1

I'm looking for a way to extract binaries from PCAP's using the command line. I realize it is possible using Wireshark -> File -> Export -> http objects etc. But tshark doesn't seem to support this.

Is there a way to do this or code around this, preferably using python or bash. Or does anyone know of tools that can do this that I am not aware of.

I'd prefer if the method is automatable / scriptable.

Improve this question

2 Answers 2

Reset to default
2

I think tcpextract is what you're looking for.

Improve this answer
1
  • I will look in to it. Not accepting yet, going to see if other people suggest other tools. +1
    – delh
    Nov 9, 2012 at 15:31
1

As of Wireshark 2.3.0, you can export HTTP objects with tshark. (Wireshark 2.3.0 hasn't been released yet, so you can grab a daily build from here.)

To extract HTTP objects from the command-line, run the following command:

tshark -r mypcap.pcap --export-objects "http,destdir"
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .