Tools for extracting files from pcaps
Often in the course of investigating a compromised machine or when analyzing malware in a sandnet or honeynet, I will have a complete capture of all the network activity in a pcap file and I want to pull out any files that were downloaded by the infected machine. Unfortunately, I have not found any really good tools that allow me to full files from lots of different types of traffic. A couple of years ago, I put together a perl script that used tcptrace and the HTTP::Response perl module to pull downloaded files out of HTTP traffic, but what about other forms of traffic? FTP? SMTP? unknown TCP or UDP? whatever? My ideal tool would be able to reassemble the packets, discard headers, etc. Well, the other day I noticed a post on Darknet about Xplico that might be (at least the basis of) the magic tool I'm looking for. I'm just starting to play with it, but I figured this might be a good time to ask our readers what they use? You can send us e-mail, use the contact form, or leave a comment. Thanx in advance.
Update: 2009-08-16 00:15 GMT (jac) A huge thanx to all who wrote in, here are some of the tools you suggested.
- NetworkMiner ( thanx, Russ and Dentrasi. Just found this note on running it under wine on Linux)
- tcpxtract (suggested by John R, Chris and Doug)
- Bro (suggested by Nicholas)
- tcpflow (suggested by Ratufa and Chris)
- foremost (suggested by Chris and Doug)
- the dsniff suite (suggested by Chris and Jason)
- Chaosreader (suggested by Chris and Parveen)
- pyflag (suggested by Chris)
- tcptrace (suggested by John T)
- tcpick (suggested by Doug)
- xtract.py from npeid (suggested by anonymous)
---------------
Jim Clausing, jclausing --at-- isc dot sans dot org
LINUX Incident Response and Threat Hunting | Online | Japan Standard Time | Oct 21st - Oct 26th 2024 |
Comments
http://chaosreader.sourceforge.net/
parveen vashishtha
Aug 14th 2009
1 decade ago
However, the one I'm really hanging out for - but can't fine a solution for - is CIFS/SMB. i.e. Microsoft network file sharing. Does anyone know of an open source product that can recreate CIFS files? Hell, even getting their filenames reliably off the stream would be great.
Jason
Aug 14th 2009
1 decade ago
'NetworkMiner can also parse PCAP files for off-line analysis and to regenerate/reassemble transmitted files and certificates from PCAP files.'
You can either sniff using it (and perhaps something else for ARP Poisoning), or just feed it pcap files. It extracts a lot of information about the hosts, rather than just showing you the actual packets. Windows only, I'm afraid, but very useful. Give it a try.
http://networkminer.sourceforge.net/
Dentrasi
Aug 14th 2009
1 decade ago
http://download.netwitness.com
Check out the youtube videos too:
http://www.youtube.com/netwitness
Alex
Aug 14th 2009
1 decade ago
tcpxtract
foremost
tcpick
nsm-console
wireshark
These utilities (and others) can be found on my Security Onion LiveCD:
http://securityonion.blogspot.com/
Doug Burks
Aug 14th 2009
1 decade ago
simon
Aug 15th 2009
1 decade ago
http://pseudo-flaw.net/content/tftpgrab/
DaveHowe
Aug 17th 2009
1 decade ago
• Chaosreader
• NetworkMiner
• NetWitness Investigator
• Wireshark
• NeSA commercial program, I did not like this program
gunnerdog
Aug 18th 2009
1 decade ago