Wireshark

# ===== Rules of engagement (excerpt — must be signed before any run) =====
# - Targets:   internal staging hosts, ONLY on networks owned by the client
# - Off-limits: capturing traffic between unaware third parties; production user PII
# - Window:    2026-06-18 09:00-17:00 AEST
# - Storage:   pcap files encrypted at rest; deleted within 7 days of report
# - PoC:       record minimum traffic needed to demonstrate the finding

# ===== 1) Capture safely (least-privilege user, scoped interface) =====
# Linux — add yourself to wireshark group so you don't need root for live capture
sudo usermod -aG wireshark $USER

# Start a CLI capture on a specific interface, ringed to 100MB files, max 10 of them
tshark -i eth0 -b filesize:102400 -b files:10 -w session.pcapng

# Stop with Ctrl+C. Output: session_00001.pcapng, session_00002.pcapng, ...

# ===== 2) Practical display filters in Wireshark =====
# tcp.port == 443                              # only HTTPS
# http.request.method == 'POST'                 # forms / API writes
# http.host contains 'example.com'              # by hostname
# dns.qry.name matches '\\.example\\.'         # DNS queries to a domain
# ip.addr == 10.0.0.42                          # all traffic for one host
# tls.handshake.type == 1                       # ClientHello (negotiation insight)
# tls.handshake.extensions.server_name contains 'auth'
# frame contains 'authorization'                # warns of accidental token leak
# !(tcp.analysis.retransmission)                # exclude retransmissions

# ===== 3) Follow the TCP / TLS stream to see one conversation =====
# Right-click a packet -> Follow -> TCP Stream  (or TLS Stream)
# Shows the full bidirectional dialogue cleanly assembled.

# ===== 4) Decrypting TLS (with cooperation) =====
# If you control the CLIENT, set SSLKEYLOGFILE so the browser / curl
# writes session keys, then point Wireshark at that file.
export SSLKEYLOGFILE=$HOME/sslkeys.log
firefox &       # all browsers and curl built with libssl >= 1.1.1 honour this
# Wireshark -> Preferences -> Protocols -> TLS -> (Pre)-Master-Secret log filename
# Now TLS frames decrypt and you can inspect HTTP, gRPC, etc.

# DO NOT install your own root CA on someone else's device — that crosses the line
# from authorised analysis into interception of a third party.

# ===== 5) Useful incident playbook queries =====
# 'Is anything sending a bearer token in cleartext?'
#   frame contains 'Bearer ' && !tcp.port == 443

# 'What endpoints does the mobile app hit on launch?'
#   tls.handshake.extensions.server_name && tls.handshake.type == 1

# 'Are we leaking PII in URL parameters?'
#   http.request.uri contains 'email=' || http.request.uri contains 'phone='

# 'Why is this connection slow?'
#   tcp.analysis.retransmission || tcp.analysis.duplicate_ack
#   then Statistics -> Conversations -> RTT to see round-trip patterns

# ===== 6) Findings template =====
cat <<'EOF'
## Finding: Sensitive header sent over cleartext
Severity:  High (credential exposure on hostile networks)
Scope:     /api/legacy/login on staging
Capture:   session_00003.pcapng frame 2147
Evidence:  Authorization: Bearer eyJ... sent to http://10.0.0.42 (port 80)
Fix:       Redirect 80 -> 443 with HSTS; reject bearer auth on non-TLS routes;
           rotate any tokens captured in the pcap and treat as compromised.
EOF

# ===== 7) Post-engagement hygiene =====
# - Delete pcaps from staff laptops; archive only the minimal evidence files
# - Encrypt evidence at rest; share with the client over their secure channel
# - Never reuse a capture from one engagement as a 'sample' for another

# Wireshark — capture + inspect packets on a LAB network.
# Filters you'll use:
ip.addr == 10.0.0.5     # by IP
tcp.port == 443         # by port
http.request.method == "POST"
dns.qry.name contains "example.com"