Full Disclosure mailing list archives
Re: Extracting files from SMB packet captures
From: "Mike Vasquez" <mnv () alumni princeton edu>
Date: Mon, 26 Feb 2007 21:22:03 -0700
While I haven't done anything specifically with SMB, I did come up with the following a few years back: it might prove useful in your research: http://www.adminprep.com/articles/default.asp?action=show&articleid=52 It covers taking an ethereal data cap, and taking portions of it to come up with the original content, i.e. .wav's, .mov's, .zip's, .jpg's, etc. You get the idea. If you have any sanitized caps you want to send my way, I'd be happy to play around with them, as well. Mike On 2/26/07, Jim O'Gorman <jogorman () gmail com> wrote:
I have been working with extracting files from full-content SMB packet captures. I would like to compare what I have found with other sources to see how right/wrong I am about a few things. Does anyone have good sources of examples on pulling files out of SMB packet captures I can use as a reference? Tools or write ups would be great. Thanks Jim _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Extracting files from SMB packet captures Jim O'Gorman (Feb 26)
- Re: Extracting files from SMB packet captures Mike Vasquez (Feb 27)
- Re: Extracting files from SMB packet captures Thorolf (Feb 27)
- <Possible follow-ups>
- Re: Extracting files from SMB packet captures Zed Qyves (Feb 27)