How to use Wireshark on Windows. How to use the power of Wireshark display filters to get the most out of Wireshark LAN traffic analysis

Wireshark is a very popular network protocol analyzer through which a network administrator can thoroughly examine the flow of data traffic to / from a computer system on a network.

This tool has been around for quite some time and provides many useful features.

One of these features is the display filter through which you can filter the captured data traffic based on various factors such as protocols, network ports, IP addresses, etc.

In this article, we will discuss the basics of Wireshark and 5 essential Wireshark display filters that every beginner should know.

If you are completely new to Wireshark, first download it and install it on your system.

After installation, launch the Wireshark GUI.

Here's an example of the Wireshark home screen:

The first step is to select the interface (on which the data should be written), and then click the "start" button.

As soon as you press the start button, information about all incoming and outgoing data packets (on the selected interface) is displayed on the output.

You can click any entry for a package in the window shown above and see more details related to that package displayed in the section just below the same window.

Now let's get back to our topic. display filters can be entered via the "Filter" text box, which is located just above the traffic output section.

Examples of Wireshark Screen Filters

In this section, we will discuss 5 useful output filter syntaxes

1. Filter results by protocol

You can easily filter the results based on a specific protocol. For example, to display only packets that contain the TCP protocol, simply write the protocol name in the filter text box.

Here's an example:

Thus, you can see that all packets containing TCP protocols were displayed in the output.

2. Filter results by port

You can also filter results based on network ports. For example, to display only packets that contain TCP and have source or destination port 80, simply write tcp.port eq 80 in the filter window.

Here's an example screenshot:

3. Filter results based on multiple conditions

If there is a scenario where you want to display results based on conditions that are not related to each other, use the filter or... For example, to display all packets containing TCP or DNS protocol, simply write t cp or dns in the filter window.

Here's an example screenshot:

Thus, you can see that the output will show packets containing the TCP or DNS protocol.

In a similar way, you can use the filter and. This filter is used where you want to display results based on unrelated conditions. For example, to display all packets containing TCP as well as HTTP protocol, simply write tcp and http in the filter field.

Here's an example screenshot:

You can see that the output will show packets containing both TCP and HTTP protocol.

4. Filter results by IP addresses

Use filters to filter results based on IP addresses src or dst.

For example, to display only those packets that contain the outgoing IP address 192.168.0.103, simply write ip.src == 192.168.0.103 in the filter window.

Here's an example:

Similarly, you can use the filter dst (ip.dst) to filter packets based on destination IP addresses.

5. Filter results based on byte sequence

Sometimes you want to check packets based on a specific sequence of bytes.

To do this, simply use the contains filter with the protocol name and byte sequence.

The output will display TCP packets containing the 00:01:02 byte sequence.

What is the most powerful tool for capturing and analyzing internet traffic today? The answer is simple - Wireshark. It is capable of intercepting not only outgoing TCP packets, but also incoming ones. This tool is in service with many professionals. And hackers do not hesitate to use it. The possibilities of the program are endless. With its help, you can pull any file from the package, view it and check it. The main question is how to do this. This is what we will try to figure out.

What is Wireshark

This utility is designed to control Internet traffic. It intercepts TCP packets that were received by the computer or sent from it. The functionality of the program is so rich that the matter is not limited to simple interception. You can view the contents of packages, search for errors, and so on. In addition, you can use WS to pull almost any file out of packages and view it. To better understand what this program is, you need to highlight its main advantages. So the pros:

• cross-platform (there are versions for Linux, Mac, Unix);
• the utility is completely free;
• has a wide functionality;
• customization flexibility;
• the ability to filter traffic;
• creating your own filters;
• interception of packets in real time.

There are really many advantages of this utility. But there are no shortcomings as such at all. No wonder Wireshark is considered the best of its kind for capturing and analyzing TCP packets. Now you need to understand a little about the program itself.

Installation and configuration

You can download Wireshark from the developer's official website. The program is completely free. It should be noted that the latest version (2.0.5) does not work with Wi-Fi adapters. Therefore, if you need to analyze the traffic of a wireless connection, you should download an older version.

Installation of the utility is standard and will not cause any problems even for beginners. Everything is clear in the installer, even though it is in English. By the way, Wireshark does not exist in Russian in nature, therefore, in order to successfully cope with this software, you will have to strain your memory and remember English. In principle, nothing supernatural is needed to simply capture and view TCP packets. School level English is enough.

So, the first thing we see after launching the installed program is the main window. For an unprepared user, it may seem incomprehensible and scary.

There is nothing wrong with it. You will be convinced of this now. To get started, you must first select a source from which to capture TCP packets. Interception can be carried out both from an Ethernet connection and from a WLAN adapter. As an example, consider the WLAN option. To configure, go to the "Capture" item, the "Options" sub-item. In the window that opens, select your wireless adapter and tick it. To start capturing traffic, just click the "Start" button.

After clicking "Start" the analysis and capturing of packets will start. A lot of incomprehensible letters and numbers will appear in the window. Some of the packages have their own color coding. In order to understand at least something, you need to determine which color refers to what. Green - TCP traffic, dark blue - DNS, light blue - UDP and black - TCP packets with errors. Now it's easier to make sense of this mountain of data.

To stop the interception process, just press the Stop button, which is marked with a red rectangle. Now you can select the package you are interested in and view it. To do this, right-click on the packet and select Show packet in new window from the menu that appears. A bunch of incomprehensible letters and numbers will immediately appear.

But with an in-depth study of the information presented, you can understand where the package came from and where and what it consisted of. In order to view the data about TCP packets later, you need to use the function of saving the captured information. It is located in the "File" menu item, the "Save as" sub-item. Then you can load the information from the file and view it calmly.

Using filters

To display only the information that interests you, you can force Wireshark to use filters and cut off unnecessary traffic. Instructions for fine-tuning filters are available on the Web, but for now we will consider only one example. Let's say you're only interested in TCP packets. In order for the program to display only them, go to the "Capture" menu item, the "Capture filters" sub-item, select the "TCP Only" item and press the "OK" button.

This way, you can force the utility to display only the traffic that interests you. More details on how to use filters can be found on the Internet. You can even create your own filter template. But that's a completely different story.

Conclusion

Among the programs for capturing and analyzing traffic, Wireshark has established itself as the most worthy utility for solving such problems. Many professionals use it with success. Of course, in order to work in it at a professional level, you will have to improve your knowledge of English and learn some principles of data transfer. But it's worth it. Now, no program on your computer will be able to send tons of unnecessary information to who knows where without your knowledge. Wireshark is unmatched as an interceptor and analyzer.

Video

1. In this article I will tell you how to intercept packets transmitted to the Internet via a local network. You will know the "ip" "Mac" address where the packet went, as well as the hash sum of the packet and much more useful information. I will not describe what and why, I will just give you the first skills, let's say so. How to capture packages and filter the packages we need from the list. Download the Wireshark program with bit depth for your system. With the installation, nothing difficult does not arise, so I will not describe it. The only thing is not to miss the "WinPcap" checkbox, it needs to be installed, with it you can learn a lot from the mac address and beyond. Installed the first launch of the program:
3. The first window is where you must select your network adapter from which to capture packets. 1.) Under the number, select the adapter and a little higher, under the number 2.) press "Start"
4. All packets that pass through the selected adapter will be intercepted and shown. You can set up a filter that will show the packets you need with the "IP" or "Mac" you need. Select the required package and right-click, select "Apply as filter" in the context menu and then "Selected" in the next context menu. Example picture below. A window with captured packets and a blue highlighted packet on which the filter will work.
5. After you have configured the filter. You will be shown only those packages that interest you. By highlighting the required package, all the information below will be available to you. Where, who and why, let's say briefly.
6. I have made a description of the top bar below. The picture is below the description.
7. 1.) You can choose another adapter.
8. 2.) So to speak, all in one. You can change the adapter, configure the filter, save to a file, save to an existing file (add), open the file.
9. 3.) Start packet capture.
10. 4.) Stop capturing packets.
11. 5.) Restart capture.
12. 6.) Open a file with existing packages.
13. 7.) Save the captured packages to a file.
14. 8.) Close the packet capture window, offer to save or exit without saving.
15. 9.) Reload the open package file.
16. 10.) Find the package you want.
17. 11.) Back to the captured packet, go to the packet window.
18. 12.) Same as 10.) only forward option. As in a browser, forward the page, naz.
19. 13.) Go to the specified package by the sequence number of the package.
20. 14.) Go to the very top in the field with packages, to the very first.
21. 15.) Go to the most recent package, to the very bottom.
22. 16.) Highlight packages with color, as specified in the settings for each package.
23. 17.) Promote the lines with the packages as they are filled. As new packages become available, show new packages.
24. 18.) Increase the lines with the packages.
25. 19.) Reduce lines, "Zoom".
26. 20.) Make the stitch enlargement 100%.
27. 21.) If you spread the stitch columns wider or narrower. This parameter will return everything by default.
28. 22.) Working with filters, you can choose an already offered filter or write your own. Add your own.
29. 23.) Almost the same as 21.) paragraph.
30. 24.) Here you can choose the color for each package separately, in the lines it will be easier for you to find the one you want.
31. 25.) Setting up the program itself.
32. 26.) Help on the program.
33. As you can see, the program is not complicated. In some countries it is prohibited, use it until it is banned here in Russia. If you think carefully, the benefits of this program can be emphasized a lot.

Network packet analyzers are often used to investigate the behavior of network applications and nodes, and also to diagnose network problems. The key features of such software are, firstly, the capabilities of versatile analytics, and secondly, multifunctional packet filtering, which allows you to fish out grains of information of interest in the endless stream of network traffic. It is the last aspect that this article is devoted to.

Introduction

Of all the methods for studying computer networks, traffic analysis is perhaps the most painstaking and time consuming. Intense streams of modern networks generate a lot of "raw" material, in which it is far from easy to find grains of useful information. Over the course of its existence, the TCP / IP stack has overgrown with numerous applications and add-ons, the count of which goes to the hundreds and thousands. These are application and service protocols, protocols for authentication, tunneling, network access, and so on. In addition to knowing the basics of network interactions, a traffic researcher (that is, you) needs to be free to navigate all this protocol variety and be able to work with specific software tools - sniffers, or, scientifically, traffic analyzers (protocols).

The sniffer functionality is not only about the ability to use promiscuos mode of the network card for interception. Such software should be able to effectively filter traffic both at the stage of collection and during the study of individual transmission units (frames, packets, segments, datagrams, messages). Moreover, the more protocols the sniffer "knows", the better.

Modern protocol analyzers can do a lot of things: read traffic statistics, draw graphs of the progress of network interactions, extract application protocol data, export work results in various formats ... Therefore, the selection of tools for analyzing network traffic is a topic for a separate conversation. If you don’t know what to choose, or don’t want to spend money on paid software, then use a simple advice: install Wireshark.

Getting to know filters

Wireshark supports two kinds of filters:

• interception of traffic (capture filters);
• display filters.

The first subsystem was inherited by Wireshark from the Pcap library, which provides a low-level API for working with network interfaces. Sampling traffic on the fly during interception saves RAM and hard disk space. A filter is an expression consisting of a group of primitives, optionally combined by logical functions (and, or, not). This expression is written to the Capture Filter field of the Capture options dialog box. The most used filters can be saved in a profile for reuse (Fig. 1).

Rice. 1. Profile of interception filters

The interception filter language is standard for the Open Source world and is used by many Pcap-based products (for example, the tcpdump utility or the Snort intrusion detection / prevention system). Therefore, there is no particular point in describing the syntax here, since you are most likely familiar with it. And the details can be found in the documentation, for example on Linux on the pcap-filter (7) man page.

Display filters work with already intercepted traffic and are native to Wireshark. Differences from Pcap - in the recording format (in particular, a dot is used as a field separator); also added English notation for comparison operations and support for substrings.

You can enter the display filter directly into the corresponding field (attention, the drop-down list-hint works) of the main program window after the "Filter" button (by the way, this button hides a profile for frequently used expressions). And if you click the button "Expression ..." located nearby, the multifunctional constructor of expressions will open (Fig. 2).

On the left (Field Name) is an alphabetical tree of the message fields of the protocols that are known to Wireshark. For this field, you can specify a logical operator (Relation), enter a value (Value), specify a range (Range), or select a value from the list (Predefined Value). In general, a complete network encyclopedia in one window.

Here are the logical operators used in display filters:

• and (&&) - "And";
• or (||) - "OR";
• xor (^^) - exclusive "OR";
• not (!) - negation;
• [...] - selection of a substring. # By filtering by the MAC address of your network adapter, we exclude all local traffic not (eth.addr eq aa: bb: cc: 22: 33: 44) # Sweep away all the "service noise" to concentrate on the traffic of interest! (Arp or icmp or dns)

As for fetching a substring, this is not quite a logical operation, but a very useful option. It allows you to get a certain part of the sequence. For example, this is how you can use the first (the first number in square brackets is the offset) three bytes (the number after the colon is the length of the subsequence) of the source MAC address field:

Eth.src == 00: 19: 5b

In selections with a colon, one of the parameters can be omitted. If you skip the offset, the sample will start from byte zero. If the length - then we get all bytes from the offset to the end of the field.

By the way, it is convenient to use substring fetching to detect malware if the sequence of bytes after the header is known (for example, "0x90, 0x90, 0x90, 0x04" in a UDP packet):

Udp == 90: 90: 90: 04

Comparison operations used in boolean expressions:

• eq (==) - equal;
• ne (! =) - not equal;
• gt (>) - more;
• lt (<) - меньше;
• ge (> =) - more or equal;
• le (<=) - меньше или равно.tcp.dstport ne 8080 && tcp.len gt 0 && data eq A0

Actually, the theory is enough for a start. Then use common sense and parentheses as needed and without it. Also, do not forget that the filter is essentially a boolean expression: if it is true, then the packet will be displayed on the screen, if false - not.

Pcap filter to detect Netbios port scanning

dst port 135 or dst port 445 or dst port 1433 and tcp & (tcp-syn)! = 0 and tcp & (tcp-ack) = 0 and src net 192.168.56.0/24

Looking for an IP hijacker

In a local network segment, there are (for one reason or another) coincidences of IP addresses for two or more nodes. The technique of "catching" (determining MAC addresses) of conflicting systems is well known: we launch a sniffer on the third computer, clear the ARP cache and stimulate a request to resolve the MAC of the desired IP, for example, by pinging it:

# arp -d 192.168.56.5 # ping -n -c 1 192.168.56.5

And then we look in the intercepted traffic, from which MAC's the answers came. If Wireshark has caught too many packets, use the constructor to create a display filter. In the first part of the expression we select ARP responses, in the second - those messages in which the source IP address is equal to the desired one. We combine the primitives with the && operator, since it is necessary that both conditions are fulfilled simultaneously:

(arp.opcode == reply) && (arp.src.proto_ipv4 == 192.168.56.5)

By the way, no computer network was harmed in this scenario because two Oracle VirtualBox virtual machines and a Virtual Host Adapter network connection were used.

We inspect the network and transport layers

Until now, the ICMP protocol remains a fairly effective tool for diagnosing the network stack. Messages from this protocol can provide valuable information about network problems.

As you may have guessed, filtering ICMP in Wireshark is very easy. It is enough to write in the filtering line in the main window of the program: icmp. In addition to icmp, many other keywords that are protocol names work, for example arp, ip, tcp, udp, snmp, smb, http, ftp, ssh, and others.

If there is a lot of ICMP traffic, then the mapping can be detailed by excluding, for example, echo requests (type 0) and echo replies (type 8):

Icmp and ((icmp.type ne 0) and (icmp.type ne 8))

In fig. Figure 4 shows an example of a small sample of ICMP messages generated by a test Linux router. The "Port Unreachable" message is usually the default. It is also generated by the network stack when it receives a UDP datagram on an unused port. In order for a virtual router based on Debian to start sending messages "Host unreachable" and "Communication administratively filtered", I had to tinker with it. Cisco informs about administrative filtering usually by default. The "Time-to-live exceeded" message indicates that there is a loop on some part of the network (well, such packets may also appear when tracing the route).

By the way, about firewalls. You can create rules for popular firewalls directly in Wireshark using the Firewall ACL Rules item in the Tools menu. First, you need to select a package from the list, the information of which will be used. Cisco standard and extended ACLs, UNIX-like rules for IP Filter, IPFirewall (ipfw), Netfilter (iptables), Packet Filter (pf), and Windows Firewall (netsh) are available.

And now, briefly about the basics of filtering at the network level, which is based on the IP packet header fields - the sender's address (ip.src) and the recipient's address (ip.dst):

(ip.src == 192.168.56.6) || (ip.dst == 192.168.56.6)

So we will see all the packets that the given IP address received or sent. You can filter entire subnets using the CIDR notation for the mask entry. For example, let's identify an infected host that sends spam (here 192.168.56.251 is the IP address of our SMTP server):

Ip.src == 192.168.56.0/24 and tcp.dstport == 25 and! (Ip.dst == 192.168.56.251)

By the way, the primitives eth.src, eth.dst and eth.addr should be used to fetch by MAC addresses. Sometimes network layer problems are much more closely related to the Ethernet layer than theory suggests. In particular, when setting up routing, it can be very useful to look at which router's MAC address the stubborn node is sending packets to. However, for such a simple task, the tcpdump utility, almost standard for UNIX-like systems, is enough.

Wireshark also has no issues with port filtering. For TCP, the keywords tcp.srcport, tcp.dstport and tcp.port are at your service, for UDP - udp.srcport, udp.dstport and udp.port. True, the built-in Wireshark filter language did not have an analogue of the port primitive in Pcap, which designates both UDP and TCP ports. But this can be easily fixed with a boolean expression, for example:

Tcp.port == 53 || udp.port == 53

Improvising with HTTP traffic

Application protocols, in particular HTTP, are an eternal topic in the context of sniffing. For the sake of fairness, it must be said that many specialized software tools have been created to study web traffic. But even such a versatile tool as Wireshark, with its flexible filtering system, is not at all superfluous in this field.

First, let's collect some web traffic by visiting the first site that comes to mind. Now let's look in the messages of the TCP protocol, which serves as a transport for HTTP, for references to our favorite Internet resource:

Tcp contains "site"

The contains operator checks for the presence of a substring in the given field. There is also the matches operator, which allows you to use Perl-compatible regular expressions.

The "Filter Expressions" window is, of course, a good helper, but sometimes flipping through a long list in search of the required field is quite tedious. There is an easier way to create / modify display filters: using the context menu when viewing packages. To do this, you just need to right-click on the field of interest and select one of the sub-items of the "Apply As Filter" item or the "Prepare a Filter" item. In the first case, the changes will immediately take effect, and in the second, you can correct the expression. "Selected" means that the field value will become a new filter, "Not Selected" - the same, only with negation. Clauses starting with "..." add the field value to the existing expression, taking into account the logical operators.

By combining various tools of the Wireshark graphical interface and knowledge of the features of the HTTP protocol, you can easily drill down to the required level of displaying traffic in the main program window.

For example, to see what images the browser requested from the web server when generating the page, a filter that analyzes the content of the URI transmitted to the server will work:

(http.host eq "www..request.uri contains" .jpg # 26759185 ") or (http.request.uri contains" .png # 26759185 "))

The same, but using matches:

(http.host eq "www..request.uri matches" .jpg | .png # 26759185 ")

Of course, message fields of protocols of different levels can be safely mixed in one expression. For example, to find out which pictures a given server has transmitted to the client, we use the source address from the IP packet and the "Content-Type" field of the HTTP response:

(ip.src eq 178.248.232.27) and (http.content_type contains "image")

And with the help of the "Referer" HTTP request field, you can find out from which other servers the browser takes content when forming the page of your favorite site:

(http.referer eq "http: //www..dst eq 178.248.232.27))

Let's look at a few more useful filters. The following expression can be used to extract HTTP requests made by the GET method from traffic:

Http.request.method == GET

It is at the application level that display filters manifest themselves in all their beauty and simplicity. For comparison: in order, for example, to solve this problem using Pcap, one would have to use the following three-story structure:

Port 80 and tcp [((tcp & 0xf0) >> 2): 4] = 0x47455420

To find out what www connections the user of the host 192.168.56.8 made at a certain time interval (say, at lunchtime), we use the frame.time primitive:

Tcp.dstport == 80 && frame.time> = "Yan 9, 2013 13:00:00" && frame.time< "Yan 9, 2013 14:00:00" && ip.src == 192.168.56.8

Well, displaying the URIs of requests containing the words "login" and "user", plus a "reminder" of passwords:

Http.request.uri matches "login. * = User" (http contains "password") || (pop contains "PASS")

Interception of SSL content

The real scourge of a network traffic researcher is encryption. But if you have the coveted file with the certificate (by the way, you need to take care of it like the apple of your eye), then you can easily find out what the users of this resource are hiding in SSL sessions. To do this, you need to specify the server parameters and the certificate file in the SSL protocol settings (item "Preferences" of the "Edit" menu, select SSL in the list of protocols on the left). PKCS12 and PEM formats are supported. In the latter case, you need to remove the password from the file with the commands:

Openssl pkcs12 -export -in server.pem -out aa.pfx openssl pkcs12 -in aa.pfx -out serverNoPass.pem –nodes

INFO

Extracting traffic from network traffic for monitoring and debugging is performed by a packet filter. A packet filter is part of the operating system kernel and receives network packets from the network card driver.

Examples of packet filters for UNIX-like OS are BPF (Berkeley Packet Filter) and LSF (Linux Socket Filter). In BPF, filtering is implemented on the basis of a case-oriented primitive machine language, the interpreter of which is BPF.

Analyzing traffic from remote hosts

Windows users can work not only with the interfaces of the computer on which Wireshark is running, but also capture traffic from remote machines. For this there is a special service (Remote Packet Capture Protocol) in the delivery of the WinPcap library. It must first be enabled in the service management snap-in (services.msc). Now, having launched Wireshark on a remote computer, you can connect to the node on which the remote traffic interception service is running (by default, it uses port 2002), and the data will flow like a river to you via the RPCAP protocol.

I will also give options for connecting to a home * nix-router "from the outside" for remote traffic analysis:

$ ssh [email protected]"tshark -f" port! 22 "-i any -w -" | wireshark -k -i - $ ssh [email protected] tcpdump -U -s0 -w - "not port 22" | wireshark -k -i -

A must have tool

Wireshark is a well-known tool for intercepting and interactively analyzing network traffic, in fact the standard for industry and education. Distributed under the GNU GPLv2 license. Wireshark works with most well-known protocols, has a GTK + based graphical user interface, a powerful traffic filter system, and a built-in Lua programming language interpreter for creating decoders and event handlers.

Extract payload

In certain circles, specialized tools are widely known that allow you to "pull" final information objects from traffic: files, images, video and audio content, and so on. Thanks to its powerful analytical subsystem, Wireshark more than covers this functionality, so look for the "Save Payload ..." button in the corresponding analysis windows.

Conclusion

Against the background of the general enthusiasm of the computer underground for the security of network applications, the monumental problems of the lower levels are gradually fading into the background. It is clear that the network and transport layers have been studied and researched far and wide. But the trouble is that specialists who grew up on SQL injection, cross-site scripting and inclusions are unaware of the huge layer hidden under the tip of the iceberg, and often give in to seemingly elementary problems.

The sniffer, like a debugger and disassembler, shows the details of the functioning of the system in great detail. With Wireshark installed and with a little knack, you can see network interactions as they are - in an innocent, virgin nude. And filters will help you!

Hello! I continue my acquaintance with WireShark.
Weirshark can be found at our file bin, just in case, here's a link.

Today we will learn how to recover files transferred over the network from a traffic dump.

First of all, let's open a sample dump with the captured FTP traffic. Open the file as standard, File -> Open.

By right-clicking on the first packet, we will get a context menu in which you need to select the Follow TCP Stream item, that is piece together the entire session:

Here we will see a window that reflects all the FTP commands and responses that were transmitted in this session. Let's pay attention to the highlighted areas.

1. Request the size of the file “OS Fingerpringing with ICMP.zip”. The server reports: 610078 bytes (we will check this later);
2. Request transfer of this file.

So, we are interested in this file (suppose), so we clear the filter (if it is not empty) and look at the dump. So I highlighted the place where the RETR command was transmitted (receiving a file), and then a new session was opened on the FTP-DATA port, i.e. data transfer. We collect this session according to the well-known scheme (see above).

There is already an unreadable option, some squiggles instead of text. This is what we need, we will keep these data in RAW format to the file.

We can give anything we want as a name. But remember from the command history that a ZIP archive was transferred. I named it 1.zip and placed it on my desktop. You can do the same.

The file can now be opened! As you can see, this is a real ZIP archive with other files inside. It is quite possible in the same way to restore the transfer of images over the HTTP protocol, HTML-code of web pages, etc.

I hope you will use this knowledge for your benefit. Now, by the way, pay attention to the size of the resulting archive. Exactly up to a byte matches the values ​​given by the server.

Friends! Join our Vkontakte group , to don't miss new articles! Wanna say thanks ? Like, repost! This is the best reward for me from you! This is how I find out that you are interested in articles of this kind and write more often and with great enthusiasm!

Also, subscribe to our YouTube channel! Videos are posted quite regularly and it will be great to be one of the first to see something!

You will also like:

Admin Quests # 4: Hijacking a Password via WireShark