Announcing Cap'r Mak'r...

[kowsik <kowsik () gmail com>]

Packet repositories are only as useful as the pcaps in them. But
uploading pcaps kinda gets boring after the first 4 weeks. So we
thought, why not make pcaps from scratch.

If you are a DPI/IPS/Firewall/Anti-something-or-the-other geek, here's
what you have to do to go from a piece of content (malware, pdf, image
exploit, etc) to a packet capture:

- set up a server
- configure it to either post or download the content
- use a client to generate the traffic
- capture the packets
- and then forget to pass "-s 0" to tcpdump *argh*
- now repeat, rinse for IPv6

No need. Point your browser to http://www.pcapr.net/caprmakr (login
required), upload a file and embed it into HTTP or SMTP streams. The
generated pcap? Yours to keep, forever.

See http://www.pcapr.net/view/kowsik/2009/1/1/22/adobe-acrobat-jbig2-buffer-overflow.pdf.pcap.html
for what's possible with Cap'r Mak'r.

Enjoy!

K.