Extract HTTP requests and responses from a PCAP
Pull every HTTP request and response out of a capture - URLs, headers, cookies, form bodies and transferred files - without opening Wireshark.
Open in ctfpalUnencrypted HTTP in a capture is a transcript. Every request line, every header, every cookie and every body is there in full, and the reason capture challenges lean on it is that it is the most legible protocol most people will ever read off the wire.
What to look at, in order
- The URLs. A path nobody would browse to -
/admin,/backup.zip,/flag- is the challenge telling you where it put things. - Cookies and `Authorization` headers. A session cookie is a credential; a
Basicheader is a password in base64, which is not encryption and never was. - POST bodies. Login forms, uploaded files, and API calls all carry their payload here in the clear.
- Response bodies. A downloaded file is in the response. So is a server banner that names a version with a known CVE.
- Unusual headers. A custom
X-header carrying base64 is a channel somebody built on purpose.
Recovering a transferred file
A file downloaded over HTTP is a response body split across TCP segments. The stream has to be reassembled before the body means anything, which is what the Follow TCP stream tab does - and then the body, minus its headers, is the file. If it arrived Content-Encoding: gzip, it is still gzipped: hand the bytes to File mode and let the magic-byte scan tell you what it actually is.
Common questions
- Why do I see requests but no responses?
- Usually because the capture was taken on the client side of a one-way tap, or the responses arrived on a TCP stream the capture truncated. It can also mean the response is there but split across segments the reassembler could not order - check the Follow TCP stream tab for the same conversation.