CTF-Misc

流量分析-基础

Table Of Content

流量分析基础：工具介绍，种类辨析
流量分析解析：协议分析，要点提取
流量分析实战：真题剖析，例题讲解

工具介绍安装
种类区分解析
基础知识介绍

You may need/

have known

Windows(Prefer)/Mac/Linux

Traffic Forensic/Analysis

流量统计，EDR/流量监控 bilibili1024 r7
流量取证，中间人/固定取证
流量分析，协议逆向

工具篇

Wireshark

Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.

tshark

命令行工具，方便编程
直接导出字段，直接处理

Eg.

tshark -r 00-wireshark.pcap -Y 'http.request.full_uri' -T fields -e 'http.file_data'
tshark -nr 00-wireshark.pcap -q -z follow,http,ascii,3

pyshark

编程直接处理
接口不友好，不如tshark

Eg.

import pyshark

pcap = pyshark.FileCapture('./00-wireshark.pcap', display_filter='http.file_data')

for packet in pcap:
    print(packet.http.file_data)