Re: extraction of files from SSL and TCP streams automatically

[Peter Wu <peter () lekensteyn nl>]

On Tue, May 08, 2018 at 08:45:55AM +0000, Miroslav Rovis wrote:
> So when did Wireshark/Tshark get the ability to extract objects from streams?

Wireshark has this feature since 2007 as far as I can see. Tshark only
recently gained this feature (in 2.4 as I said).

> So what would be the commands to issue, then, on the trace that I offered, and
> which my stream-cont.pl on streams produced from that trace with my
> tshark-streams.sh, extracted all the files out from, as I show on that
> explanation page of mine at:
>
> https://www.croatiafidelis.hr/foss/cap/cap-180505-schmoog-referendum/

Without reading the whole thing, this tshark command sets the TLS key
log file, reads the pcap, hides dissection output and saves extracted
HTTP objects to the "files" directory.

    tshark -ossl.keylog_file:dump_180505_0342_gdO_SSLKEYLOGFILE.txt \
        -r dump_180505_0342_gdO.pcap -q --export-object http,files/

The result is 53 files.
-- 
Kind regards,
Peter Wu
https://lekensteyn.nl
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe