Threat Level: green Handler on Duty: Jim Clausing

SANS ISC: Tools for extracting files from pcaps - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Tools for extracting files from pcaps

Often in the course of investigating a compromised machine or when analyzing malware in a sandnet or honeynet, I will have a complete capture of all the network activity in a pcap file and I want to pull out any files that were downloaded by the infected machine.  Unfortunately, I have not found any really good tools that allow me to full files from lots of different types of traffic.  A couple of years ago, I put together a perl script that used tcptrace and the HTTP::Response perl module to pull downloaded files out of HTTP traffic, but what about other forms of traffic?  FTP?  SMTP?  unknown TCP or UDP?  whatever?  My ideal tool would be able to reassemble the packets, discard headers, etc.  Well, the other day I noticed a post on Darknet about Xplico that might be (at least the basis of) the magic tool I'm looking for.  I'm just starting to play with it, but I figured this might be a good time to ask our readers what they use?  You can send us e-mail, use the contact form, or leave a comment.  Thanx in advance.

---------------
Jim Clausing, jclausing --at-- isc dot sans dot org

Jim

399 Posts
ISC Handler
chaosreader is also a good tool to extract traffic from pcaps.

http://chaosreader.sourceforge.net/
Anonymous
Posts
the dsniff suite is still hard to beat - even supports capturing NFS files!

However, the one I'm really hanging out for - but can't fine a solution for - is CIFS/SMB. i.e. Microsoft network file sharing. Does anyone know of an open source product that can recreate CIFS files? Hell, even getting their filenames reliably off the stream would be great.

Jason

4 Posts Posts
The best program I've found for this is Network Miner. To quote the site:

'NetworkMiner can also parse PCAP files for off-line analysis and to regenerate/reassemble transmitted files and certificates from PCAP files.'

You can either sniff using it (and perhaps something else for ARP Poisoning), or just feed it pcap files. It extracts a lot of information about the hosts, rather than just showing you the actual packets. Windows only, I'm afraid, but very useful. Give it a try.

http://networkminer.sourceforge.net/
Anonymous
Posts
NetWitness Investigator...it can extract files and much much more.

http://download.netwitness.com

Check out the youtube videos too:

http://www.youtube.com/netwitness
Alex

1 Posts Posts
As mentioned by others, I would recommend chaosreader and dsniff. In addition, I would also recommend:
tcpxtract
foremost
tcpick
nsm-console
wireshark

These utilities (and others) can be found on my Security Onion LiveCD:
http://securityonion.blogspot.com/
Anonymous
Posts
Another tool worth mentioning is xplico, www.xplico.org
simon

1 Posts Posts
Another one I find useful - tftpgrab

http://pseudo-flaw.net/content/tftpgrab/
Anonymous
Posts
I tried these programs when I was doing an investigation and found I liked NetWitness the most. None of them created a good timeline like I wanted.

• Chaosreader
• NetworkMiner
• NetWitness Investigator
• Wireshark
• NeSA commercial program, I did not like this program
Anonymous
Posts

Sign Up for Free or Log In to start participating in the conversation!