Extraindo arquivos e informações capturadas das redes por sniffers

[firebits]

Uma forma mais automatizada é uma arquivo em shell script (read_capture_sniffers.sh)

#!/bin/bash
filename=`echo $0 |tr -d .sh |tr -d /`

fna=$filename"_log"

echo "Enter your '.cap' file location/name"
echo "Ex: /root/media/packets/lab/packets.cap"
echo -n "-> "
read fn

mkdir $fna
mkdir $fna/`date +%m%d%y%H%M`

while :
do
echo ">>>>>>>>MENU<<<<<<<<"
echo "1) Run URLSNARF (Grabs URLS)"
echo "2) Run DriftNet (Grabs Images)"
echo "3) Run ForeMost (Grabs Files and Images)"
echo "4) Run URLSnarf and ForeMost"
echo "5) Exit"
echo "Please enter an option 1-5"
echo -n "-> "
read opt
case $opt in
1) echo "+++++++++URLSNARF+++++++++";
mkdir $fna/`date +%m%d%y%H%M`/urlsnarf
urlsnarf -p $fn > $fna/`date +%m%d%y%H%M`/urlsnarf/urls.txt;
echo "UrlSnarf Complete";;
2) echo "+++++++++DriftNet+++++++++";
mkdir $fna/`date +%m%d%y%H%M`/driftnet;
tcpreplay -i lo $fn &1;
driftnet -i lo -a -d $fna/driftnet/;
echo "DiftNet Complete";;
3) echo "+++++++++ForeMost++++++++++";
mkdir $fna/`date +%m%d%y%H%M`/foremost;
foremost -i $fn -v -o $fna/foremost/;
echo "ForeMost Complete";;
4) echo "+++Running Multiple Methods+++";
mkdir $fna/`date +%m%d%y%H%M`/urlsnarf;
mkdir $fna/`date +%m%d%y%H%M`/foremost;
urlsnarf -p $fn > $fna/`date +%m%d%y%H%M`/urlsnarf/urls.txt;
foremost -i $fn -v -o $fna/`date +%m%d%y%H%M`/foremost/;
echo "All Extractions Completed";;
5) echo "Later!";
exit;;
*) echo "$opt is an invalid option. Please select option 1-5 only";
echo "Press enter to continue...";
read enterKey;;
esac
done

Fonte:http://www.backtrack-linux.org/forum...-captures.html

Traduzido e Adaptado por firebits
http://www.backtrack-linux.org/forum.../firebits.html