Extracting Files from PCAPs with Wireshark // Lesson 9 // Wireshark Tutorial

[@ChrisGreer]

If we are doing a CTF or performing Malware analysis with Wireshark, we usually need to extract files from PCAPs at some point. In this video, we will look at how to do it. Download the sample trace file here: www.cloudshark.org/captures/a9472fbe700a (Select Export | Download to pull the trace down locally)

[@mindiswealth]

THANK YOU FOR MAKING THIS VIDEO. I have started my journey in CS and a job I applied to has asked me to extract a pdf file from the PCAP and this helped me so much! THANK YOU

[@finance10102]

OMG ME TOOO!!!

[@finance10102]

Was it Nukuo?

[@mindiswealth]

@@finance10102 YOOO YES 😂 small world man!

[@IxapanI]

@@finance10102 yes same

[@mehershewon9301]

Did you follow this step by step and it worked?

[@CAAV4252]

Dear Chris, thank you very much for sharing your knowledge and excellent content ... keep going .. !!! Greetings from Ecuador

[@ChrisGreer]

Thanks for the comment! Ecuador is a beautiful place.

[@vyasG]

Thank you for this lesson. Looking forward for the next one.

[@IsometricSandwiches]

Chris, a video on TLS decryption in Wireshark would be a great addition to this playlist!

[@moviesinnutshell8815]

That is above his paygrade 😂

[@notistsimas1837]

YOU ARE A FKING LEGEND! TOOK MY 50 HOURS TO FIND YOU TRYING TO SOLVE MY ASSIGNMENT

[@flamshlo1]

your lessons are FANTASTIC. have practically all of yours in my playlists. for some reason there is no SAVE provision in my wireshark version 3.63 (v3.63.-06d348e4611e2)

[@ChrisGreer]

Hey Shlomo! That is really weird. You mean you cannot save the whole file?

[@majiddehbi9186]

very happy to be here

[@mrjapansl]

Looking forward to the next video

[@onkarmhaskar8551]

thanks sir u just saved my life!!! 😁😁😁

[@comedydaddy8074]

I am about to cry. Every time I try this it keeps saying that the photo is not supported. I tried it on my actual laptop and on a VM. Agh it's not annoying I keep getting the same thing over and over.

[@ChitChat]

How does one get into packet capture analysis? Also it appears that the Wireshark cert is not high in demand in job postings. Curious of your thoughts on that.

[@jjames7206]

Hi CHris！I alway looking for something about packet capture analysis work on with wireshark !

[@ChrisGreer]

Hello - how does one get into it? I guess several ways... if you are in netops, secops, devops, just download it, install, and get to capturing. Learn what each packet means, one at a time. Start slow and get more complex. Watch videos like these ones on my channel to get a running start, and then just do it! Certs? I had the WCNA for some time. It goes into several aspects of the analyzer that are good to know. Do you need it for a job? Probably not. I've known some amazing packet analysts that never got it.

[@ZirveAzeri]

Great teacher...

[@雨緑-q4t]

Thank you! Very interesting

[@baidysall9591]

Short and sweet

[@dopy8418]

So this is the prequel to ‘decrypting https traffic’. You are going star wars on us.

[@MuhammadAbdullah-fb4wn]

Hello Master , I just come up with a quick question that Is wireshark also as noisy as nmap or Not?

[@luckygolakoti3241]

Sir, how can we see the data format which was traversing through packets as you have displayed images how can i enable ?

[@flamshlo1]

thanks. your file for the lesson is NOT the problem. the problem is saving the "packet-pioneer-logo-blue-green-media.png" as instructed by you at 3:09 minutes into the lesson. the 2 lines are listed but there is NO save option.

[@Pentestercoe]

How to identify the file type and extract it from TCP payload?

[@ΔΙΟΝΥΣΗΣΖΑΠΑΝΤΗΣ]

Hello Chris! When you will publish the lesson 10? Thanx!

[@ChrisGreer]

Good reminder... I need to get it out there!

[@badrmotayeb4833]

amazing video

[@roswithadusa8673]

hello timeline 4:26 it is possible to save or copy the png part and then open it up in a pictures editor?

[@kemovlogz]

Great Video Bro! Can I Get Packet Data Uploaded to KZbin, Love To See Some Old Post that I deleted

[@roswithadusa8673]

please can anybody help .I try to open (frame 14) png file from TCP flow (ascii to raw, file ,save as xxx.png)but it dont work.Why?

[@volkan8693]

Hi Chris, what if i have a compressed content and I want to uncompress the http request body? In my case I have "content-type: application/x-deflate"

[@francypothuraju7002]

hi chris. How to extract txt and docx files from pcap file

[@nokotable]

how safe it it to extract those files to your VM?

[@berthold9582]

so goooood thanks

[@JasperFay-t1g]

Georgianna Stravenue

[@mystica-subs]

Can you please explain this for QUIC and not just http2/3 ?

[@ChrisGreer]

kzbin.info/www/bejne/fp-npICbnbiGj5Y Have you stopped by this video yet?

[@plushplush7635]

worked, awesome

[@ChrisGreer]

Great!

[@agolu16]

Thanks!

[@ChrisGreer]

Thank you!

[@luckygolakoti3241]

sir,did you provide any course for ethical hackers about wireshark in any platform like udemy....if yes please do provide link for it?

[@ChrisGreer]

Not yet - hopefully coming soon.

[@nataliaerrecalde7340]

Hi Chris, thanks for you incredible job. i need your help im trying to Decrypt SSL traffic using Wireshark and SSL key log file in macOS but im not able. could you make a video of that or if you have one can you please share it to me . cheers. naty

[@nataliaerrecalde7340]

that's the answer that ive received cannot open `/Users/nxxxxxxxxe/sslkey.log' (No such file or directory)

[@kahdajufaizal9337]

Robin Williams does Wireshark

[@ChrisGreer]

So you aren’t the first person to say that…. Really? You guys think I look like Robin Williams?

[@erenkorcan5458]

why we can just extract files from http traffic why not https

[@lilmamagc]

https is encrypted and designed in a way that wireshark can't pick it up.

[@erenkorcan5458]

@@lilmamagc 👌

[@BorisMatric]

Taylor Brian Rodriguez Betty Garcia Jeffrey

[@morpheus_uat]

short, consice, and straight to the point thanks fine lad

[@_a2life_]

didn't know that Flea from rhcp also coding

[@lucascon9696]

Gave me what I was searching for in half a minute, many thanks!

[@ChrisGreer]

No problem!

[@Dalin_B]

Been following this class from the start.... Yo, I had no idea that Wireshark could do any of this.

[@ChrisGreer]

Glad you like it!

[@tfitzge134]

Hi Chris, I bought your course at Udemy and it is so awesome!

[@ChrisGreer]

Awesome, thank you!

[@workflowinmind]

Just commenting to give this series more light! Amazing work once again

[@ChrisGreer]

Thank you! I appreciate it.

[@KSPAllies]

My guy this is absolutely what i needed shouts out to you big dog

[@MegaDiamond91]

Thank you, mate :)

[@rdh9475]

Get to the point .

[@erenkorcan5458]

for example i just downloaded a pdf file from a website can wireshark show this and how?

[@ChrisGreer]

Because it is encrypted and you might not have the decryption keys loaded into WS

[@erenkorcan5458]

@@ChrisGreer ohh okay i got you, i was making some research how to get decryption keys of smthng. By the way thank you for your answer and kindness 💙🙏

[@telisijohn2054]

What does CTF stands for or what is CTF?

[@ChrisGreer]

Capture the flag

[@telisijohn2054]

@@ChrisGreer Thanks I usually see an acronym description in the documentation but I couldn’t find one for CTF even in Google search. Anyways now Thani know what it means, I will go back and see the video

[@ivegyattocomment]

thank you for this, i have a challenge that was set up by a training provider that also provides job opportunity in cybersec... i had to extract a PDF that contains passwords and details for my next step in the programme and this video helped me lmao within 4 mins. THANK YOU CHRIS!

[@saniya11229226]

Hi Chris, Any way you can help.I am on the same challenge and am confused on how to operate wire shark.

[@ivegyattocomment]

​@@saniya11229226did you manage?

[@ivegyattocomment]

​@@savagevolt4458if you follow this guide you're surely gonna find the pdf and extract it out already, will reveal next step for red alpha application process...

[@dbzbattler7282]

Hey I’m doing the same thing but I’m not finding the password any tips?

[@a-plusappliancerepairllc5395]

​@dbzbattler7282 Good Morning, Did you ever figure it out?