Network Forensics

A pcap remembers everything that crossed the wire. Pull the files and creds back out.

17 minforensicspcapnetwork

What you will learn

-Triage a pcap to find the conversations that matter
-Follow a TCP stream to reconstruct a full exchange
-Extract transferred files and cleartext credentials from captured traffic

A capture is a recording of the wire. Every request, every file transfer, every login that used a is sitting in that file waiting to be read. Someone captured the traffic during the , handed you a .pcap, and now the job is turning ten million packets into "here is exactly what the attacker took".

Triage before you drown

Do not scroll a pcap packet by packet. You will die of old age. Start by asking what protocols and are even in the file, then narrow to the interesting ones. tshark is Wireshark's command-line engine and it is faster for this than clicking.

analyst@workstation

# size, packet count, time range at a glance

$capinfos capture.pcap

# protocol hierarchy: what is actually in here

$tshark -r capture.pcap -q -z io,phs

# top TCP conversations by bytes, find the big transfers

$tshark -r capture.pcap -q -z conv,tcp

The protocol hierarchy tells you where to look. Ten megabytes of FTP-DATA means a file left the building. A spike of with long random subdomains is often exfiltration or command and tunneled through DNS. Follow the volume and the oddities.

Follow the stream

A single conversation is scattered across hundreds of packets in capture order. Reassembling it by hand is pointless. Wireshark's Follow TCP Stream stitches a conversation back into the two-sided dialog it actually was, bytes one color, bytes another.

In the GUI you right-click a packet and choose Follow, then TCP Stream. From the command line you filter by the stream index.

attacker@kali

$tshark -r capture.pcap -q -z follow,tcp,ascii,4

Reassemble TCP stream number 4 and print it as ASCII. You see the full request and response as one readable exchange, which is where an HTTP POST or an FTP login shows up in plain view.

Point this at an conversation and you read the exact , , and body. Point it at an FTP or Telnet session and the USER and PASS commands are right there, because those protocols never encrypted anything. This is why cleartext protocols are a gift to a forensic analyst and a liability to everyone else.

Pull the files and credentials out

Wireshark can carve transferred objects straight out of the capture. Under File, then Export Objects, it lists every file it reassembled from HTTP, , FTP, or TFTP, and you save them to disk with one click. From the command line, tshark --export-objects http,out/ does the same in bulk.

fall out of any plaintext auth. Filter for the protocols that carry them and read the values directly.

analyst@workstation

# dump every file transferred over HTTP

$tshark -r capture.pcap --export-objects http,loot/

# show every FTP password sent in the clear

$tshark -r capture.pcap -Y 'ftp.request.command == "PASS"'

# find HTTP Basic auth headers, base64 but trivial to decode

$tshark -r capture.pcap -Y 'http.authorization'

HTTP Basic auth looks encrypted because it is , but base64 is , not . Pipe the captured string through base64 -d and you have username:password in cleartext. Anyone who sees the packet sees the login.

Capture and analyze only authorized traffic

Sniffing traffic pulls in other people's private data by design. Capture and analyze pcaps only on networks you own or have explicit to monitor. Intercepting communications you were not cleared to see is a wiretap violation in many jurisdictions, engagement or not.

A pcap shows an HTTP Authorization header with a base64 value. What does that tell you about the credentials?

Exercise

You need to pull every file transferred over HTTP out of capture.pcap into a folder. Write the tshark command.

--export-objects http,loot/ reassembles every HTTP-transferred file and writes them into loot/, so you recover exactly what moved across the wire.

Memory Forensics Building a Timeline

Triage before you drown

analyst@workstation

# size, packet count, time range at a glance

$capinfos capture.pcap

# protocol hierarchy: what is actually in here

$tshark -r capture.pcap -q -z io,phs

# top TCP conversations by bytes, find the big transfers

$tshark -r capture.pcap -q -z conv,tcp

Follow the stream

In the GUI you right-click a packet and choose Follow, then TCP Stream. From the command line you filter by the stream index.

attacker@kali

$tshark -r capture.pcap -q -z follow,tcp,ascii,4

Reassemble TCP stream number 4 and print it as ASCII. You see the full request and response as one readable exchange, which is where an HTTP POST or an FTP login shows up in plain view.

Pull the files and credentials out

fall out of any plaintext auth. Filter for the protocols that carry them and read the values directly.

analyst@workstation

# dump every file transferred over HTTP

$tshark -r capture.pcap --export-objects http,loot/

# show every FTP password sent in the clear

$tshark -r capture.pcap -Y 'ftp.request.command == "PASS"'

# find HTTP Basic auth headers, base64 but trivial to decode

$tshark -r capture.pcap -Y 'http.authorization'

Capture and analyze only authorized traffic

A pcap shows an HTTP Authorization header with a base64 value. What does that tell you about the credentials?

Exercise

You need to pull every file transferred over HTTP out of capture.pcap into a folder. Write the tshark command.

--export-objects http,loot/ reassembles every HTTP-transferred file and writes them into loot/, so you recover exactly what moved across the wire.