Is there any way, using TCPdump, Wireshark or any library based on that, to know if someone is downloading a specific file, for example abc.exe, by inspecting the http packet? http, not https
-
Unless you constantly scan packet and look for header like "MZ".– mootmootCommented Apr 25, 2017 at 16:12
Add a comment
|
2 Answers
Yes.
Since you know the contents of the file, obtain a certain section (or better - multiple samples from the file from different points) and compare the hex-encoded bits from it with the data in the packet. If some, or all of it matches up, you can safely assume that the file contained the data.
Example:
Sniffed packet:
00000000: 00 00 00 00 01 4e 56 41 52 33 00 ff ff ff 82 03 .....NVAR3......
00000010: 49 63 63 41 64 76 61 6e 63 65 64 53 65 74 75 70 IccAdvancedSetup
00000020: 44 61 74 61 56 61 72 00 00 00 00 00 00 00 00 00 DataVar.........
00000030: 00 00 00 00 00 00 00 00 4e 56 41 52 1c 00 ff ff ........NVAR....
00000040: ff 82 04 4e 65 77 4f 70 74 69 6f 6e 50 6f 6c 69 ...NewOptionPoli
00000050: 63 79 00 00 4e 56 41 52 21 00 ff ff ff 82 05 4e cy..NVAR!......N
00000060: 65 74 77 6f 72 6b 53 74 61 63 6b 56 61 72 00 01 etworkStackVar..
00000070: 01 00 00 00 01 4e 56 41 52 2a 00 ff ff ff 82 00 .....NVAR*......
00000080: 53 64 69 6f 44 65 76 43 6f 6e 66 69 67 75 72 SdioDevConfigur
Data samples from executable:
00000000: 61 56 61 72 aVar
00000000: 42 6f 6f 74 Boot
00000000: 64 69 6f 44 65 76 43 dioDevC
On comparing:
00000000: 00 00 00 00 01 4e 56 41 52 33 00 ff ff ff 82 03 .....NVAR3......
00000010: 49 63 63 41 64 76 61 6e 63 65 64 53 65 74 75 70 IccAdvancedSetup
00000020: 44 61 74 61 56 61 72 00 00 00 00 00 00 00 00 00 DataVar.[MATCH]
00000030: 00 00 00 00 00 00 00 00 4e 56 41 52 1c 00 ff ff ........NVAR....
00000040: ff 82 04 4e 65 77 4f 70 74 69 6f 6e 50 6f 6c 69 ...NewOptionPoli
00000050: 63 79 00 00 4e 56 41 52 21 00 ff ff ff 82 05 4e cy..NVAR!......N
00000060: 65 74 77 6f 72 6b 53 74 61 63 6b 56 61 72 00 01 etworkStackVar..
00000070: 01 00 00 00 01 4e 56 41 52 2a 00 ff ff ff 82 00 .....NVAR......
00000080: 53 64 69 6f 44 65 76 43 6f 6e 66 69 67 75 72 SdioDevConfigur
[MATCH]
-
1Only "trivial" if you're willing to accept false positives, don't care about compression, etc Commented Apr 25, 2017 at 16:19
-
OP did say 'plain HTTP'. That did cross my mind, but I didn't really write more since if you're using wireshark, it'll detect most of the common protocols for you, and you can analyze them by yourself later. But @BenVoigt - you're right, this isn't the best solution.– thel3lCommented Apr 25, 2017 at 16:25
-
Oh, I didn't mean that it's a bad method. Just saying that if it were trivial, antivirus companies wouldn't need to spend multiple man-years dealing with all the complicated cases. Commented Apr 25, 2017 at 16:30
-
-
I'm currently working on my final thesis, so I think on write in python something like an WIPS. Since I'm on a wireless network, I can't block that kind of packets, so the idea is scan packets and search for executable files, one I obtain the source of the download, I can use the virustotal API to test it. So that's why I would like to inspect packets searching for executables. Commented Apr 25, 2017 at 17:46
This is SUPER messy (bad regex) but does the job if you know HOW it was downloaded (http/ftp/etc). As an example, I'm pulling any extension that that has a period, followed by three alpha characters on an FTP download. Sadly, it also pulls MORE than 3 characters on the regex. I'm sure someone can tweak this to be a little less messy. Grep and regex aren't a strong suit for me.
3.pcapng -X port 21 | grep ".\.[[:alpha:]][[:alpha:]][[:alpha:]]"
