SANS ISC: Tools for extracting files from pcaps

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Often in the course of investigating a compromised machine or when analyzing malware in a sandnet or honeynet, I will have a complete capture of all the network activity in a pcap file and I want to pull out any files that were downloaded by the infected machine.  Unfortunately, I have not found any really good tools that allow me to full files from lots of different types of traffic.  A couple of years ago, I put together a perl script that used tcptrace and the HTTP::Response perl module to pull downloaded files out of HTTP traffic, but what about other forms of traffic?  FTP?  SMTP?  unknown TCP or UDP?  whatever?  My ideal tool would be able to reassemble the packets, discard headers, etc.  Well, the other day I noticed a post on Darknet about Xplico that might be (at least the basis of) the magic tool I'm looking for.  I'm just starting to play with it, but I figured this might be a good time to ask our readers what they use?  You can send us e-mail, use the contact form, or leave a comment.  Thanx in advance.

---------------
Jim Clausing, jclausing --at-- isc dot sans dot org