Post

TryHackMe Security Footage

Posted
Preview Image
By xorandd
1 min read
TryHackMe Security Footage

Analyzing file

First, download provided .pcap file

Download-file

After downloading pcap file and opening it with wireshark follow tcp stream that contains encrypted traffic. Notice that stream starts with JFIF header - meaning that a JPEG file within that stream.

Follow-TCP-stream

Contents-of-TCP-stream

Files recovery

To recover files use foremost with this command

1

foremost -i security-footage-1648933966395.pcap -o extracted

Extracted-data

Once images were extracted, open them to reveal the flag

flag

TryHackMe
forensics pcap wireshark data recovery
This post is licensed under CC BY 4.0 by the author.