3

I running a honeypot for the telnet and ssh services (more specifically, I'm running cowrie).

When an attacker tries to download a binary file cowrie generally downloads it and saves it to a file, but sometimes it fails and displays the whole binary gibberish instead rather than saving it to a file.

I have the pcap files with the traffic though, so what I'd like to do is use some program to filter any downloaded binary code from the pcap file and save it to a file.

My question is, is there any such program/script that does that?

Improve this question
2

1 Answer 1

Reset to default
-1

You can open the PCAP file with NetworkMiner, which will automatically extract all files that have been trasfered in clear text (HTTP, FTP etc). NetworkMiner woks in both Windows and Linux.

Improve this answer
3
  • He wants SSH and Telnet. For HTTP it's even built-in in Wireshark, why use an external tool?
    – Thomas Weller
    Jan 5, 2017 at 14:34
  • @ThomasWeller He's running an SSH/telnet honeypot, but there's nothing in the post indicating that the downloads are done inside of the SSH/telnet session. Hackers often attempt to download tools for privilege escalation and persistence through HTTP or FTP and NetworkMiner supports both these protocols but not Wireshark.
    – Erik
    Jan 20, 2017 at 18:16
  • Wireshark: File / Export objects / HTTP
    – Thomas Weller
    Jan 21, 2017 at 12:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .