O'Reilly Network Weblogs: Capturing Files from Network Streams

Published on The O'Reilly Network (http://www.oreillynet.com/)
http://www.oreillynet.com/pub/wlg/8049

Capturing Files from Network Streams

by Nitesh Dhanjani
Oct. 10, 2005

Eric Chavez, a good friend of mine, alerted me to a new tool called tcpxtract. The purpose of this tool is to extract files from network dump files. I have been looking at ways to capture files from HTTP streams, so I thought I’d give it a try. It wouldn’t compile right away (misplaced #endif), but I found the solution on the Bugs section of the project website. I tried running it on OS-X, but it didn’t seem to capture any images. When I get a chance, I will probably look at the source code for tcpxtract.c to see where the problem is.

This reminded me of driftnet, a similar tool, but limited to extracting images (and now MPEG audio streams) from the network. Always a fun tool to try when at a coffee shop or airport. Here is a screenshot of driftnet successfully capturing images on my network (while I was visiting oreilly.com):

One useful option in driftnet is –a, which causes drifnet to save the images into a temporary location instead of displaying it on-the-fly.

On a related note, I came across another interesting tool: Foremost – this tool can recover files from a given stream of data. I tried it with network dump files that I created with Ettercap, and it worked surprisingly well.

Nitesh Dhanjani is a well known security researcher, author, and speaker. Dhanjani has been invited to talk at various information security events such as the Black Hat Briefings, RSA, Hack in the Box, Microsoft Blue Hat, and OSCON.