Unit 7: Reading captures in Wireshark · Lesson 5 of 6 · 18 min
Exporting files from a capture
Pull transferred files out of HTTP traffic, hash them and hand them over as evidence.
mission
- You are
- The analyst preserving evidence.
- Situation
- Anything sent over plain HTTP can be rebuilt from a capture: pages, downloads, even form submissions. Incident handlers want the files, with hashes.
- Goal
- Export every HTTP object from http.pcap and record a hash for each.
- Hand in
- The number of exported objects and the hash of the dashboard page.
From capture to evidence
- Capturehash the pcap first
- Export--export-objects http
- Identifyfile, read as text
- Hashsha256sum every object
- Hand overfiles, hashes, command
Export the objects
--export-objects http,DIR writes every HTTP body it can rebuild into DIR. In Wireshark: File, Export Objects, HTTP.
mkdir -p ~/objects && tshark -r http.pcap -q --export-objects http,/home/analyst/objects && ls ~/objects
dashboard
login
login(1)
you should see Three objects. login(1) is the second body seen for /login.
Look inside without running anything
Read exported files as text, never open them in a browser or run them.
cat ~/objects/dashboard <h1>Dashboard</h1> cat ~/objects/login\(1\) username=jlee&password=Lab-Only-Pass-99!
you should see The second login object is the form the browser submitted: the credentials themselves.
defender tip Treat exports from a real incident as hostile. Work on them in an isolated machine, and use file and hashes before anything else.
Hash for the record
A SHA-256 hash proves later that the file you analysed is the one you exported.
sha256sum ~/objects/*
49541366dff30426ac3e1879faee9358640e6d24f844ba9ffc0037b60617d00f /home/analyst/objects/dashboard
6300360d6c38252799f5e1c055a7f3614ffffc348dbff2bcca36298d14958608 /home/analyst/objects/login
a5af6acb2d18db1a587bd0225df10e515f396aca247f526df2ca909b232d93fe /home/analyst/objects/login(1)
Evidence notes
exported some files from the capture
Nobody can check or repeat it.
source: http.pcap (sha256 ...) command: tshark --export-objects http,objects dashboard 4954136... login(1) a5af6ac... contains credentials
Repeatable and verifiable by anyone.
Check types and sizes before exporting
The server's headers say what each response claims to be. Compare that with what you export.
tshark -r http.pcap -Y http.response -T fields -e http.content_type -e http.content_length
text/html 43
0
text/html 19
you should see Two small HTML pages and one empty redirect.
What a defender takes away
- 1Plain HTTP transfers can be rebuilt from a capture, including uploads.
- 2Read exports as text and hash them before anything else.
- 3Record the source file, the command and the hashes together.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.