search
OverviewGitHubHomepageGoDoc

File Extraction

Extract transferred files and save them to disk

hashtag
Introduction

Various protocols allow transferring files (e.g: HTTP, POP3) and some are made for the sole purpose of transferring files (FTP, SMB etc).

From a network security monitoring perspective, transferred files are interesting because they can contain malicious software or prohibited content.

Netcap extracts files from HTTP and saves them to disk, for both HTTP responses and HTTP requests.

It uses the File audit record type to model the extracted information.

Future versions will add file extraction support for other protocols as well.

hashtag
File Audit Records

The audit record definition for a file looks like this:

message File {
    string        Timestamp   = 1;
    string        Name        = 2;
    int64         Length      = 3;
    string        Hash        = 4;
    string        Location    = 5;
    string        Ident       = 6;
    string        Source      = 7;
    string        ContentType = 8;
    PacketContext Context     = 9;
    string        Host        = 10;
    string        ContentTypeDetected = 11;
}

As can be seen, the content type indicated by the HTTP header is included, as well as the content type that was detected. In addition, the source of the File is specified (e.g: from HTTP, Mail attachment etc), as well the identifier of the connection where it originated from.

The Hash field currently holds an MD5 hash of the file, Location points to the path on disk where the file is stored.

This will likely be replaced with a stronger hash function in the future.

hashtag
Usage

File capture is enabled by default and will store extracted files in the files subdirectory within your output directory. The -fileStorage flag allows you to customize this path (relative to the output directory):

To disable file extraction, set an empty string:

After capturing, lets inspect the directory contents:

As you can see, files are sorted by their MIME types retrieved from classifying them using the go standard library and named after the TCP connection they originated from.

By default, only complete requests and responses are captured, if you also want to extract incomplete data, use the -writeincomplete flag:

Dumping a File on the commandline looks like this:

For properly exploring files for each host I recommend using the Maltego Integration:

Maltego Integrationchevron-right
PreviousIndustrial Control SystemsNextEmail Extraction

Last updated