Search
Network Forensics with NetworkMiner
2 min read

Network Forensics with NetworkMiner

Raúl Vázquez González's Picture
Raúl Vázquez González in networkminer network-forensics pcap-analysis tryhackme

Network Forensics with NetworkMiner

Investigating PCAP files and email metadata

In the world of network forensics, tools like NetworkMiner are essential for extracting valuable information from captured network traffic. This walkthrough will guide you through Task 5 of TryHackMe’s “NetworkMiner” room, Task 5: Tool Overview 2, providing answers to questions based on analysis of PCAP files and email metadata. I will cover the steps for identifying Linux distributions, frames associated with possible anomalies, and email details — all using the powerful NetworkMiner tool.

Task Overview and Answers

Use mx-7.pcap

Question 1: What is the name of the Linux distro mentioned in the file associated with frame 63075?

  • Process:
     Navigate to the Files tab, search by Frame number, and locate the Source Host column.

1_bHoNGqVC1K1zj_MVeSyQDg.png

  • Answer:
     CentOS

Question 2: What is the header of the page associated with frame 75942?

  • Process:
     Go to the Files tab, search by Frame number, and double-click the result to see more details.

1_SOxcy1C19hhRO-6IaYCe0g.png

  • Answer:
     Password-Ned AB

Question 3: What is the source address of the image “ads.bmp.2E5F0FD9.bmp”?

  • Process:
     Navigate to the Files tab, search by Filename, and check the Source Host column.

1_ujHbce0yBuvCOOsfYoYrUg.png

  • Answer:
     80.239.178.187

Question 4: What is the frame number of the possible TLS anomaly?

  • Process:
     Go to the Anomalies Tab, and check the First result.

1_mZBbcMQDtMAyrusDXlZifw.png

  • Answer:
     36255

Use mx-9 file

Question 5: Look at the messages. Which platform sent a password reset email?

  • Process:
     Navigate to the Messages tab and look for any indication of a platform name.

1_KsKQ-wwpWyWz1f1yai5MKQ.png

Note: Even though the correct answer appears to be Facebook, the content of the email doesn’t seem to specifically relate to a password reset.

  • Answer:
     Facebook

Question 6: What is the email address of Branson Matheson?

  • Process:
     Go to the Messages tab, search for an email with Branson Matheson’s name, and locate the email address in the details.

1_0LLV1VDT5Qs3alKW2dwgIg.png

Tip: If there were many more results, I would search for Branson’s name in the search bar to narrow down the options.

  • Answer:
     branson@sandsite.org

Conclusion

By following these steps in NetworkMiner, you can uncover a wealth of data hidden in network traffic, from identifying device information to analyzing anomalous behaviors. The ability to extract such information is essential for any cybersecurity professional working in the field of network forensics.

You may also like

Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
11 min read

Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night

Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration

Raúl Vázquez González's Picture
Raúl Vázquez González in ransomware threat-hunting splunk tryhackme aws
Exposing a Network-Based Attack: TryHackMe First Shift CTF — Task 7: The Crown Jewel
6 min read

Exposing a Network-Based Attack: TryHackMe First Shift CTF — Task 7: The Crown Jewel

Network Traffic Analysis and Forensics to Identify C2 Channels, ARP Spoofing, and Data Exfiltration Techniques

Raúl Vázquez González's Picture
Raúl Vázquez González in network-security network-forensics incident-response wireshark log-analysis
Investigating a Multi-Stage Attack: TryHackMe First Shift CTF — Task 6: Zero Tolerance
10 min read

Investigating a Multi-Stage Attack: TryHackMe First Shift CTF — Task 6: Zero Tolerance

A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence

Raúl Vázquez González's Picture
Raúl Vázquez González in soc-analyst splunk threat-hunting tryhackme

Latest Posts

Building a Tier 1 SOC Dashboard in Splunk
9 min read

Building a Tier 1 SOC Dashboard in Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
7 min read

Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González

Explore Tags

active-directory allowlist aws azure-security blue-team bluetooth books brim btlo certification certifications chmod cloud-security compliance cyber-security-awareness cyberchef cybercrime cybersecurity cybersecurity-lab dashboards data-filtering data-protection ddos detection-engineering dfir dfir tryhackme digital-forensics elastic elastic-search elastic-stack elk ez-tools file-permissions firewall homelab incident-response infosec intrusion-detection kerberos linux-hardening linux-security log-analysis malware-analysis mitm mitre mitre-attck network-analysis network-forensics network-security networking networkminer nmap opencti osint packet-analysis pcap-analysis phishing powershell programming python ransomware regex security-audit siem snort soc soc-analyst soc-lab spl splunk sql sysmon threat-detection threat-hunting threat-intelligence tryhackme ufw virustotal volatility web-security windows-forensics wireshark xdr