From 54ecb707e60b54d5f6a772f1b254b041e66d9e15 Mon Sep 17 00:00:00 2001 From: stefan Date: Tue, 18 Jun 2024 22:26:21 +0200 Subject: [PATCH] added details about -z --- Forensics/Wireshark.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/Forensics/Wireshark.md b/Forensics/Wireshark.md index f14507a..1f17a3d 100644 --- a/Forensics/Wireshark.md +++ b/Forensics/Wireshark.md @@ -18,6 +18,17 @@ Autostop `-a` and ringbuffer `-b` arguments may be set to stop or split files at defined duration `duration:10`, sizes `filesize:100`, and count of files `files:5`. +Use `-z help` to see options of possible statistics, use `-q` to suppress +packet details. + +## Find Credentials + +Tshark can list all found credentials via the following command + +```sh +tshark -r file.pcap -z credentials -q +``` + ## Extracting USB Keystrokes Data between USB devices and the host can be filtered via tshark in order to @@ -27,7 +38,8 @@ display just the payload, e.g. keystrokes in the following way tshark -r keystrokes.pcapng -Y "usb.transfer_type==0x01 and frame.len==35 and! (usb.capdata == 00:00:00:00:00:00:00:00)" -T fields -e usbhid.data > output.txt ``` -A lookup table is needed to [convert the USBHID data to ASCII values](https://gist.github.com/ImAnEnabler/091a9e1ee2d6a0805408e009e2f4a2b5) +A lookup table is needed to [convert the USBHID data to ASCII +values](https://gist.github.com/ImAnEnabler/091a9e1ee2d6a0805408e009e2f4a2b5) ```sh python keystrokedecoder.py output.txt