WEBVTT

0:00:02.760000 --> 0:00:07.800000
 In this video, we will go through the
 following tools, chaos reader, TCP

0:00:07.800000 --> 0:00:13.480000
 flow, foremost, which we saw in a previous
 file carving video, wire shark,

0:00:13.480000 --> 0:00:16.280000
 bro IDS, and network miner.

0:00:16.280000 --> 0:00:20.200000
 These five tools can be used to file
 carbon network traffic or PCAP files

0:00:20.200000 --> 0:00:22.440000
 that you have acquired
 from the network.

0:00:22.440000 --> 0:00:25.600000
 We'll explore each of these tools so
 you have an idea of how to use them

0:00:25.600000 --> 0:00:28.260000
 to carbon network files
 from network traffic.

0:00:28.260000 --> 0:00:31.960000
 I've prepared these directories so
 we have a clean place to start.

0:00:31.960000 --> 0:00:35.300000
 All we need to do is enter this.

0:00:35.300000 --> 0:00:38.840000
 This PCAP file was captured from a
 user accessing their WordPress blog

0:00:38.840000 --> 0:00:41.360000
 and the user uploaded some files.

0:00:41.360000 --> 0:00:44.340000
 We will use the list of tools mentioned
 earlier to see how we can extract

0:00:44.340000 --> 0:00:48.940000
 those files. We'll start
 off with chaos reader.

0:00:48.940000 --> 0:00:53.500000
 Here are all the results
 it produced.

0:00:53.500000 --> 0:00:56.780000
 We can now go to File Manager and look
 at the results it produced for

0:00:56.780000 --> 0:01:04.100000
 us. Let's double click Desktop, then
 Carving, then Chaos, and now we can

0:01:04.100000 --> 0:01:08.740000
 see Data Files, Gift
 Files, and Gzip File.

0:01:08.740000 --> 0:01:16.880000
 As a quick note, you may not
 always get a working file.

0:01:16.880000 --> 0:01:18.920000
 When you try to open one,
 it may be corrupt.

0:01:18.920000 --> 0:01:24.220000
 It doesn't happen often, but it
 is something to be aware of.

0:01:24.220000 --> 0:01:27.680000
 These files here are the reports
 that Chaos writes.

0:01:27.680000 --> 0:01:32.700000
 These reports will give us an
 idea of what is available.

0:01:32.700000 --> 0:01:47.560000
 This here is the Get Post report, and
 we can see several details below.

0:01:47.560000 --> 0:01:52.820000
 For instance, we can see the details
 on IP to IP and the port number.

0:01:52.820000 --> 0:01:56.020000
 If we scroll down, we
 see more details.

0:01:56.020000 --> 0:02:00.400000
 Here we can see some
 very helpful details.

0:02:00.400000 --> 0:02:04.680000
 The user was logged in to the WordPress
 login page, as we see here.

0:02:04.680000 --> 0:02:10.360000
 Here's the login username, admin, and
 password, DFP, and eLearn that was

0:02:10.360000 --> 0:02:16.360000
 used. So, these are the details the
 report provides for Get and Post.

0:02:16.360000 --> 0:02:20.020000
 If we click on the Next tab, here we
 see the images Chaos Reader managed

0:02:20.020000 --> 0:02:24.280000
 to extract. We can see that it's
 still trying to load some images.

0:02:24.280000 --> 0:02:27.800000
 Once loaded, the report will
 show you the images.

0:02:27.800000 --> 0:02:31.780000
 Here's the full report for the sessions
 that were found in this traffic.

0:02:31.780000 --> 0:02:35.080000
 This is a great report that
 is automatically generated.

0:02:35.080000 --> 0:02:40.640000
 We can see the size, protocol, which files
 are related to, and the location

0:02:40.640000 --> 0:02:46.560000
 was between, time, as
 well as other details.

0:02:46.560000 --> 0:02:50.680000
 As we scroll down, we see the IP count,
 which shows how many bytes were

0:02:50.680000 --> 0:02:52.500000
 sent and received.

0:02:52.500000 --> 0:02:58.640000
 Here's the TCP port count, which
 shows which port was used.

0:02:58.640000 --> 0:03:10.440000
 Let's go back. Let's take a look at
 this file, which was extracted from

0:03:10.440000 --> 0:03:15.900000
 the traffic. It doesn't seem
 that it's working 100%.

0:03:15.900000 --> 0:03:22.620000
 We can also filter the type.

0:03:22.620000 --> 0:03:25.200000
 So, here we see all
 of the HTML files.

0:03:25.200000 --> 0:03:27.700000
 These are the images.

0:03:27.700000 --> 0:03:31.700000
 Let's open one. As mentioned earlier,
 sometimes some files won't always

0:03:31.700000 --> 0:03:34.120000
 open because some
 stuff is missing.

0:03:34.120000 --> 0:03:37.860000
 When that's the case, we can
 manually carve the files.

0:03:37.860000 --> 0:03:44.480000
 But, as you can see, they
 have all been extracted.

0:03:44.480000 --> 0:03:46.120000
 Here are the text files.

0:03:46.120000 --> 0:03:48.660000
 We also have a PDF.

0:03:48.660000 --> 0:03:50.920000
 This is our PCAP file.

0:03:50.920000 --> 0:03:56.420000
 A bit below, we see
 the HTML files.

0:03:56.420000 --> 0:04:00.520000
 So, these are the files that Chaos
 Reader managed to provide us.

0:04:00.520000 --> 0:04:04.660000
 This provided us some good information,
 but maybe we can find more.

0:04:04.660000 --> 0:04:06.320000
 Let's try another tool.

0:04:06.320000 --> 0:04:09.560000
 As it's good to have a wide variety
 of tools, we can select from and not

0:04:09.560000 --> 0:04:12.300000
 rely on a single one.

0:04:12.300000 --> 0:04:17.120000
 This time, let's use a tool called TCP
 Flow, which extracts all the flows

0:04:17.120000 --> 0:04:19.560000
 that are found in a PCAP file.

0:04:19.560000 --> 0:04:28.140000
 We're using the same
 PCAP file as before.

0:04:28.140000 --> 0:04:32.540000
 It's extracting all the flows and
 generates files based on the flow.

0:04:32.540000 --> 0:04:45.680000
 Here, we see that this is between 192
.168.56.1, port 50.662, and this

0:04:45.680000 --> 0:04:49.120000
 IP here, and port 12321.

0:04:49.120000 --> 0:04:51.880000
 It's clear what type of
 communication this is.

0:04:51.880000 --> 0:04:55.400000
 And here, this tells you
 that it's a JSON file.

0:04:55.400000 --> 0:05:00.460000
 This one here is a CSS file,
 and we can see others too.

0:05:00.460000 --> 0:05:03.600000
 You will show these files if the tool
 was able to extract the full content

0:05:03.600000 --> 0:05:07.040000
 in one packet, because sometimes the
 body of the content, which is the

0:05:07.040000 --> 0:05:10.140000
 file that's being transferred, cannot
 be held in one single packet, so

0:05:10.140000 --> 0:05:13.500000
 usually it is sent on top
 of more than one packet.

0:05:13.500000 --> 0:05:17.360000
 So, TCP Flow cannot identify that.


0:05:17.360000 --> 0:05:21.840000
 All it does is extract the data
 found in every single packet.

0:05:21.840000 --> 0:05:24.760000
 Now, let's apply foremost.

0:05:24.760000 --> 0:05:28.540000
 Let's say that our input is all of these
 files, and that our output will

0:05:28.540000 --> 0:05:30.420000
 be in the results directory.

0:05:30.420000 --> 0:05:37.220000
 Now we have a directory
 with results.

0:05:37.220000 --> 0:05:41.220000
 Let's go there now and select
 TCP Flow, and then results.

0:05:41.220000 --> 0:05:50.540000
 From this file, we can
 see these details.

0:05:50.540000 --> 0:05:54.240000
 As we saw in the file carving video
 in labs, this gives us an idea of

0:05:54.240000 --> 0:05:57.920000
 how the tool went through the data
 and carved out all of these files.

0:05:57.920000 --> 0:06:07.800000
 The report also shows you that
 the files have been extracted.

0:06:07.800000 --> 0:06:13.260000
 Here we see the types of files, JPEG,
 which has 10, GIF, which has 15,

0:06:13.260000 --> 0:06:17.660000
 HTM, PNG, and PNG.

0:06:17.660000 --> 0:06:20.480000
 This gives us a good report
 that we can check.

0:06:20.480000 --> 0:06:23.460000
 Let's go to the PDF folder
 and open the first file.

0:06:23.460000 --> 0:06:29.060000
 The document opens, and we have a fancy
 forensic file, which is NTFS forensics.

0:06:29.060000 --> 0:06:31.760000
 We can see that all of these
 were extracted correctly.

0:06:31.760000 --> 0:06:33.260000
 Let's click on another.

0:06:33.260000 --> 0:06:38.160000
 This one here shows us the TCP Flow
 report, which was generated by TCP

0:06:38.160000 --> 0:06:46.840000
 Flow. If we open the PNG folder, we
 can see all the extracted pictures.

0:06:46.840000 --> 0:06:51.320000
 TCP Flow, when combined with Foremost,
 does a really good job.

0:06:51.320000 --> 0:06:54.120000
 You can use this technique
 of combining the two.

0:06:54.120000 --> 0:06:57.900000
 Let's go back to TCP Flow
 and explore more.

0:06:57.900000 --> 0:07:01.380000
 This picture was transferred
 in a single packet, however.

0:07:01.380000 --> 0:07:04.920000
 If the file was transferred using more
 than one packet, then TCP Flow

0:07:04.920000 --> 0:07:08.140000
 could not extract that file, and again,
 you may need to either put them

0:07:08.140000 --> 0:07:09.000000
 together manually.

0:07:09.000000 --> 0:07:23.240000
 Write a script, or use a tool like
 Foremost to combine those together.

0:07:23.240000 --> 0:07:28.240000
 So, that was for TCP Flow.

0:07:28.240000 --> 0:07:30.080000
 Let's now look at Wire Shark.

0:07:30.080000 --> 0:07:41.320000
 So let's go ahead and open up
 the PCAP file in Wire Shark.

0:07:41.320000 --> 0:07:45.520000
 Let's also make a directory for Wire
 Shark here to store our results.

0:07:45.520000 --> 0:07:51.900000
 Let's first go to Statistics to understand
 what type of traffic we have

0:07:51.900000 --> 0:07:54.320000
 in this PCAP file.

0:07:54.320000 --> 0:07:57.720000
 Let's select Protocol History.

0:07:57.720000 --> 0:08:04.280000
 This is usually done for a general idea
 of what type of traffic we have.

0:08:04.280000 --> 0:08:08.180000
 We can see here most of the packets
 are IP version 4, and are using the

0:08:08.180000 --> 0:08:10.160000
 Transmission Control Protocol.

0:08:10.160000 --> 0:08:13.400000
 And these are the full details of the
 traffic, which even has the type

0:08:13.400000 --> 0:08:15.300000
 of files that were found.

0:08:15.300000 --> 0:08:23.380000
 We can also filter some
 of our traffic.

0:08:23.380000 --> 0:08:29.400000
 Let's type in HTTP
 and click Apply.

0:08:29.400000 --> 0:08:32.160000
 Here, we can see the login.

0:08:32.160000 --> 0:08:34.380000
 We can filter even further.

0:08:34.380000 --> 0:08:38.480000
 Let's filter for HTTP request method,
 then type in equal equal, and then

0:08:38.480000 --> 0:08:43.040000
 post. This lets us filter
 for the post method only.

0:08:43.040000 --> 0:08:44.800000
 Let's select this first line.

0:08:44.800000 --> 0:08:47.520000
 Right-click and choose
 Follow TCP Stream.

0:08:47.520000 --> 0:08:53.780000
 We can see the following.

0:08:53.780000 --> 0:08:58.920000
 Admin is the username, and the password
 is DFP Percentage 40ELearn.

0:08:58.920000 --> 0:09:02.220000
 Percentage 40 actually refers
 to the at symbol.

0:09:02.220000 --> 0:09:06.580000
 Since the packets were sent using a clear
 text protocol over HTTP, anyone

0:09:06.580000 --> 0:09:10.920000
 acquiring this traffic can see this
 data, which can easily be seen.

0:09:10.920000 --> 0:09:16.240000
 This is why it's highly recommended that
 you use it over HTTPS when using

0:09:16.240000 --> 0:09:23.440000
 your name and password.

0:09:23.440000 --> 0:09:26.120000
 We can also search for
 the files that we want.

0:09:26.120000 --> 0:09:29.240000
 For example, let's select
 String and search for PDF.

0:09:29.240000 --> 0:09:32.820000
 Let's also select Packet Details in
 the Search In section, and click the

0:09:32.820000 --> 0:09:37.580000
 Find button. Actually, let's clear
 this and start from the beginning,

0:09:37.580000 --> 0:09:39.740000
 and then we'll start
 the search again.

0:09:39.740000 --> 0:09:49.020000
 This feature allows us to search
 for various items of interest.

0:09:49.020000 --> 0:09:51.580000
 In this instance, a PDF.

0:09:51.580000 --> 0:09:55.600000
 If you remember from the previous extraction,
 we found a PDF file, and

0:09:55.600000 --> 0:09:59.780000
 there is an actual PDF file in the
 PCAP, and here again, we see a PDF

0:09:59.780000 --> 0:10:01.680000
 file in this packet.

0:10:01.680000 --> 0:10:05.920000
 Here's our PDF file.

0:10:05.920000 --> 0:10:09.300000
 We can click on it and select Export
 Selected Bites, which is one way

0:10:09.300000 --> 0:10:17.440000
 to extract this file.

0:10:17.440000 --> 0:10:21.460000
 Please note that it might not work because
 as we see here, there are some

0:10:21.460000 --> 0:10:25.420000
 bytes that need to be removed in the
 HTTP part, so cleaning will need

0:10:25.420000 --> 0:10:28.820000
 to be done. But this is one way.

0:10:28.820000 --> 0:10:35.200000
 Since these files were sent over HTTP,
 another option in Wireshark is

0:10:35.200000 --> 0:10:40.320000
 to go to File, then Export
 Objects, and select HTTP.

0:10:40.320000 --> 0:10:43.420000
 This will display all the files that
 Wireshark can export for us using

0:10:43.420000 --> 0:10:47.200000
 Export Object Method.

0:10:47.200000 --> 0:10:54.760000
 Here at the bottom, let's click the Save
 All button, and since we've already

0:10:54.760000 --> 0:10:57.220000
 created a directory,
 we'll use this one.

0:10:57.220000 --> 0:11:04.180000
 Let's type results into the Name Text
 field, and click the OK button.

0:11:04.180000 --> 0:11:07.200000
 And now, it's extracted
 all of these files.

0:11:07.200000 --> 0:11:09.100000
 Now, let's go back.

0:11:09.100000 --> 0:11:12.800000
 Let's select the Carving tab and
 then open the Wireshark folder.

0:11:12.800000 --> 0:11:17.320000
 Before we open the Results folder,
 let's open the PDF, and we can see

0:11:17.320000 --> 0:11:20.660000
 that it managed to extract this
 file manually using Wireshark.

0:11:20.660000 --> 0:11:24.380000
 Let's go ahead and open
 the Results folder.

0:11:24.380000 --> 0:11:27.640000
 We were able to extract pictures, as
 well as all the other files that

0:11:27.640000 --> 0:11:42.540000
 Wireshark was able to identify.

0:11:42.540000 --> 0:11:45.380000
 Now, let's do an Extraction
 using Bro.

0:11:45.380000 --> 0:11:50.020000
 Bro is one of my best tools, and I
 highly recommend you give it a try

0:11:50.020000 --> 0:11:52.700000
 and start using it
 with your analysis.

0:11:52.700000 --> 0:12:03.240000
 Here, we're going to ignore the check
 sums, as we just want to analyze

0:12:03.240000 --> 0:12:06.340000
 the packets, so it won't matter if
 there's a corrupted packet or entry

0:12:06.340000 --> 0:12:10.880000
 in this file. It won't extract any
 file, but if you check the contents

0:12:10.880000 --> 0:12:14.960000
 of the file, it shows files that
 are found in this PCAP file.

0:12:14.960000 --> 0:12:21.060000
 It also gives you all the packets
 and all the protocols that it saw.

0:12:21.060000 --> 0:12:25.960000
 Here are details for the DHCP.

0:12:25.960000 --> 0:12:38.140000
 Here are the details for the
 DNS requests in this packet.

0:12:38.140000 --> 0:12:46.040000
 We can also see the HTTP requests.


0:12:46.040000 --> 0:12:49.540000
 You can even filter with a
 tool in Bro called BroCut.

0:12:49.540000 --> 0:12:56.520000
 For example, we could extract the ID
 for this entry, the ID of the origin,

0:12:56.520000 --> 0:13:05.820000
 the protocol, the destination, the
 host, the URI, and the user agent.

0:13:05.820000 --> 0:13:09.560000
 This gives us a really simple way of
 filtering through the PCAP file,

0:13:09.560000 --> 0:13:12.120000
 so we can just bring
 a PCAP file to Bro.

0:13:12.120000 --> 0:13:15.420000
 Bro will analyze it and generate logs
 based on the protocols that are

0:13:15.420000 --> 0:13:17.120000
 found within the file.

0:13:17.120000 --> 0:13:21.180000
 We can use our Linux capabilities and
 tools to start parsing and extracting

0:13:21.180000 --> 0:13:23.020000
 details within them.

0:13:23.020000 --> 0:13:29.200000
 Since we didn't do any file extraction,
 let's go back and add another

0:13:29.200000 --> 0:13:31.980000
 file, which extracts all files.

0:13:31.980000 --> 0:13:34.860000
 Let's use a basic script that will
 check the protocol entries and the

0:13:34.860000 --> 0:13:39.860000
 PCAP file. If it finds a file,
 then it will extract it.

0:13:39.860000 --> 0:13:44.620000
 Now we will have a new directory that
 is called extracted files, so we

0:13:44.620000 --> 0:13:46.660000
 can start going through
 the results.

0:13:46.660000 --> 0:13:50.860000
 Let's type file, extracted
 files, and pipe it to more.

0:13:50.860000 --> 0:13:56.620000
 We can see that it
 extracted the file.

0:13:56.620000 --> 0:14:00.700000
 Here we see the ID for this file, which
 we can use later to identify what

0:14:00.700000 --> 0:14:02.960000
 coordinates with which session.

0:14:02.960000 --> 0:14:09.140000
 Here we see a jpeg file
 and a c++ file.

0:14:09.140000 --> 0:14:12.600000
 Scrolling down, we see
 a PDF file here.

0:14:12.600000 --> 0:14:20.440000
 Instead of piping to more, we can say
 that we're only interested in PDF

0:14:20.440000 --> 0:14:26.580000
 files. It will give you
 all the PDF files.

0:14:26.580000 --> 0:14:30.740000
 We can then go on to have the tool open
 the PDF file, and as you can see,

0:14:30.740000 --> 0:14:32.960000
 we manage to open it.

0:14:32.960000 --> 0:14:36.020000
 These were a few examples of what to
 search for, but it really depends

0:14:36.020000 --> 0:14:39.360000
 on you and what you're looking
 for in your investigation.

0:14:39.360000 --> 0:14:42.920000
 Let's continue and
 look for PNG files.

0:14:42.920000 --> 0:14:45.040000
 Here we have all the PNG files.

0:14:45.040000 --> 0:14:50.220000
 Let's change our search and see
 if broken find any exe files.

0:14:50.220000 --> 0:14:53.720000
 We'll search by using PE.

0:14:53.720000 --> 0:14:56.440000
 No, it did not find any
 executable files.

0:14:56.440000 --> 0:15:00.120000
 It gave us a jpeg file, so maybe this
 packet capture doesn't actually

0:15:00.120000 --> 0:15:02.780000
 have an exe within it.

0:15:02.780000 --> 0:15:04.820000
 Bro was a very useful tool.

0:15:04.820000 --> 0:15:08.480000
 All we need to do is apply a script,
 and it will do everything for us.

0:15:08.480000 --> 0:15:11.840000
 And if you apply filters, you
 can see the results of that.

0:15:11.840000 --> 0:15:13.820000
 Here we didn't apply any filters.

0:15:13.820000 --> 0:15:19.100000
 If Bro could not identify something,
 then you will see something like

0:15:19.100000 --> 0:15:24.140000
 this. DNS unmatched message for
 the unidentifiable log file.

0:15:24.140000 --> 0:15:28.100000
 Our final extraction tool
 will be NetworkMiner.

0:15:28.100000 --> 0:15:31.460000
 Let's go to the security onion
 and go to NetworkMiner.

0:15:31.460000 --> 0:15:35.460000
 NetworkMiner is an extremely useful
 tool when it comes to file carving.

0:15:35.460000 --> 0:15:41.060000
 Let's get started by selecting file,
 open, desktop, carving, and then

0:15:41.060000 --> 0:15:42.820000
 we can select any one of these.

0:15:42.820000 --> 0:15:46.700000
 But let's select Bro, and then the
 WordPress PCAP file, and now click

0:15:46.700000 --> 0:15:52.200000
 open. We can see that it loads the file
 and begins extracting the file.

0:15:52.200000 --> 0:15:56.800000
 Here we see a display of information
 from the PCAP file.

0:15:56.800000 --> 0:16:01.600000
 The first entry tells us that
 it's a Windows machine.

0:16:01.600000 --> 0:16:04.980000
 We see other details like the MAC address,
 the vendor, what operating

0:16:04.980000 --> 0:16:10.120000
 system it is, and we even see where
 they were extracted based on P0F,

0:16:10.120000 --> 0:16:13.980000
 which is a very useful tool for
 passive analysis and traffic.

0:16:13.980000 --> 0:16:18.400000
 We also see open ports, the number of
 packets sent, the number of packets

0:16:18.400000 --> 0:16:21.640000
 received, and outgoing sessions.

0:16:21.640000 --> 0:16:24.580000
 All of this is extracted
 automatically.

0:16:24.580000 --> 0:16:28.700000
 One really useful feature is that
 it categorizes other things.

0:16:28.700000 --> 0:16:31.900000
 Here we can filter all the files
 that have been extracted.

0:16:31.900000 --> 0:16:43.220000
 As we scroll through the files, we have
 a lot of useful extracted files.

0:16:43.220000 --> 0:16:45.080000
 Here we have images.

0:16:45.080000 --> 0:16:47.160000
 Let's go ahead and open one.

0:16:47.160000 --> 0:16:55.240000
 If there are any messages, we will see
 them here under the Messages tab.

0:16:55.240000 --> 0:16:57.420000
 We also have a search option.

0:16:57.420000 --> 0:17:00.080000
 Here we have a list
 of credentials.

0:17:00.080000 --> 0:17:02.260000
 Let's check out the auto resize.

0:17:02.260000 --> 0:17:05.840000
 It managed to automatically extract
 the username, admin, and password,

0:17:05.840000 --> 0:17:11.120000
 DFPADLearn, which this user used
 to log into this website.

0:17:11.120000 --> 0:17:15.140000
 The Sessions tab provides
 us all of the sessions.

0:17:15.140000 --> 0:17:18.960000
 If there are any DNS queries,
 they will appear here.

0:17:18.960000 --> 0:17:22.140000
 Here are the parameters that
 were sent back and forth.

0:17:22.140000 --> 0:17:27.320000
 You can use keywords.

0:17:27.320000 --> 0:17:31.420000
 If there are any anomalies,
 you can find them here.

0:17:31.420000 --> 0:17:34.700000
 NetworkMiner is freeware, which is limited
 in the amount of work it can

0:17:34.700000 --> 0:17:38.980000
 do. If you find a beneficial, which
 I really do, you can purchase this

0:17:38.980000 --> 0:17:41.680000
 tool and I highly recommend
 you do that.

0:17:41.680000 --> 0:17:45.700000
 Another thing that NetworkMiner can
 do, so you don't have to capture the

0:17:45.700000 --> 0:17:48.320000
 file, is to run it on the fly.

0:17:48.320000 --> 0:17:52.660000
 You can do that by going to File, then
 select to receive PCAP over IP.

0:17:52.660000 --> 0:17:55.900000
 You can use it to listen in on the network,
 capture traffic, and analyze

0:17:55.900000 --> 0:18:01.500000
 it. So as you can see, we can do a
 lot of fancy things with this tool.

0:18:01.500000 --> 0:18:04.180000
 We can even carve files.

0:18:04.180000 --> 0:18:06.480000
 I want to show you
 two more examples.

0:18:06.480000 --> 0:18:09.800000
 Let's go to NetworkMiner again
 and open another file.

0:18:09.800000 --> 0:18:21.560000
 Let's go to Public, then PCAPs,
 and select the first file.

0:18:21.560000 --> 0:18:26.820000
 We want an EXE. Now, let's
 go ahead and click Open.

0:18:26.820000 --> 0:18:29.100000
 Let's go to the Files tab.

0:18:29.100000 --> 0:18:33.320000
 This one here was for when the
 user downloaded an EXE file.

0:18:33.320000 --> 0:18:36.380000
 We have the option to open the file,
 but because it's an EXE, it will

0:18:36.380000 --> 0:18:39.820000
 not. Let's go ahead and
 open the folder, though.

0:18:39.820000 --> 0:18:42.400000
 Here it tells you the file
 that you have extracted.

0:18:42.400000 --> 0:18:44.960000
 If you want to make sure that this is
 a file, you can open the terminal

0:18:44.960000 --> 0:18:47.880000
 and type in FileBstrings.exe.

0:18:47.880000 --> 0:18:57.000000
 It tells us that it is a PE32 executable
 file, so NetworkMiner can even

0:18:57.000000 --> 0:19:05.140000
 do this for us. Let's
 copy this file.

0:19:05.140000 --> 0:19:08.640000
 Let's type in Public,
 PCAPs, and Download.

0:19:08.640000 --> 0:19:10.620000
 Let's bring it over here.

0:19:10.620000 --> 0:19:15.360000
 Okay, let's remove
 everything here.

0:19:15.360000 --> 0:19:26.280000
 Now, let's type in Bro
 minus CRDownload.PCAP.

0:19:26.280000 --> 0:19:34.500000
 And I have another script
 to extract the PE file.

0:19:34.500000 --> 0:19:37.440000
 Now let's see what it did.

0:19:37.440000 --> 0:19:39.480000
 It extracted a file.

0:19:39.480000 --> 0:19:43.140000
 This is it, and it
 is the ID for it.

0:19:43.140000 --> 0:19:46.260000
 This here is the MD5 for the file.


0:19:46.260000 --> 0:19:55.860000
 Now, let's type in grep and copy this
 value, and then from the http.log

0:19:55.860000 --> 0:20:09.400000
 file. It tells me the time,
 as well as the ID entry.

0:20:09.400000 --> 0:20:17.680000
 Here it shows you who downloaded it, as
 well as from where it was downloaded.

0:20:17.680000 --> 0:20:20.060000
 It used the get method.

0:20:20.060000 --> 0:20:27.160000
 This is the full URL of the file.

0:20:27.160000 --> 0:20:32.040000
 This here is the URL to the file's exact
 resource location on this source,

0:20:32.040000 --> 0:20:34.000000
 which it was downloaded from.

0:20:34.000000 --> 0:20:37.680000
 It even shows us the user agent
 and operating system.

0:20:37.680000 --> 0:20:44.160000
 Now, it should be in the extract files,
 so here it is, and if we run files

0:20:44.160000 --> 0:20:52.380000
 against it, it should tell us that this
 is a Windows PE32 executable file.

0:20:52.380000 --> 0:20:56.180000
 And this concludes this video lesson
 on how to carve files from network

0:20:56.180000 --> 0:20:59.900000
 traffic both automatically
 and manually.

0:20:59.900000 --> 0:21:00.780000
 Thank you for joining us.