8/8/2019 Network Monitor -- Get Password
1/2
Capturing passwords with a protocol analyzer
To capture passwords with a protocol analyzer, you perform the
following steps:
Log on to a Vista computer as an administrator.1.
Select Start - All Programs - Microsoft Network Monitor 3.1 -
Microsoft Network Monitor 3.1 to
access the Microsof t Network Monitor console.
2.
Click Yes in the Microsof t Update Opt-in dialog box.3.
Select the I accept the terms of use in the Internet Explorer
dialog box and click Install.4.
Click Continue.5.
After Internet Explorer confirms that Microsoft Update was
successfully installed, you close the
Internet Explorer window and close Windows Update.
6.
Click the Create a New Capture tab.7.
Select Capture - Start.8.
Open a Command Prompt window.9.
Obtain the IP address of the Windows Server 2008 computer in
your network.10.Enter the FTP server IP address to open a
connection to your FTP server.11.
On the User :>:line, enter the address and password, and
press Enter.12.
At the ftp prompt, type bye to end the connection to the FTP
server.13.
Open the Microsoft Network Monitor 3.1 window and select Capture
- Stop.14.
Close the Command Prompt window.15.
Select My Traffic to show only the network traffic to and from
your computer.16.
Review the Description column for the FTP traffic. You should
see an FTP Response from the "220
Microsoft FTP Service", an FTP Request for USER anonymous
access, an FTP Response allowing
Anonymous access and requesting the client send identity, an FTP
Request showing the e-mail youentered as your password, an FTP
Response logging in the anonymous user, and an FTP Request to
quit.
17.
In the Network Monitor, press F10 to start capturing
again.18.
You select Start - Network to examine the results of
authenticating to the server using Windows
passwords.
19.
You are prompted to authenticate to the server. You open the
same Windows Server 2008 computer
you used previously and log in as an administrator with your
password.
20.
Close the Network window.21.
Switch to Network Monitor and stop the capture.22.Select My
Traffic.23.
Click the Load Filters button.24.
Select Standard Filters, IPv4Address.25.
In the Filter pane, edit the IPv4.Address to the IP address of
your Windows Server 2008 computer.26.
Click Apply to display only the network traffic between your
computer and the server you just
connected to.
27.
Review the connection information that is recorded.28.
uring passwords with a protocol analyzer
https://library.skillport.com/courseware/Content/cca/cs_sety_a03_
10/12/2010
