Hello everyone, I currently have a pcap file that contains an unencrypted Telnet session, and when I trace the TCP stream the password is in a format like so: pas...ord (please note this is just the format not the actual password). My question is, what can I do to be able to reconstruct the password fully? Thank you for your time.
What does the hex dump say? In general, 8-bit and non-printables are printed as '.' by most viewers. Pretty much like this (just on a Linux prompt though):
And here is an example of how to decode the hex:
You might also need to figure out what encoding was used and convert it to whatever your teminal is using.