Re: [Full-disclosure] Extracting files from SMB packet captures
- From: "Mike Vasquez" <mnv@xxxxxxxxxxxxxxxxxxxx>
- Date: Mon, 26 Feb 2007 21:22:03 -0700
While I haven't done anything specifically with SMB, I did come up with the
following a few years back: it might prove useful in your research:
http://www.adminprep.com/articles/default.asp?action=show&articleid=52
It covers taking an ethereal data cap, and taking portions of it to come up
with the original content, i.e. .wav's, .mov's, .zip's, .jpg's, etc. You
get the idea.
If you have any sanitized caps you want to send my way, I'd be happy to play
around with them, as well.
Mike
On 2/26/07, Jim O'Gorman <jogorman@xxxxxxxxx> wrote:
_______________________________________________
I have been working with extracting files from full-content SMB packet
captures. I would like to compare what I have found with other sources to
see how right/wrong I am about a few things.
Does anyone have good sources of examples on pulling files out of SMB
packet captures I can use as a reference? Tools or write ups would be great.
Thanks
Jim
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- References:
- [Full-disclosure] Extracting files from SMB packet captures
- From: Jim O'Gorman
- [Full-disclosure] Extracting files from SMB packet captures
- Prev by Date: Re: [Full-disclosure] ViewCVS 0.9.4 issues
- Next by Date: Re: [Full-disclosure] SEC Consult SA-20070226-0 :: File Disclosure in Pagesetter for PostNuke
- Previous by thread: [Full-disclosure] Extracting files from SMB packet captures
- Next by thread: Re: [Full-disclosure] Extracting files from SMB packet captures
- Index(es):
Relevant Pages
|
Loading
