Skip to content

Instantly share code, notes, and snippets.

@MrThreat
Created October 18, 2017 04:51
Show Gist options
  • Save MrThreat/a3f210baa4ff9009352d11c3b88565ab to your computer and use it in GitHub Desktop.
Save MrThreat/a3f210baa4ff9009352d11c3b88565ab to your computer and use it in GitHub Desktop.
quick pcap parser for malware
#!/bin/bash
#simple pcap extractor for malware analysis
#@grotezinfosec
#arguments passed
pcap=$1
clear
if [[ $# -lt 1 ]] ; then
echo "========================"
echo "= Usage ="
echo "=./pcap_check PCAP-FILE="
echo "========================"
exit 0
fi
echo "DNS"
echo "==================================="
tshark -r $1 -T fields -e ip.src -e dns.qry.name -2R "dns.flags" | awk -F" " '{ print $2 }' | sort -u
echo ""
echo "Hostnames"
echo "==================================="
tshark -T fields -e http.host -r $1 |sort -u
echo ""
echo "useragents"
echo "==================================="
tshark -Y 'http contains "User-Agent:"' -T fields -e http.user_agent -r $1 | sort -u
echo ""
echo "email addresses"
echo "==================================="
tshark -r $1 -Y "data-text-lines" -T fields -e text |grep -Eio '\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b' | sort -u
echo ""
echo "urls"
echo "==================================="
tshark -r $1 -T fields -e http.host -e http.request.uri -Y 'http.request.method == "GET"' |sort -u
echo ""
echo "==================================="
echo "completed"
echo "==================================="
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment