Inspecting the contents of the extracted UDP stream there are several Type 7 passwords which we can potentially use. Ip tacacs source-interface FastEthernet0/0 Type 7 Passwords).Įnable secret 5 $1$cPBj$qwX7keZqu6vF1UqNZxgCU0Īaa authentication login default group tacacs+ enableĪaa authorization exec default group tacacs+ noneĪaa authorization commands 1 default group tacacs+ noneĪaa a.uthorization commands 15 default group tacacs+ none

Knowing this, we may be able to decrypt some passwords that are stored using reversable encryption (ex. In order to inspect UDP traffic, you must open the Packet Capture in Wireshark, find the traffic you’d like to inspect, right click and hit “Follow UDP Stream”.Ī new window will be displayed to you showing the data contained within the UDP stream.īeautiful, now we can see that over TFTP the contents of “show run” from a Cisco device was transmitted. Alternatively, if there is noise on the wire, it will be shown As seen here: TFTP runs over UDP port 69, which means that if a packet is sent and it does not reach the end device, it will not be re-transmitted. TFTP is a protocol that is used to transfer files from one device to another in a non-secure, connectionless fashion.

Today we’re going to take a look at how to interpret TFTP and TACACS+ traffic and decode the contents of TACACS+ encrypted packet. Being able to intepret traffic in Wireshark is an incredibly important part in being a Cyber Security Analyst.

Wireshark filter clear text password