Grab images off wireshark

[krispys]

If you capture packets using wireshark that contain image files, how do you go about exporting the binary to reassemble into an image?

[Re@lity]

Have you tried chaosreader?

[krispys]

That is the program I am looking for, but I am trying to grab images off a WPA network. Therefore I can decrypt the packets, but then when i feed it into chaos reader, it outputs nothing... im thinking this is cause chaosreader only sees the encrypted packets. Any way to isolate the decrypted packets and feed it in a readable format?

[krispys]

Got it,
you cant use airdecap-ng 1.01, have to use older version. you can make changes to the files but that was too much work, so i just downloaded 0.9.1 or 0.9.3 and they both work. once you have the decrypted cap file you can use chaosreader on it and it works flawlessly.

[caturix]

I hadn't tried with any other versions but wireshark has that ability already for http.

I just verified it on 0.99.6a (I forgot I had it on this machine) but it works with the latest versions.

File -> export -> object -> http

If you follow the prompts you can dump any of the http images from a capture file. If you just need something quick for http that is the way to go.