I am currently doing pen-testing on a local proxy server that I have setup using Squid. I initiated a MITM attack to get packets from the compromised hosts. I have over hundred thousand packets in my pcap file from which I need to extract the basic proxy authorization fields of username and pass. Within the pcap file I can apply "http.authbasic" as a filter to get all the packets sent with username and pass, but how do I extract this info automatically for all the packets ,and prerably output the result to a text file ? asked 18 Jun '15, 13:44  Backspace |
One Answer:
You can use tshark.
Sample output: Please read the tshark man page and the display filter reference guide for more options and fields. Regards answered 18 Jun '15, 14:12  Kurt Knochner ♦ |
Is there a way to do this on a live packet capture stream ? the above command works perfectly for pcap files. We can also print distinct combinations using |sort |uniq
please try this:
-ni eth0 instead of -nr http.cap. On Windows it's -ni <id> while <id> is the interfaces ID you'll see with dumpcap -D -M