Forensic challenge - wireshark - tshark - to extract dns query to a file in order to analysis

 1. Open wireshark. From protocol hierarchy menu check what is the percentage of dns protocol. If it is high then there is a change that data exfiltration had occur via dns. 

2. Now filter packets based on dns protocol. Scroll down top to bottom to see is there any query exists with weird names like long hex character. 

i.e. 26tghkhk34553ggggggggggggggggfghfgfghfgsdfadfd2323234xvdfgdfs.example.zxy

You can see that how weird query looks like. you could also see MX, TXT and CNAME dns record there. Now you need to create dns.qry.name column. In order to do that, select any suspicious dns query packet. 

Then follow what the above image suggest. 

Now you need to extract the dns.qry.name column using tshark. 

tshark -r something.pcapng -T fields -e "dns.qry.name" > dns.txt

Now copy all the text from dns.txt packet and paste that on cyberchef to decode hex. Then find flag by searching DUCTF{} You can get the flag if you follow up to this way. Lets get more into it. 

If you use the above tshark command then legitimate domain name + some blank space will also get extracted on that dns.txt file. But we want only malicious hex domain name write? 

Now in the above image take a closure look. There is a Type field which is MX. Now write click on that and select apply filter as selected. You should see dns.qry.type == 15 filter is selected. Now query the following way:

tshark -r something.pcapng -T fields -e "dns.qry.name" -Y dns.qry.name==15> dns.txt  

Now you can try to decode using the same way. You may see double entries there because we captured request and responses as well. source is 10.0.2.15 and destination is 3.24.188.205 This public ip is the dns server. In order to get rid of those duplicate entries we need to add following tshark command. 

tshark -r something.pcapng -T fields -e "dns.qry.name" -Y dns.qry.name==15 -Y ip.src==3.24.188.205> dns.txt  

Now we will be getting all the response originating from source 3.24.188.205

If you want to remove 209 characters all together using regex then type the below regex pattern. 

[\w\d\.]{209}\n

w for all word

d for all decimal 

. will also be removed

\n new line

This one begins with 18 characters and ends with new line. 

 

 

 

 *** sometimes random characters in the dns query and response are not always hex or base64. Try to decode with RC4 algorithm or first try with base64 and after that underneath try with RC4 using cyber chef. RC4 algorithm needs a key to decrypt. You may also need to replace - with + and _ with / from the random string. 

 

Avi