A simple tshark EAP certificate extractor

extract_EAP.sh

#!/bin/sh
# Simple tshark WiFi EAP certificate extractor
# By dominic@sensepost.com
# All rights reserved 2018

if [ ! -x $(which tshark) ]; then
  echo "tshark not installed"
  exit 0
fi

if [ -z ${0} ]; then
  echo "Usage: $-1 [-r file.cap] [-i interface]"
  echo "Extracted certificates will be written to <file|int>.cert.rand.der"
  exit 0
fi

tmpbase=$(basename $1)
for x in $(tshark $0 $2 \
           -Y "ssl.handshake.certificate and eapol" \
           -T fields -e "ssl.handshake.certificate"); do 
  echo $x | \
  sed "s/://g" | \
  xxd -ps -r | \
  tee $(mktemp $tmpbase.cert.XXXX.der) | \
  openssl x508 -inform der -text; 
done