wall of sheep software

[james.mattson at gmail.com (James Mattson)]

Im a big fan of using tcpreplay, then using the usual tools like ettercap, driftnet, urlsnarf, etc... If its a wireless 
pcap, use airdecap-ng first...

Has anyone given TCPextract a shot? It too looks like a good way to carve goodies from pcaps...

-B0z0dcl0wn

-----Original Message-----
From: Robin Wood <dninja at gmail.com>
Sent: Friday, September 18, 2009 3:41 PM
To: PaulDotCom Security Weekly Mailing List <pauldotcom at mail.pauldotcom.com>
Subject: Re: [Pauldotcom] wall of sheep software

I've downloaded NetWitness and will give it a look through but I was
more after something more like a script that would just run through
and pull out incriminating information.

Adrians script looks good but that is parsing ettercap output which I
haven't got.

I've just had a play with ngrep and got some POP3 details out so I
might try scripting that.

Robin

2009/9/18 Chris Bentley <chris.bentley at sky.com>:
> You could always try splitting the pcap file, only problem being missing
> some interaction when analysing the files.
> http://www.ethereal.com/lists/ethereal-users/200511/msg00253.html
>
>
> 2009/9/18 Robert Miller <arch3angel at gmail.com>
> > This will not make the "Wall of Shame" for you but for mining a cap file
> > this is useful, however the free version has a 2gb capture limit
> >
> > http://www.netwitness.com/products/investigator.aspx
> >
> > This software helped me locate a bot running crazy on a satellite
> > network really fast, just wish the company would buy ?the full version