Extracting Files from PCAPs with Wireshark // Lesson 9 // Wireshark Tutorial

Подписаться 133 тыс.

Просмотров 92 тыс.

50% 1

If we are doing a CTF or performing Malware analysis with Wireshark, we usually need to extract files from PCAPs at some point. In this video, we will look at how to do it.
Download the sample trace file here:
www.cloudshark.org/captures/a...
(Select Export | Download to pull the trace down locally)
Please smash the like button to let me know if you enjoy this content!
== More On-Demand Training from Chris ==
▶Getting Started with Wireshark - bit.ly/udemywireshark
▶Getting Started with Nmap - bit.ly/udemynmap
== Live Wireshark Training ==
▶TCP/IP Deep Dive Analysis with Wireshark - bit.ly/virtualwireshark
== Private Wireshark Training ==
Let's get in touch - packetpioneer.com/product/pri...

Опубликовано:

24 июл 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 91

@ChrisGreer 2 года назад

@mindiswealth Месяц назад

THANK YOU FOR MAKING THIS VIDEO. I have started my journey in CS and a job I applied to has asked me to extract a pdf file from the PCAP and this helped me so much! THANK YOU

@finance10102 Месяц назад

OMG ME TOOO!!!

@finance10102 Месяц назад

Was it Nukuo?

@mindiswealth Месяц назад

@@finance10102 YOOO YES 😂 small world man!

@IxapanI Месяц назад

@@finance10102 yes same

@mehershewon9301 Месяц назад

Did you follow this step by step and it worked?

@vyasG 2 года назад

Thank you for this lesson. Looking forward for the next one.

@morpheus_uat Год назад

short, consice, and straight to the point thanks fine lad

@workflowinmind Год назад

Just commenting to give this series more light! Amazing work once again

@ChrisGreer Год назад

Thank you! I appreciate it.

@lucascon9696 Год назад

Gave me what I was searching for in half a minute, many thanks!

@ChrisGreer Год назад

No problem!

@CAAV4252 2 года назад

Dear Chris, thank you very much for sharing your knowledge and excellent content ... keep going .. !!! Greetings from Ecuador

@ChrisGreer 2 года назад

Thanks for the comment! Ecuador is a beautiful place.

@IsometricSandwiches 5 месяцев назад

Chris, a video on TLS decryption in Wireshark would be a great addition to this playlist!

@moviesinnutshell8815 5 месяцев назад

That is above his paygrade 😂

@KSPAllies 6 месяцев назад

My guy this is absolutely what i needed shouts out to you big dog

@tfitzge134 5 месяцев назад

Hi Chris, I bought your course at Udemy and it is so awesome!

@ChrisGreer 5 месяцев назад

Awesome, thank you!

@mrjapansl 2 года назад

Looking forward to the next video

@majiddehbi9186 2 года назад

very happy to be here

@volkan8693 Год назад

Hi Chris, what if i have a compressed content and I want to uncompress the http request body? In my case I have "content-type: application/x-deflate"

@user-qb3co2jb9z 2 года назад

Thank you! Very interesting

@luckygolakoti3241 2 года назад

Sir, how can we see the data format which was traversing through packets as you have displayed images how can i enable ?

@flamshlo1 2 года назад

your lessons are FANTASTIC. have practically all of yours in my playlists. for some reason there is no SAVE provision in my wireshark version 3.63 (v3.63.-06d348e4611e2)

@ChrisGreer 2 года назад

Hey Shlomo! That is really weird. You mean you cannot save the whole file?

@baidysall9591 2 года назад

Short and sweet

@roswithadusa8673 7 месяцев назад

hello timeline 4:26 it is possible to save or copy the png part and then open it up in a pictures editor?

@ZirveAzeri 6 месяцев назад

Great teacher...

@onkarmhaskar8551 4 месяца назад

thanks sir u just saved my life!!! 😁😁😁

@ivegyattocomment Год назад

thank you for this, i have a challenge that was set up by a training provider that also provides job opportunity in cybersec... i had to extract a PDF that contains passwords and details for my next step in the programme and this video helped me lmao within 4 mins. THANK YOU CHRIS!

@saniya11229226 10 месяцев назад

Hi Chris, Any way you can help.I am on the same challenge and am confused on how to operate wire shark.

@ivegyattocomment 8 месяцев назад

@@saniya11229226did you manage?

@ivegyattocomment 8 месяцев назад

@@savagevolt4458if you follow this guide you're surely gonna find the pdf and extract it out already, will reveal next step for red alpha application process...

@dbzbattler7282 7 месяцев назад

Hey I’m doing the same thing but I’m not finding the password any tips?

@a-plusappliancerepairllc5395 Месяц назад

@dbzbattler7282 Good Morning, Did you ever figure it out?

@badrmotayeb4833 9 месяцев назад

amazing video

@MegaDiamond91 8 месяцев назад

Thank you, mate :)

@notistsimas1837 9 месяцев назад

YOU ARE A FKING LEGEND! TOOK MY 50 HOURS TO FIND YOU TRYING TO SOLVE MY ASSIGNMENT

@francypothuraju7002 11 месяцев назад

hi chris. How to extract txt and docx files from pcap file

@roswithadusa8673 7 месяцев назад

please can anybody help .I try to open (frame 14) png file from TCP flow (ascii to raw, file ,save as xxx.png)but it dont work.Why?

@nokotable Год назад

how safe it it to extract those files to your VM?

@berthold9582 Год назад

so goooood thanks

@MuhammadAbdullah-fb4wn 3 месяца назад

Hello Master , I just come up with a quick question that Is wireshark also as noisy as nmap or Not?

@ChitChat 2 года назад

How does one get into packet capture analysis? Also it appears that the Wireshark cert is not high in demand in job postings. Curious of your thoughts on that.

@jjames7206 2 года назад

Hi CHris！I alway looking for something about packet capture analysis work on with wireshark !

@ChrisGreer 2 года назад

Hello - how does one get into it? I guess several ways... if you are in netops, secops, devops, just download it, install, and get to capturing. Learn what each packet means, one at a time. Start slow and get more complex. Watch videos like these ones on my channel to get a running start, and then just do it! Certs? I had the WCNA for some time. It goes into several aspects of the analyzer that are good to know. Do you need it for a job? Probably not. I've known some amazing packet analysts that never got it.

@user-mb5sj1cx7w 7 месяцев назад

How to identify the file type and extract it from TCP payload?

@plushplush7635 2 года назад

worked, awesome

@ChrisGreer 2 года назад

Great!

@kemovlogz Год назад

Great Video Bro! Can I Get Packet Data Uploaded to RU-vid, Love To See Some Old Post that I deleted

@Dalin_B Год назад

Been following this class from the start.... Yo, I had no idea that Wireshark could do any of this.

@ChrisGreer Год назад

Glad you like it!

@comedydaddy8074 11 месяцев назад

I am about to cry. Every time I try this it keeps saying that the photo is not supported. I tried it on my actual laptop and on a VM. Agh it's not annoying I keep getting the same thing over and over.

@user-dl4cr3by2x 2 года назад

Hello Chris! When you will publish the lesson 10? Thanx!

@ChrisGreer 2 года назад

Good reminder... I need to get it out there!

@flamshlo1 2 года назад

thanks. your file for the lesson is NOT the problem. the problem is saving the "packet-pioneer-logo-blue-green-media.png" as instructed by you at 3:09 minutes into the lesson. the 2 lines are listed but there is NO save option.

@agolu16 Год назад

Thanks!

@ChrisGreer Год назад

Thank you!

@dopy8418 2 года назад

So this is the prequel to ‘decrypting https traffic’. You are going star wars on us.

@mystica-subs 2 года назад

Can you please explain this for QUIC and not just http2/3 ?

@ChrisGreer 2 года назад

ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-HnDsMehSSY4.html Have you stopped by this video yet?

@nataliaerrecalde7340 Год назад

Hi Chris, thanks for you incredible job. i need your help im trying to Decrypt SSL traffic using Wireshark and SSL key log file in macOS but im not able. could you make a video of that or if you have one can you please share it to me . cheers. naty

@nataliaerrecalde7340 Год назад

that's the answer that ive received cannot open `/Users/nxxxxxxxxe/sslkey.log' (No such file or directory)

@luckygolakoti3241 2 года назад

sir,did you provide any course for ethical hackers about wireshark in any platform like udemy....if yes please do provide link for it?

@ChrisGreer 2 года назад

Not yet - hopefully coming soon.

@erenkorcan5458 Год назад

for example i just downloaded a pdf file from a website can wireshark show this and how?

@ChrisGreer Год назад

Because it is encrypted and you might not have the decryption keys loaded into WS

@erenkorcan5458 Год назад

@@ChrisGreer ohh okay i got you, i was making some research how to get decryption keys of smthng. By the way thank you for your answer and kindness 💙🙏

@telisijohn2054 2 года назад

What does CTF stands for or what is CTF?

@ChrisGreer 2 года назад

Capture the flag

@telisijohn2054 2 года назад

@@ChrisGreer Thanks I usually see an acronym description in the documentation but I couldn’t find one for CTF even in Google search. Anyways now Thani know what it means, I will go back and see the video