I running a honeypot for the telnet and ssh services (more specifically, I'm running cowrie).

When an attacker tries to download a binary file cowrie generally downloads it and saves it to a file, but sometimes it fails and displays the whole binary gibberish instead rather than saving it to a file.

I have the pcap files with the traffic though, so what I'd like to do is use some program to filter any downloaded binary code from the pcap file and save it to a file.

My question is, is there any such program/script that does that?


You can open the PCAP file with NetworkMiner, which will automatically extract all files that have been trasfered in clear text (HTTP, FTP etc). NetworkMiner woks in both Windows and Linux.

|improve this answer|||||
  • He wants SSH and Telnet. For HTTP it's even built-in in Wireshark, why use an external tool? – Thomas Weller Jan 5 '17 at 14:34
  • @ThomasWeller He's running an SSH/telnet honeypot, but there's nothing in the post indicating that the downloads are done inside of the SSH/telnet session. Hackers often attempt to download tools for privilege escalation and persistence through HTTP or FTP and NetworkMiner supports both these protocols but not Wireshark. – ErikH Jan 20 '17 at 18:16
  • Wireshark: File / Export objects / HTTP – Thomas Weller Jan 21 '17 at 12:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.