{"id":199,"date":"2025-06-22T16:41:19","date_gmt":"2025-06-22T16:41:19","guid":{"rendered":"https:\/\/epbrtcybersecurityportfolio.xyz\/?p=199"},"modified":"2025-06-22T16:41:19","modified_gmt":"2025-06-22T16:41:19","slug":"wireshark-part-iii","status":"publish","type":"post","link":"https:\/\/epbrtcybersecurityportfolio.xyz\/?p=199","title":{"rendered":"Wireshark part III"},"content":{"rendered":"\n<p><strong>Exercise 1<\/strong><\/p>\n\n\n\n<p><strong>Description:<\/strong> Extract the web object image from <code>wireshark3.pcap<\/code> and view it. According to the extracted image, what did Snort save?<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"517\" src=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-69-1024x517.png\" alt=\"\" class=\"wp-image-200\" srcset=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-69-1024x517.png 1024w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-69-300x152.png 300w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-69-768x388.png 768w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-69-1536x776.png 1536w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-69.png 1605w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"519\" height=\"433\" src=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-70.png\" alt=\"\" class=\"wp-image-201\" srcset=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-70.png 519w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-70-300x250.png 300w\" sizes=\"auto, (max-width: 519px) 100vw, 519px\" \/><\/figure>\n\n\n\n<p><strong>Exercise 2<\/strong><\/p>\n\n\n\n<p><strong>Description:<\/strong> Carve and decode the base64-encoded message from the SMTP exchange between 10.10.10.10 and 10.10.10.25. What does it say?<\/p>\n\n\n\n<p>First, we apply a filter to capture all the packets involved in this exchange: <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"186\" src=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-71-1024x186.png\" alt=\"\" class=\"wp-image-202\" srcset=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-71-1024x186.png 1024w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-71-300x54.png 300w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-71-768x139.png 768w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-71-1536x279.png 1536w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-71.png 1571w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Then, we can right-click on any of these packets so that we can follow the TCP stream for this conversation:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"921\" height=\"453\" src=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-72.png\" alt=\"\" class=\"wp-image-203\" srcset=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-72.png 921w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-72-300x148.png 300w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-72-768x378.png 768w\" sizes=\"auto, (max-width: 921px) 100vw, 921px\" \/><\/figure>\n\n\n\n<p>We can then save this stream as &#8216;raw&#8217;:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"974\" height=\"852\" src=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-73.png\" alt=\"\" class=\"wp-image-204\" srcset=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-73.png 974w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-73-300x262.png 300w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-73-768x672.png 768w\" sizes=\"auto, (max-width: 974px) 100vw, 974px\" \/><\/figure>\n\n\n\n<p>Using notepad, I can now edit the file I just saved.<\/p>\n\n\n\n<p>I have to delete all lines above and below the single base64-encoded line and delete all blank lines. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"794\" height=\"662\" src=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-74.png\" alt=\"\" class=\"wp-image-205\" srcset=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-74.png 794w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-74-300x250.png 300w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-74-768x640.png 768w\" sizes=\"auto, (max-width: 794px) 100vw, 794px\" \/><\/figure>\n\n\n\n<p>I can now decode the resulting base64-encoded carved file. There are many online base64 decoders available. I can also use built-in tools on most operating systems.<\/p>\n\n\n\n<p>For Windows, I am going to use  the built-in certutil command-line tool. The certutil command with the &#8211;decode option takes in a base64 file and outputs the decoded file. The format is:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"806\" height=\"146\" src=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-75.png\" alt=\"\" class=\"wp-image-207\" srcset=\"https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-75.png 806w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-75-300x54.png 300w, https:\/\/epbrtcybersecurityportfolio.xyz\/wp-content\/uploads\/2025\/06\/image-75-768x139.png 768w\" sizes=\"auto, (max-width: 806px) 100vw, 806px\" \/><\/figure>\n\n\n\n<p>The encoded message says: You rock big time! <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Exercise 1 Description: Extract the web object image from wireshark3.pcap and view it. According to the extracted image, what did Snort save? Exercise 2 Description: Carve and decode the base64-encoded message from the SMTP exchange between 10.10.10.10 and 10.10.10.25. What does it say? First, we apply a filter to capture all the packets involved in [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-199","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/epbrtcybersecurityportfolio.xyz\/index.php?rest_route=\/wp\/v2\/posts\/199","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/epbrtcybersecurityportfolio.xyz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/epbrtcybersecurityportfolio.xyz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/epbrtcybersecurityportfolio.xyz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/epbrtcybersecurityportfolio.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=199"}],"version-history":[{"count":2,"href":"https:\/\/epbrtcybersecurityportfolio.xyz\/index.php?rest_route=\/wp\/v2\/posts\/199\/revisions"}],"predecessor-version":[{"id":208,"href":"https:\/\/epbrtcybersecurityportfolio.xyz\/index.php?rest_route=\/wp\/v2\/posts\/199\/revisions\/208"}],"wp:attachment":[{"href":"https:\/\/epbrtcybersecurityportfolio.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=199"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/epbrtcybersecurityportfolio.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=199"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/epbrtcybersecurityportfolio.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=199"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}