Page 1 of 2 12 LastLast
Results 1 to 10 of 12

Thread: Extracting flash streams?

  1. #1
    Just burned his ISO
    Join Date
    Mar 2007
    Posts
    23

    Default Extracting flash streams?

    Is it possible to extract Flash streams, or play them, from a packet capture file?

    I have tried capturing my network traffic whilst using mplayer to play a .flv file from over the Internet and also viewing a video on youtube, and then using tcpreplay to replay this on the local interface where mplayer is listening, but to no avail.

    Is there any method of doing so?

  2. #2
    Senior Member iproute's Avatar
    Join Date
    Jan 2010
    Location
    Midwest, USA
    Posts
    192

    Default Re: Extracting flash streams?

    ant video downloader with embedded player

    Not real sure why you'd want to watch from a pcap recording... I imagine that just by sniffing where a 'sniffed' client is going you could easily watch said video yourself.
    Last edited by iproute; 01-20-2011 at 06:45 AM.

  3. #3
    Member
    Join Date
    Feb 2010
    Posts
    78

    Default Re: Extracting flash streams?

    I believe he is asking if you can reconstruct flash video from sniffed packets. Why would you want to do this?

  4. #4
    Member
    Join Date
    Jun 2009
    Posts
    74

    Default Re: Extracting flash streams?

    ....malicious video streams perhaps? I think it would make more sense just to use an evil FLV file but who knows ... I'm a bit intrigued or confused at least
    cd ~
    cd ./fridge
    rm beer
    cd ../bedroom
    more beer

  5. #5
    Just burned his ISO
    Join Date
    Mar 2007
    Posts
    23

    Default Re: Extracting flash streams?

    Quote Originally Posted by Renek View Post
    I believe he is asking if you can reconstruct flash video from sniffed packets. Why would you want to do this?
    Exactly, this is what I want to achieve.

    More so than anything, it is just out of curiosity to see if it can be done; I'm curious to know if people sniffing my wireless on an open connection without encryption (not that I do) are able to reconstruct my video/webcam streams.

  6. #6
    Member
    Join Date
    Feb 2010
    Posts
    78

    Default Re: Extracting flash streams?

    I use xplico to reconstruct http traffic, not sure if it can do flash streams however. May want to check that out.
    Computer security is a temporary condition.

  7. #7
    Good friend of the forums gunrunr's Avatar
    Join Date
    Jan 2010
    Location
    shining my spoon
    Posts
    265

    Default Re: Extracting flash streams?

    supposedly it can. Just make sure you edit your apache2 server settings as seen here or xplico will not convert your pcaps
    Code:
    We must also modify the php.ini file to allow uploads (pcap) files. Edit /etc/php5/apache2/php.ini.
    
    The lines to modify are:\\
    **post_max_size = 100M** \\
    **upload_max_filesize = 100M**\\
    Wielder of the spoon of doom
    Summercon, Toorcon, Defcon, Bsides, Derbycon, Shmoocon oh my
    Come hang out with hackers on twitter @gunrunr556

  8. #8
    Member muminrz's Avatar
    Join Date
    Jan 2010
    Posts
    64

    Default Re: Extracting flash streams?

    Firefox+DownloadHelper=Yourfile

  9. #9
    Just burned his ISO
    Join Date
    Mar 2007
    Posts
    23

    Default Re: Extracting flash streams?

    (Sorry for the rather late reply)
    Quote Originally Posted by muminrz View Post
    Firefox+DownloadHelper=Yourfile
    Thanks, but that's not quite what I am after; just to clarify, say I had sniffed my network and dumped the packets to a pcap file, I would like to reconstruct/extract any webcam streams (or similar) from the file.

    Quote Originally Posted by ranek
    I use xplico to reconstruct http traffic, not sure if it can do flash streams however. May want to check that out.
    That's a nice little tool, thanks, I've had no such luck extracting anything from it though.
    The author claims it can do RTP dissection, which is basically what I am after, but only supports audio only atm and with a limited number codecs.

    Hopefully video support comes soon, or is there something else out there?

  10. #10
    Senior Member
    Join Date
    Jul 2009
    Posts
    135

    Default Re: Extracting flash streams?

    Open up wireshark >> load pcap >>filter the stream session >> filter only traffic coming from webserver>> dump data to a file >> open up the file in a hex editor >> remove http headers or other headers, before the FLV header >> Save the newly modified file to disk >> open file with suitable flash player to confirm file works.

    or

    Open up wireshark >> load pcap >> filter the stream session >> filter only traffic coming from webserver>> dump data to a file >> use scalpel or foremost to carve video file >> open file with suitable flash player to confirm file works.

Page 1 of 2 12 LastLast

Similar Threads

  1. Replies: 0
    Last Post: 09-11-2010, 04:32 PM
  2. extracting data from captures
    By halfdone in forum Beginners Forum
    Replies: 14
    Last Post: 07-27-2010, 09:55 AM
  3. extracting rar files in backtrack
    By coubury in forum OLD BackTrack 4 General Support
    Replies: 8
    Last Post: 03-03-2010, 07:53 PM
  4. Help with extracting tcpdump data...?
    By ajf3ajf3 in forum OLD BackTrack 4 General Support
    Replies: 8
    Last Post: 09-16-2009, 01:50 AM
  5. Extracting images from captured stream
    By JF1980 in forum OLD Newbie Area
    Replies: 8
    Last Post: 09-17-2007, 02:36 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •