Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Hello everyone, I currently have a pcap file that contains an unencrypted Telnet session, and when I trace the TCP stream the password is in a format like so: pas...ord (please note this is just the format not the actual password). My question is, what can I do to be able to reconstruct the password fully? Thank you for your time.

share|improve this question
1  
Have you tried another capture to see if the same thing happens. You may just have a corrupt capture... –  Rory Alsop Oct 8 '13 at 14:20

1 Answer 1

up vote 2 down vote accepted

What does the hex dump say? In general, 8-bit and non-printables are printed as '.' by most viewers. Pretty much like this (just on a Linux prompt though):

$ echo H€llo | hd
00000000  48 e2 82 ac 6c 6c 6f 0a                           |H...llo.|
00000008

And here is an example of how to decode the hex:

$ perl -ne 'chomp; s/ //g; print pack("H".length, $_)' <<< "48 e2 82 ac 6c 6c 6f 0a"
H€llo

You might also need to figure out what encoding was used and convert it to whatever your teminal is using.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.