> For the complete documentation index, see [llms.txt](https://chinnidiwakar.gitbook.io/githubimport/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://chinnidiwakar.gitbook.io/githubimport/forensics/basic-forensic-methodology/pcap-inspection.md).

# Pcap Inspection

{% hint style="info" %}
A note about **PCAP** vs **PCAPNG**: there are two versions of the PCAP file format; P**CAPNG is newer and not supported by all tools**. You may need to convert a file from PCAPNG to PCAP using Wireshark or another compatible tool, in order to work with it in some other tools.
{% endhint %}

## Online tools for pcaps

* If the header of your pcap is **broken** you should try to **fix** it using: [http://f00l.de/hacking/**pcapfix.php**](http://f00l.de/hacking/pcapfix.php)\*\*\*\*
* Extract **information** and search for **malware** inside a pcap in [**PacketTotal**](https://packettotal.com/)\*\*\*\*
* Search for **malicious activity** using [**www.virustotal.com**](https://www.virustotal.com/) and [**www.hybrid-analysis.com**](https://www.hybrid-analysis.com/)\*\*\*\*

## Extract Information

The following tools are useful to extract statistic, files...

### Wireshark

{% hint style="info" %}
**If you are going to analyze a PCAP you basically must to know how to use Wireshark**
{% endhint %}

You can find some Wireshark trick in:

{% content-ref url="/pages/-MaoHEtWovTW-hsbnDhK" %}
[Wireshark tricks](/githubimport/forensics/basic-forensic-methodology/pcap-inspection/wireshark-tricks.md)
{% endcontent-ref %}

### Xplico Framework

Xplico can **analyze** a **pcap** and extract information from it. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on.

#### Install

```bash
sudo bash -c 'echo "deb http://repo.xplico.org/ $(lsb_release -s -c) main" /etc/apt/sources.list'
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 791C25CE
sudo apt-get update
sudo apt-get install xplico
```

#### Run

```
/etc/init.d/apache2 restart
/etc/init.d/xplico start
```

Access to ***127.0.0.1:9876*** with credentials ***xplico:xplico***

Then create a **new case**, create a **new session** inside the case and **upload the pcap** file.

### NetworkMiner

Like Xplico it is a tool to analyze and extract objects from pcaps. It has a free edition that you can download [here](https://www.netresec.com/?page=NetworkMiner).

### [BruteShark](https://github.com/odedshimon/BruteShark)

* Extracting and encoding usernames and passwords (HTTP, FTP, Telnet, IMAP, SMTP...)
* Extract authentication hashes and crack them using Hashcat (Kerberos, NTLM, CRAM-MD5, HTTP-Digest...)
* Build visual network diagram (Network nodes & users)
* Extract DNS queries
* Reconstruct all TCP & UDP Sessions
* File Carving

### Capinfos

```
capinfos capture.pcap
```

### Ngrep

If you are **looking** for **something** inside the pcap you can use **ngrep**. And example using the main filters:

```
ngrep -I packets.pcap "^GET" "port 80 and tcp and host 192.168 and dst host 192.168 and src host 192.168"
```

### Carving

Using common carving techniques can be useful to extract files and information from the pcap:

{% content-ref url="/pages/-MaoHEtQ2rsEQD\_T3b4N" %}
[File/Data Carving & Recovery Tools](/githubimport/forensics/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.md)
{% endcontent-ref %}

## Check Exploits/Malware

### Suricata

#### Install and setup

```
apt-get install suricata
apt-get install oinkmaster
echo "url = http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz" >> /etc/oinkmaster.conf
oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules
```

#### Check pcap

```
suricata -r packets.pcap -c /etc/suricata/suricata.yaml -k none -v -l log
```

### YaraPcap

\*\*\*\*[**YaraPCAP**](https://github.com/kevthehermit/YaraPcap) is a tool that

* Reads a PCAP File and Extracts Http Streams.
* gzip deflates any compressed streams
* Scans every file with yara
* writes a report.txt
* optionally saves matching files to a Dir

### Malware Analysis

Check if you can find any fingerprint of a known malware:

{% content-ref url="/pages/-MaoHEtMT8G9sFcGPuG3" %}
[Malware Analysis](/githubimport/forensics/basic-forensic-methodology/malware-analysis.md)
{% endcontent-ref %}

## Other pcap analysis tricks

{% content-ref url="/pages/-MaoHEtTTtYI\_MuI9k10" %}
[DNSCat pcap analysis](/githubimport/forensics/basic-forensic-methodology/pcap-inspection/dnscat-exfiltration.md)
{% endcontent-ref %}

{% content-ref url="/pages/-MaoHEtUO5jv9bvG1ouP" %}
[USB Keyboard pcap analysis](/githubimport/forensics/basic-forensic-methodology/pcap-inspection/usb-keyboard-pcap-analysis.md)
{% endcontent-ref %}

{% content-ref url="/pages/-MaoHEtVJ2\_t8\_bwqDsa" %}
[Wifi Pcap Analysis](/githubimport/forensics/basic-forensic-methodology/pcap-inspection/wifi-pcap-analysis.md)
{% endcontent-ref %}