-1)]
    avg = statistics.mean(intervals)
    std = statistics.stdev(intervals) if len(intervals) > 1 else 0
    beacon = "⚠ SÍ" if std < avg * 0.2 and len(ts) > 5 else "No"
    print(f"{ip:<20} {len(ts):>6} {avg:>9.1f}s {std:>7.1f}s {beacon}")
PYEOF

# USER-AGENTS INUSUALES
tshark -r sample.pcap -Y http.request \
  -T fields -e ip.dst -e http.user_agent 2>/dev/null | \
  sort | uniq -c | sort -rn | head -10

# DNS TUNNELING
tshark -r sample.pcap -Y dns -T fields -e ip.src -e dns.qry.name 2>/dev/null | \
  awk 'length($2) > 40 || split($2,a,".") > 5 {print "[TUNNEL?]", $0}' | head -10

# GENERAR IOCs
tshark -r sample.pcap -T fields -e ip.dst 2>/dev/null | \
  grep -v "^192.|^10.|^172.1" | sort -u > /tmp/iocs_ips.txt
echo "IPs a bloquear guardadas en /tmp/iocs_ips.txt"

# CAPTURAR DURANTE EL PROBLEMA
sudo tcpdump -i eth0 -w /tmp/slow.pcap "host 192.168.1.100 and port 80"

# CONTAR RETRANSMISIONES
tshark -r /tmp/slow.pcap -Y tcp.analysis.retransmission \
  -T fields -e frame.time -e ip.src 2>/dev/null | wc -l

# TIEMPOS DE RESPUESTA HTTP
python3 << 'PYEOF'
import subprocess
from collections import defaultdict

# Requests
reqs = {}
r = subprocess.run(['tshark','-r','/tmp/slow.pcap','-Y','http.request',
    '-T','fields','-e','frame.number','-e','frame.time_epoch','-e','http.request.uri'],
    capture_output=True, text=True)
for line in r.stdout.strip().split('
'):
    p = line.split('	')
    if len(p)==3: reqs[p[0]] = {'ts': float(p[1]), 'uri': p[2]}

# Responses
r2 = subprocess.run(['tshark','-r','/tmp/slow.pcap','-Y','http.response',
    '-T','fields','-e','frame.number','-e','frame.time_epoch','-e','http.response.code'],
    capture_output=True, text=True)

print(f"{'Tiempo':>10} {'Código':>6} {'URI'}")
print('-' * 60)
times = []
for line in r2.stdout.strip().split('
'):
    p = line.split('	')
    if len(p) == 3:
        rts = float(p[1])
        for rn, rd in sorted(reqs.items(), key=lambda x: x[1]['ts']):
            if rd['ts'] < rts < rd['ts'] + 10:
                rt = rts - rd['ts']
                times.append(rt)
                flag = "🐌" if rt > 1.0 else ""
                print(f"{rt:>9.3f}s {p[2]:>6} {rd['uri'][:45]} {flag}")
                break
if times:
    import statistics
    print(f"
Promedio: {statistics.mean(times):.3f}s | P95: {sorted(times)[int(len(times)*0.95)]:.3f}s")
PYEOF

# ZERO WINDOW (congestión)
tshark -r /tmp/slow.pcap -Y tcp.analysis.zero_window 2>/dev/null | wc -l

# DIAGNÓSTICO AUTOMÁTICO
RETRANS=$(tshark -r /tmp/slow.pcap -Y tcp.analysis.retransmission 2>/dev/null | wc -l)
echo ""
if [ $RETRANS -gt 100 ]; then
  echo "→ PROBLEMA DE RED: $RETRANS retransmisiones detectadas"
else
  echo "→ PROBLEMA EN APLICACIÓN: pocas retransmisiones, revisar BD/app"
fi

# CONFIGURAR EXPORTACIÓN DE CLAVES TLS
export SSLKEYLOGFILE=/tmp/tls_keys.log
firefox https://api.ejemplo.com &
# O: google-chrome https://api.ejemplo.com &

# Verificar que se generan las keys:
tail -f /tmp/tls_keys.log
# Verás: CLIENT_RANDOM abc123... def456...

# CAPTURAR SIMULTÁNEAMENTE
sudo tcpdump -i eth0 -w /tmp/https_audit.pcap port 443
# Ctrl+C cuando termines de navegar

# CARGAR EN WIRESHARK
# Edit → Preferences → Protocols → TLS
# (Pre)-Master-Secret log: /tmp/tls_keys.log
# Abrir /tmp/https_audit.pcap → filtro: http

# VIA TSHARK CON CLAVES
tshark -r /tmp/https_audit.pcap \
  -o "tls.keylog_file:/tmp/tls_keys.log" \
  -Y "http.request" \
  -T fields -e http.request.uri -e http.authorization -e http.cookie \
  2>/dev/null | head -20

# ANALIZAR TOKENS JWT
tshark -r /tmp/https_audit.pcap \
  -o "tls.keylog_file:/tmp/tls_keys.log" \
  -Y "http.authorization contains "Bearer"" \
  -T fields -e http.authorization 2>/dev/null | \
  grep -oP 'Bearer K[A-Za-z0-9+/._-]+' | \
  while read token; do
    PAYLOAD=$(echo $token | cut -d. -f2 | \
      awk '{n=length%4; if(n) for(i=1;i<=4-n;i++) printf"="; print}' | \
      base64 -d 2>/dev/null | python3 -m json.tool 2>/dev/null)
    echo "=== JWT Payload ==="
    echo "$PAYLOAD" | grep -E '"exp"|"iat"|"sub"|"email"|"role"'
    EXP=$(echo "$PAYLOAD" | python3 -c "import sys,json; print(json.load(sys.stdin).get('exp',0))" 2>/dev/null)
    NOW=$(date +%s)
    [ "$EXP" != "" ] && [ "$EXP" -lt "$NOW" ] && echo "⚠ TOKEN EXPIRADO — posible bug de seguridad"
  done

# BUSCAR DATOS SENSIBLES EN RESPUESTAS
tshark -r /tmp/https_audit.pcap \
  -o "tls.keylog_file:/tmp/tls_keys.log" \
  -Y "http.response" -T fields -e http.file_data 2>/dev/null | \
  python3 -c "
import sys,re
patterns = {'credit_card':r'd{4}[- ]?d{4}[- ]?d{4}[- ]?d{4}',
            'email':r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+.[a-zA-Z]{2,}'}
for line in sys.stdin:
    for name, pat in patterns.items():
        matches = re.findall(pat, line)
        if matches: print(f'[{name.upper()}] {matches[:3]}')
  "