Hello everyone, I currently have a pcap file that contains an unencrypted Telnet session, and when I trace the TCP stream the password is in a format like so: pas...ord (please note this is just the format not the actual password). My question is, what can I do to be able to reconstruct the password fully? Thank you for your time.
What does the hex dump say? In general, 8-bit and non-printables are printed as '.' by most viewers. Pretty much like this (just on a Linux prompt though):
$ echo H€llo | hd 00000000 48 e2 82 ac 6c 6c 6f 0a |H...llo.| 00000008
And here is an example of how to decode the hex:
$ perl -ne 'chomp; s/ //g; print pack("H".length, $_)' <<< "48 e2 82 ac 6c 6c 6f 0a" H€llo
You might also need to figure out what encoding was used and convert it to whatever your teminal is using.