Hey everyone, and welcome to the Knowledge Portal Video series.
So in the earlier lecture we had understood the basics about what a protocols are, and today we'll
understand protocols as well as the cryptography is concerned.
So there are two types of protocols.
One is plain text and second is encrypted text.
So let's go ahead and understand more about it.
So this is one of the slides which we discussed in the earlier lectures where there are various types
of protocols which are available.
You have FTP, DNS, TCP, Sftp, FTP, IP and many more.
Now each of these protocols, some of these protocols will natively send data in plain text.
However, some of the protocols will natively send data in an encrypted format.
So one classic example that we will be discussing today in practical is the file transfer protocol,
FTP and the secure file transfer protocol Sftp.
So FTP will send the data natively in plain text.
So an attacker who is sniffing the network will be able to look into everything in plain text format.
However, when we use Sftp, everything will be in an encrypted format.
So even if an attacker is sniffing the traffic, he'll not be able to understand how or what exactly
the data is being sent.
So let's do one thing.
Let's go to our practical session and understand about these two protocols in practical scenario.
So we have a favorite CentOS machine up and running.
Let me just maximize the screen so it will become visible.
So what I'll do is I'll log in to root and let's open up the wireshark.
So while shark is a great tool to sniff the network traffic.
Perfect.
So let's do one thing.
Let's verify if I have my FTP related package installed.
Perfect.
So I have my vsftpd package installed and some and we will look into this specific aspect with both
FTP and Sftp protocol.
Perfect.
So let's do one thing in my wireshark.
I'll select the interface.
So just if you want to try it out, I have my main interface which is Gns3 three.
I have also a loopback interface and I have my third interface as well.
So since I have my vsftpd package up and running, let's verify and let's do a quick netstat.
I'll do a netstat and you see I have vsftpd running on port 21.
So for the time being so that we don't receive unnecessary traffic.
I'll select Loopback as the primary interface and I'll click on start.
So now you see I don't really have any packets which are flowing here.
So let's do one thing.
Let's connect to FTP on 1270.0.1 and now it is asking me for the username.
The username will be Z.
Water.
So this will be the username which is present in the machine.
Let me just verify.
Okay.
Zalora.
It is asking me for a password.
I'll put in the password.
And now you see it is saying login successful.
So I was able to successfully able to login to FTP.
Now we have discussed that the FTP is a plain text protocol.
So if you see there is a lot of packets which have been captured.
So let's do one thing, I'll maximize the screen and we since we had logged in via FTP, FTP is a plain
text protocol and now if you see within the protocol type, which is FTP, it is saying that the request
username was Zora.
So you will be actually be able to find this under the FTP protocol.
So the username is Zora and we had also entered the password so in my case the password was string password.
So it is actually showing me the password in plain text.
So this is what an attacker can actually do.
If is sniffing into your traffic, he can get both your username and password in plain text and he can
get all the responses if you see login successful.
So this is one of the challenges with plain text protocol.
Let's do one thing.
I'll close this terminal and this time we will be using an encrypted text protocol which would be Sftp.
So I'll restart the session.
Perfect.
So I'll use sftp.
Vohra added 127.0.0.1.
It is asking me for password.
I'll feed in the password and now I'm connected via sftp.
So now I close this session.
Let me maximize the screen and here if you see the initial there is a key exchange.
So key exchange is basically used to exchange the secret key which will be used to encrypt the data.
And once the key has been received, all the data, which you will see, all the data is in form of
encrypted packets.
So even if you open up the strings, you will not be able to.
Find the plaintext data.
It seems someone is calling me.
I'll pick up later.
So this is all the packets which are part of sftp are in encrypted format.
So in this case, even if a user or even if an attacker is.
Watching your traffic or sniffing your traffic.
All he'll get is he'll get the packets in encrypted format.
So you will see this is the encrypted packet and he'll not be able to make out or he'll not be able
to decrypt the packet unless and until he has the secret key.
So this is the reason why having the encrypted protocols to be used is extremely important and this
is the reason why specifically in the login forms, you will find that websites are using Https, which
basically encrypts all the communication so that your login cannot be found.
So this is it.
About this lecture.
I hope this has been informative for you and I look forward to see you in the next lecture.