Extracting Files from PCAPs with Wireshark // Lesson 9 // Wireshark Tutorial
HTML-код
- Опубликовано: 15 июл 2024
- If we are doing a CTF or performing Malware analysis with Wireshark, we usually need to extract files from PCAPs at some point. In this video, we will look at how to do it.
Download the sample trace file here:
www.cloudshark.org/captures/a...
(Select Export | Download to pull the trace down locally)
Please smash the like button to let me know if you enjoy this content!
== More On-Demand Training from Chris ==
▶Getting Started with Wireshark - bit.ly/udemywireshark
▶Getting Started with Nmap - bit.ly/udemynmap
== Live Wireshark Training ==
▶TCP/IP Deep Dive Analysis with Wireshark - bit.ly/virtualwireshark
== Private Wireshark Training ==
Let's get in touch - packetpioneer.com/product/pri...
If we are doing a CTF or performing Malware analysis with Wireshark, we usually need to extract files from PCAPs at some point. In this video, we will look at how to do it.
Download the sample trace file here:
www.cloudshark.org/captures/a9472fbe700a
(Select Export | Download to pull the trace down locally)
THANK YOU FOR MAKING THIS VIDEO. I have started my journey in CS and a job I applied to has asked me to extract a pdf file from the PCAP and this helped me so much! THANK YOU
OMG ME TOOO!!!
Was it Nukuo?
@@finance10102 YOOO YES 😂 small world man!
@@finance10102 yes same
Did you follow this step by step and it worked?
Thank you for this lesson. Looking forward for the next one.
short, consice, and straight to the point
thanks fine lad
Gave me what I was searching for in half a minute, many thanks!
No problem!
Just commenting to give this series more light! Amazing work once again
Thank you! I appreciate it.
My guy this is absolutely what i needed shouts out to you big dog
very happy to be here
Looking forward to the next video
Dear Chris, thank you very much for sharing your knowledge and excellent content ... keep going .. !!! Greetings from Ecuador
Thanks for the comment! Ecuador is a beautiful place.
Thank you! Very interesting
Short and sweet
Great teacher...
Hi Chris, I bought your course at Udemy and it is so awesome!
Awesome, thank you!
amazing video
thanks sir u just saved my life!!!
😁😁😁
so goooood thanks
Thank you, mate :)
Chris, a video on TLS decryption in Wireshark would be a great addition to this playlist!
That is above his paygrade 😂
YOU ARE A FKING LEGEND!
TOOK MY 50 HOURS TO FIND YOU TRYING TO SOLVE MY ASSIGNMENT
worked, awesome
Great!
Thanks!
Thank you!
your lessons are FANTASTIC. have practically all of yours in my playlists. for some reason there is no SAVE provision in my wireshark version 3.63 (v3.63.-06d348e4611e2)
Hey Shlomo! That is really weird. You mean you cannot save the whole file?
Hi Chris, what if i have a compressed content and I want to uncompress the http request body? In my case I have "content-type: application/x-deflate"
How does one get into packet capture analysis? Also it appears that the Wireshark cert is not high in demand in job postings. Curious of your thoughts on that.
Hi CHris！I alway looking for something about packet capture analysis work on with wireshark !
Hello - how does one get into it? I guess several ways... if you are in netops, secops, devops, just download it, install, and get to capturing. Learn what each packet means, one at a time. Start slow and get more complex. Watch videos like these ones on my channel to get a running start, and then just do it!
Certs? I had the WCNA for some time. It goes into several aspects of the analyzer that are good to know. Do you need it for a job? Probably not. I've known some amazing packet analysts that never got it.
Sir, how can we see the data format which was traversing through packets as you have displayed images how can i enable ?
Been following this class from the start.... Yo, I had no idea that Wireshark could do any of this.
Glad you like it!
thank you for this, i have a challenge that was set up by a training provider that also provides job opportunity in cybersec... i had to extract a PDF that contains passwords and details for my next step in the programme and this video helped me lmao within 4 mins. THANK YOU CHRIS!
Hi Chris, Any way you can help.I am on the same challenge and am confused on how to operate wire shark.
@@saniya11229226did you manage?
@@savagevolt4458if you follow this guide you're surely gonna find the pdf and extract it out already, will reveal next step for red alpha application process...
Hey I’m doing the same thing but I’m not finding the password any tips?
@dbzbattler7282 Good Morning, Did you ever figure it out?
Great Video Bro! Can I Get Packet Data Uploaded to RUclips, Love To See Some Old Post that I deleted
So this is the prequel to ‘decrypting https traffic’. You are going star wars on us.
hello timeline 4:26 it is possible to save or copy the png part and then open it up in a pictures editor?
Hello Master , I just come up with a quick question that Is wireshark also as noisy as nmap or Not?
hi chris. How to extract txt and docx files from pcap file
how safe it it to extract those files to your VM?
Hello Chris! When you will publish the lesson 10? Thanx!
Good reminder... I need to get it out there!
How to identify the file type and extract it from TCP payload?
please can anybody help .I try to open (frame 14) png file from TCP flow (ascii to raw, file ,save as xxx.png)but it dont work.Why?
Hi Chris, thanks for you incredible job. i need your help im trying to Decrypt SSL traffic using Wireshark and SSL key log file in macOS but im not able. could you make a video of that or if you have one can you please share it to me . cheers. naty
that's the answer that ive received cannot open `/Users/nxxxxxxxxe/sslkey.log' (No such file or directory)
Can you please explain this for QUIC and not just http2/3 ?
ruclips.net/video/HnDsMehSSY4/видео.html Have you stopped by this video yet?
thanks. your file for the lesson is NOT the problem. the problem is saving the "packet-pioneer-logo-blue-green-media.png" as instructed by you at 3:09 minutes into the lesson. the 2 lines are listed but there is NO save option.
I am about to cry. Every time I try this it keeps saying that the photo is not supported. I tried it on my actual laptop and on a VM. Agh it's not annoying I keep getting the same thing over and over.
sir,did you provide any course for ethical hackers about wireshark in any platform like udemy....if yes please do provide link for it?
Not yet - hopefully coming soon.
Robin Williams does Wireshark
So you aren’t the first person to say that…. Really? You guys think I look like Robin Williams?
for example i just downloaded a pdf file from a website can wireshark show this and how?
Because it is encrypted and you might not have the decryption keys loaded into WS
@@ChrisGreer ohh okay i got you, i was making some research how to get decryption keys of smthng. By the way thank you for your answer and kindness 💙🙏
didn't know that Flea from rhcp also coding
What does CTF stands for or what is CTF?
Capture the flag
@@ChrisGreer Thanks I usually see an acronym description in the documentation but I couldn’t find one for CTF even in Google search. Anyways now Thani know what it means, I will go back and see the video
why we can just extract files from http traffic why not https
https is encrypted and designed in a way that wireshark can't pick it up.
@@lilmamagc 👌
Get to the point .