Never use Telnet

Key Takeaways

this video is part of my wireshark packet analysis and ethical hacking course have a look at this playlist if you want to see other videos in this series in this video i'm going to show you how to capture telnet traffic we're going to capture the telnet session and see all the passwords and all the data sent as part of the telnet session be careful using telnet in your network today you should be using ssh okay let's get started [Music] in this topology i'm using gns3 to virtualize a network now if you're not used to using gns3 don't worry too much basically i'm running a cisco router cisco switch and linux devices in this topology another very important skill if you're interested in being a good network engineer or being a good ethical hacker is to learn linux you need to know linux kelly linux is a great version of linux that can be used for hacking but even if you're not interested in becoming a hacker but want to implement network security or be a good network engineer you need to learn linux so in this example i've got web term it's a linux client but it's a gui based client so here we go this is a gui based client that will allow me to for instance to run firefox which gives me the ability to use http but it also has a console so as an example if i type ifconfig i can see the ip address of this device so this is a linux based graphical client i've got an ubuntu client here this ubuntu client is cli based there's no graphical user interface on this client but you can see the ip address is 10113 i've also got a toolbox client this toolbox client is basically a server that allows me to run a whole bunch of protocols once again it's also linux based ip address is 10 1 1. so let's see if we can capture some traffic i'll start a wireshark capture between the switch and the router in this topology geno3 makes this very easy because you can capture traffic in this virtual environment by simply right-clicking on a link in the real world you need to span a port or mirror a port or add a hub to the topology or a network tap network tap is basically where you inject something in the network so that you can see the traffic going across a link but we don't need to do that here gn3 allows us to monitor traffic very easily so as an example you can see hdp or spanning tree traffic you can see dynamic trunk protocol traffic we can see cdp traffic we can already see which devices are in the network so as an example we can see that there's a device called switch which is a cisco switch it's using this version of cisco ios very easy to see information on the network using wireshark but let's do this on the ubuntu client client over here i'm going to telnet to the router and log in so first thing is what is the ip address of the router show ip interface brief ip address of the router is 10 1 1 2 5 4. so let's assume that a administrator or a user is telnetting two router one and you're capturing traffic on the network so telnet 10 11254 password prompt is displayed i'll put in the password type enable put in the password type show run so this is the running configuration of the cisco router the problem with that is it's in clear text so if i filter for telnet in wireshark you can already see details of the telnet session here we can see as an example the source ip address destination ip address source port destination port telnet uses port 23. so that's the initial connection from the pc to the router rather replying back a bunch of information is displayed here but notice as an example we can see the prompt for the password so user access verification carriage return password and now a bunch of stuff negotiated but notice here c i s c o that is the telnet password a bunch of other stuff is now displayed notice there's the prompt of the router user typed e n enable in other words router's prompting for the password notice the source ip address is 10 1 254 that is the router asking the user for their password so in other words the enable password user type c-i-s-c-o precious carriage return and then type show run r-u-n there's run pressed carriage return router is building the configuration and then displaying the configuration now that's okay but it's not very easy to read that so what i'm simply going to do is go to the first entry and right click and type follow tcp stream and notice that there you go you get all of that information in one screen so password telnet password is cisco typed enable password typed as cisco notice we've got blue and red here so blue is the router prompting the user red is what the user is typing so what you'll notice is every character is sent individually so when you type s h as in show and then r u n as in run notice s h sent individually and then it's echoed back so when you telnetting to the router so in this example let's go back to the ubuntu client notice i'm on the ubuntu client if i type s h it's a character that's sent to the rod and then it's echoed back so i can see what i'm typing that's why when the link is really bad when you type a character it takes a long time for it to display on the screen so you have to type s it goes all the way to the router and then it echoes back s back to you so you can see what you've typed when the link is bad takes a long time for characters to display but notice enable password is cisco type show run there's the full running configuration captured in wireshark it was as simple as that to capture telnet traffic in the network that's why you don't want to use telnet if i type exit here connection is closed once again i'll follow that tcp stream scroll all the way down to the end notice i was typing sh and then i stopped that and typed exit to clear or end the telnet session as simple as that to grab the full running configuration of a cisco router using telnet do not use telnet today unless you know the network is secure or it's offline or you don't worry too much about the contents being read simple as that to get telnet traffic off the network be careful what i'll do is stop this capture and i'll save this as telnet so to make the course more interactive i've saved the wireshark captures that i'm using so why don't you download them and import them into wireshark and see if you can filter for traffic yourself and see if you can capture usernames and passwords as well rather than just watching me do it next