Wireshark y tshark
On HTB you find a .pcap with cleartext credentials (HTTP, FTP, LDAP) or you need to check that your payload lands (tcpdump with ICMP). tshark does what Wireshark does, from the terminal.
- Platform
- Linux · Windows · macOS
- Official site
- wireshark.org
- On HTB
- 6 machines
Install
sudo apt install wireshark tshark tcpdumpWireshark y tshark cheat sheet
Capture
Does my ping arrive? (confirm command execution)
Attacker
sudo tcpdump -i tun0 icmp
Save a capture
sudo tcpdump -i eth0 -w captura.pcapAnalyse a pcap
TCP conversations
tshark -r captura.pcap -q -z conv,tcp
HTTP requests
tshark -r captura.pcap -Y 'http.request' -T fields -e http.host -e http.request.uri
FTP passwords
tshark -r captura.pcap -Y 'ftp.request.command == "PASS"' -T fields -e ftp.request.arg
Export files transferred over HTTP
tshark -r captura.pcap --export-objects http,objetos/
Wireshark filter for submitted forms
http.request.method == "POST"No command matches.
HTB machines where Wireshark y tshark is used
Taken from the chapters of IppSec videos where Wireshark y tshark shows up. The ▶ link jumps to the minute of that part.
Guides that use Wireshark y tshark
- Analysing a PCAP in a CTF with Wireshark and tshark 3 min read What to check first in a packet capture, how to pull FTP, HTTP, LDAP and Kerberos credentials, extract files and decrypt TLS or WiFi with Wireshark and tshark.