hacktricks/forensics/basic-forensic-methodology/pcap-inspection/usb-keyboard-pcap-analysis.md
Carlos Polop aaa94e960b a
2024-02-06 04:10:27 +01:00

3 KiB

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

If you have a pcap of a USB connection with a lot of Interruptions probably it is a USB Keyboard connection.

A wireshark filter like this could be useful: usb.transfer_type == 0x01 and frame.len == 35 and !(usb.capdata == 00:00:00:00:00:00:00:00)

It could be important to know that the data that starts with "02" is pressed using shift.

You can read more information and find some scripts about how to analyse this in:

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: