hacktricks/forensics/pcaps-analysis

Pcaps analysis

Start searching for malware inside the pcap. Use the tools mentioned in Malware Analysis.

A note about PCAP vs PCAPNG: there are two versions of the PCAP file format; PCAPNG is newer and not supported by all tools. You may need to convert a file from PCAPNG to PCAP using Wireshark or another compatible tool, in order to work with it in some other tools.

Online tools for pcaps

• If the header of your pcap is broken you should try to fix it using: http://f00l.de/hacking/pcapfix.php****
• Extract information and search for malware inside a pcap in PacketTotal****
• Search for malicious activity using www.virustotal.com and www.hybrid-analysis.com****

Basic Statistics

Capinfos

capinfos capture.pcap

Wireshark

Inside wireshark you can see different statistics that could be useful. Some interesting http filters: https://www.wireshark.org/docs/dfref/h/http.html

If you want to search for content inside the packets of the sessions press CTRL+f
You can add new layers to the main information bar (No., Time, Source...) pressing right bottom and Edit Column

Practice: https://www.malware-traffic-analysis.net/

You can find more Wireshark trick in:

{% page-ref page="wireshark-tricks.md" %}

Suricata

Install and setup

apt-get install suricata
apt-get install oinkmaster
echo "url = http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz" >> /etc/oinkmaster.conf
oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules

Check pcap

suricata -r packets.pcap -c /etc/suricata/suricata.yaml -k none -v -l log

Ngrep

If you are looking for something inside the pcap you can use ngrep. And example using the main filters:

ngrep -I packets.pcap "^GET" "port 80 and tcp and host 192.168 and dst host 192.168 and src host 192.168"

Xplico Framework

Xplico can analyze a pcap and extract information from it. For example, from a pcap file Xplico extracts each email POP, IMAP, and SMTP protocols, all HTTP contents, each VoIP call SIP, FTP, TFTP, and so on.

Install

sudo bash -c 'echo "deb http://repo.xplico.org/ $(lsb_release -s -c) main" /etc/apt/sources.list'
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 791C25CE
sudo apt-get update
sudo apt-get install xplico

Run

/etc/init.d/apache2 restart
/etc/init.d/xplico start

Access to 127.0.0.1:9876 with credentials xplico:xplico

Then create a new case, create a new session inside the case and upload the pcap file.

NetworkMiner

Like Xplico it is a tool to analyze and extract objects from pcaps. It has a free edition that you can download here.

Other pcap analysis tricks

• DNSCat pcap analysis
• USB Keyboard pcap analysis