Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there any tool to extract cookies from network sniffs generated by tcpdump (.pcap files).

I know I can open it in wireshark but it will take a while until I find the domain I am interested into and the cookies (is there a filter I can use ?)

Thanks

share|improve this question
    
ngrep.sourceforge.net/usage.html haven't used it myself but looks it will do what you looking for –  Sachin Kumar Apr 5 '13 at 14:02
    
have you tried firesheep? –  Rook Apr 5 '13 at 15:45
add comment

2 Answers 2

It looks like you should be able to easily pull the cookies from your pcaps with Wireshark or tshark using filters based around HTTP Cookies.

You should be able to match against http.cookie as a string according to the filters protocol reference: http://www.wireshark.org/docs/dfref/h/http.html

Some more general information about filter syntax (including operators) is here: http://wiki.wireshark.org/DisplayFilters

I'd fire up Wireshark on your pcap and use Find Packet with a known string and then use the right click menus to have Wireshark craft the filter for you (as described some in the manual section 6.2.2. Pop-up menu of the "Packet List" pane at http://www.wireshark.org/docs/wsug_html_chunked/ChWorkDisplayPopUpSection.html

You can then use that filter (copy and paste) in a console with tshark to rapidly search large pcaps or script the searches trivially.

share|improve this answer
    
A tshark command that will filter on packets with cookie and display the host and cookie: tshark -r some.pcap -T fields -e http.host -e http.cookie -Y http.cookie (note: perhaps the http.host field will be empty for server-originated cookies (responses from the server)). –  Lekensteyn Apr 2 at 20:16
add comment

The best solution is probably to load the PCAP file into NetworkMiner. All cookies will be automatically extracted by NetworkMiner and displayed on the "Credentials" tab.

This has already been suggested at the Wireshark-users mailing list: http://www.wireshark.org/lists/wireshark-users/201209/msg00054.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.