Shark Fest17 US Analyzing Exploit Kit Traffic with

  • Slides: 80
Download presentation
Shark. Fest'17 US Analyzing Exploit Kit Traffic with Wireshark Analyzing Malicious Traffic with Wireshark

Shark. Fest'17 US Analyzing Exploit Kit Traffic with Wireshark Analyzing Malicious Traffic with Wireshark Bradley Duncan Threat Intelligence Analyst | Palo Alto Networks Unit 42 Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WHY THE CHANGE? • Traditional campaigns using exploit kits were relatively easy to find.

WHY THE CHANGE? • Traditional campaigns using exploit kits were relatively easy to find. Compromised website Exploit kit server Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WHY THE CHANGE? Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

WHY THE CHANGE? Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WHY THE CHANGE? • Now, generally malvertising leads to exploit kits AD Normal website

WHY THE CHANGE? • Now, generally malvertising leads to exploit kits AD Normal website GATES Exploit kit server Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

INTRODUCTION @malware_traffic Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

INTRODUCTION @malware_traffic Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

OVERVIEW • Wireshark setup • Find traffic based on an IDS alert • Find

OVERVIEW • Wireshark setup • Find traffic based on an IDS alert • Find root cause after post-infection alerts • Example of exploit kit traffic Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

PCAPS ONLINE AT: • http: //www. malware-traffic-analysis. net/2017/06/01/ 2017 -06 -01 -Shark. Fest-pcap-for-lab-by-Duncan 01.

PCAPS ONLINE AT: • http: //www. malware-traffic-analysis. net/2017/06/01/ 2017 -06 -01 -Shark. Fest-pcap-for-lab-by-Duncan 01. pcap. zip • http: //www. malware-traffic-analysis. net/2017/06/01/ 2017 -06 -01 -Shark. Fest-pcap-for-lab-by-Duncan 02. pcap. zip • http: //www. malware-traffic-analysis. net/2017/06/01/ 2017 -06 -01 -Shark. Fest-pcap-for-lab-by-Duncan. Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Default column display not ideal for HTTP traffic Shark. Fest'17 US

WIRESHARK SETUP • Default column display not ideal for HTTP traffic Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Time display to UTC Shark. Fest'17 US • Carnegie Mellon University

WIRESHARK SETUP • Time display to UTC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Hide or remove the colums you don't need. Shark. Fest'17 US

WIRESHARK SETUP • Hide or remove the colums you don't need. Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Go to Column Preferences Shark. Fest'17 US • Carnegie Mellon University

WIRESHARK SETUP • Go to Column Preferences Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Go to Column Preferences Shark. Fest'17 US • Carnegie Mellon University

WIRESHARK SETUP • Go to Column Preferences Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Adding a column Shark. Fest'17 US • Carnegie Mellon University •

WIRESHARK SETUP • Adding a column Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Adding a column Shark. Fest'17 US • Carnegie Mellon University •

WIRESHARK SETUP • Adding a column Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Adding a column Shark. Fest'17 US • Carnegie Mellon University •

WIRESHARK SETUP • Adding a column Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Adding a column Shark. Fest'17 US • Carnegie Mellon University •

WIRESHARK SETUP • Adding a column Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Adding a column Shark. Fest'17 US • Carnegie Mellon University •

WIRESHARK SETUP • Adding a column Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Adding a column Shark. Fest'17 US • Carnegie Mellon University •

WIRESHARK SETUP • Adding a column Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Aligning the columns Shark. Fest'17 US • Carnegie Mellon University •

WIRESHARK SETUP • Aligning the columns Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

WIRESHARK SETUP • Time Source IP Source port Destination IP • Destination port HTTP

WIRESHARK SETUP • Time Source IP Source port Destination IP • Destination port HTTP host Info Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

UP NEXT. . . • Wireshark setup • Find traffic based on an IDS

UP NEXT. . . • Wireshark setup • Find traffic based on an IDS alert • Find root cause after post-infection alerts • Example of exploit kit traffic Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT • Initial alerts on the first pcap show a JS or

FROM IDS ALERT • Initial alerts on the first pcap show a JS or WSF downloader Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT • http. request and tcp. port eq 49216 Shark. Fest'17 US

FROM IDS ALERT • http. request and tcp. port eq 49216 Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

FROM IDS ALERT Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

UP NEXT. . . • Wireshark setup • Find traffic based on an IDS

UP NEXT. . . • Wireshark setup • Find traffic based on an IDS alert • Find root cause after post-infection alert • Example of exploit kit traffic Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION • Alerts for Fareit/Pony, Terdot. A/Zloader, and Tor Shark. Fest'17

ROOT CAUSE AFTER POSTINFECTION • Alerts for Fareit/Pony, Terdot. A/Zloader, and Tor Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION • Filter: http. request and ip. addr eq 178. 170.

ROOT CAUSE AFTER POSTINFECTION • Filter: http. request and ip. addr eq 178. 170. 180. 193 Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION • Filter: http. request and ip. addr eq 176. 99.

ROOT CAUSE AFTER POSTINFECTION • Filter: http. request and ip. addr eq 176. 99. 7. 225 Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION Domains from the alerts • nyatguted. com • soevenghappar. ru

ROOT CAUSE AFTER POSTINFECTION Domains from the alerts • nyatguted. com • soevenghappar. ru Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION "nyatguted. com" and site: malwr. com Shark. Fest'17 US •

ROOT CAUSE AFTER POSTINFECTION "nyatguted. com" and site: malwr. com Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POST"nyatguted. com"INFECTION and site: hybrid-analysis. com Shark. Fest'17 US • Carnegie

ROOT CAUSE AFTER POST"nyatguted. com"INFECTION and site: hybrid-analysis. com Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION • Filter: ssl. handshake. extensions_server_name Shark. Fest'17 US • Carnegie

ROOT CAUSE AFTER POSTINFECTION • Filter: ssl. handshake. extensions_server_name Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION http. request or ssl. handshake. extensions_server_ name Shark. Fest'17 US

ROOT CAUSE AFTER POSTINFECTION http. request or ssl. handshake. extensions_server_ name Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19

ROOT CAUSE AFTER POSTINFECTION Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

UP NEXT. . . • Wireshark setup • Find traffic based on an IDS

UP NEXT. . . • Wireshark setup • Find traffic based on an IDS alert • Find root cause after post-infection alert • Example of exploit kit traffic Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC • Rig EK is often easiest to replicate. • EKs are

EXPLOIT KIT TRAFFIC • Rig EK is often easiest to replicate. • EKs are evolving. • Rig EK URL patterns changed last week on June 12 th or June 13 th. Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC • Post-infection alerts Shark. Fest'17 US • Carnegie Mellon University •

EXPLOIT KIT TRAFFIC • Post-infection alerts Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC http. request and ip. addr eq 185. 158. 153. 204 Shark.

EXPLOIT KIT TRAFFIC http. request and ip. addr eq 185. 158. 153. 204 Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC • Flow of events from the EK domain: Landing page exploit

EXPLOIT KIT TRAFFIC • Flow of events from the EK domain: Landing page exploit payload Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC • Flow of events from the EK domain: Landing page &

EXPLOIT KIT TRAFFIC • Flow of events from the EK domain: Landing page & IE exploit payload Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC (http. request or http. response) and ip. addr eq 185. 158.

EXPLOIT KIT TRAFFIC (http. request or http. response) and ip. addr eq 185. 158. 153. 204 Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC • File Export Objects HTTP Shark. Fest'17 US • Carnegie Mellon

EXPLOIT KIT TRAFFIC • File Export Objects HTTP Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC (http. request or http. response) and ip. addr eq 185. 158.

EXPLOIT KIT TRAFFIC (http. request or http. response) and ip. addr eq 185. 158. 153. 204 Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC • File Export Objects HTTP Shark. Fest'17 US • Carnegie Mellon

EXPLOIT KIT TRAFFIC • File Export Objects HTTP Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC • Example from Tuesday 2017 -06 -20: Shark. Fest'17 US •

EXPLOIT KIT TRAFFIC • Example from Tuesday 2017 -06 -20: Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC • Example from yesterday on 2017 -06 -20 Shark. Fest'17 US

EXPLOIT KIT TRAFFIC • Example from yesterday on 2017 -06 -20 Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC (http. request or http. response) and ip. addr eq 185. 158.

EXPLOIT KIT TRAFFIC (http. request or http. response) and ip. addr eq 185. 158. 153. 204 Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC ip contains red. troy. systems Shark. Fest'17 US • Carnegie Mellon

EXPLOIT KIT TRAFFIC ip contains red. troy. systems Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22,

EXPLOIT KIT TRAFFIC Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

SUMMARY • Wireshark setup • Find traffic based on an IDS alert • Find

SUMMARY • Wireshark setup • Find traffic based on an IDS alert • Find root cause after post-infection alerts • Example of exploit kit traffic Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

Shark. Fest'17 US Analyzing Exploit Kit Traffic with Wireshark Analyzing Malicious Traffic with Wireshark

Shark. Fest'17 US Analyzing Exploit Kit Traffic with Wireshark Analyzing Malicious Traffic with Wireshark Bradley Duncan Threat Intelligence Analyst | Palo Alto Networks Unit 42 Shark. Fest'17 US • Carnegie Mellon University • June 19 -22, 2017

Related presentations

Pleskwin exploitPleskwin exploit
Hammerhead shark vs great white shark sizeHammerhead shark vs great white shark size
Inbound traffic vs outbound trafficInbound traffic vs outbound traffic
All traffic solutions traffic cloudAll traffic solutions traffic cloud
Format string vulnerabilityFormat string vulnerability
Osvdb-3268 exploitOsvdb-3268 exploit
ParallelismParallelism
Policy non-compliance: exploit detectionPolicy non-compliance: exploit detection
Lotus domino securityLotus domino security
SshSsh
Awstats exploitAwstats exploit
Intrusion.win.iis.unicode.a.exploitIntrusion.win.iis.unicode.a.exploit
Dropbox lan sync discovery protocolDropbox lan sync discovery protocol
Nelson model behavior Nelson model behavior "torrent"
Printenv.pl exploitPrintenv.pl exploit
Those who know their god will do exploitThose who know their god will do exploit
Gobbles exploitGobbles exploit
Bob websiteBob website
Millhouse-project exploitMillhouse-project exploit
Exploit.in combo listExploit.in combo list
Xkcd 327Xkcd 327
Unix cal command exploitUnix cal command exploit
Ani exploitAni exploit
Tornadoserver exploitTornadoserver exploit
Pbx exploitPbx exploit
_vti_bin/_vti_adm/admin.dll exploit_vti_bin/_vti_adm/admin.dll exploit
Mara cms exploitMara cms exploit
Mssql exploitMssql exploit
Rom 0 vulnerabilityRom 0 vulnerability
AutowuAutowu
Ms09-001 metasploitMs09-001 metasploit
Gobbles exploitGobbles exploit
Void exploitVoid exploit
Iweb exploitIweb exploit
Find-fix-finish-exploit-analyze targeting modelFind-fix-finish-exploit-analyze targeting model
Horse dichotomous keyHorse dichotomous key
Simile nounSimile noun
Great white sharkGreat white shark
ZeppelinhubZeppelinhub
Shark classShark class
The clouds smiled down at meThe clouds smiled down at me
BiosphereBiosphere
Meredith sandersMeredith sanders
Ravenous and savage from its long polar journeyRavenous and savage from its long polar journey
Great white shark vs grizzly bearGreat white shark vs grizzly bear
Shark vs trexShark vs trex
SharksSharks
Nancy oconnorNancy oconnor
She has a skeleton in her closet figurative languageShe has a skeleton in her closet figurative language
Basking shark skeletonBasking shark skeleton
CladisticsCladistics
Owl conflict styleOwl conflict style
Watson and the shark analysisWatson and the shark analysis
Understatement examplesUnderstatement examples
Shark distributingShark distributing
Aunt julia annotated poemAunt julia annotated poem
Think acrosticThink acrostic
Frilled shark geological eraFrilled shark geological era
Shark fin etco2 waveformShark fin etco2 waveform
Sharks phylumSharks phylum
Tiger shark outlineTiger shark outline
Joseph dunn shark attackJoseph dunn shark attack
Circle of security shark musicCircle of security shark music
Sharks body shapeSharks body shape
Shark similesShark similes
Life of pi chapter 86 summaryLife of pi chapter 86 summary
Basking shark annotatedBasking shark annotated
Barberfish and hammerhead shark relationshipBarberfish and hammerhead shark relationship
Hyperbole exmaplesHyperbole exmaples
Shark fin etco2 waveformShark fin etco2 waveform
I'd rather take baths with a man-eating sharkI'd rather take baths with a man-eating shark
Basking shark poemBasking shark poem
Predator ecologyPredator ecology
Elephant sharkElephant shark
SharkShark
TcpsharkTcpshark
I'd rather take baths with a man-eating sharkI'd rather take baths with a man-eating shark
Basking shark annotatedBasking shark annotated
What kingdom do sharks belong toWhat kingdom do sharks belong to
Dogfish shark internal anatomyDogfish shark internal anatomy
Turtle shark teddy bear fox owl testTurtle shark teddy bear fox owl test