It’s time to extract files from pcaps. If you ever played with packet captures you probably thought it would be cool that you could actually get downloaded files so let’s see not only one way to do this, but four!
1. Wireshark: http export
You can find this at File > Export > Objects > Http, you will be presented with a list of files found in all the http requests. The bad thing about this feature is that even with the latest version (1.6.5 at the time of this writing) you still can’t sort by column or apply any filters which makes finding something specific hard.
2. Wireshark: export bytes
To find this you will have to drill down in the packet you want, depending on the protocol.
Right click > Export selected bytes
The advantage of doing it this way is that you can actually extract files from other protocols other than http (like ftp or smb) and you can use display filters.
Thanks, I was unaware of “chaosreader” and I’m always looking for good command line tools.