Wireshark — Network Traffic Analysis

SQL injection attempts:

http.request.uri contains "UNION"
http.request.uri contains "' OR "
frame contains "sqlmap"

🔑 Finding Credentials in Cleartext

Here's why unencrypted traffic is a critical security risk: when data travels across a network without encryption, anyone on the same network segment can read it. Think of it like sending a postcard instead of a sealed letter — every mail carrier along the way can read your message. On a shared network (coffee shop WiFi, corporate LAN, compromised router), an attacker running Wireshark or tcpdump can capture login credentials, session tokens, personal data, and API keys in real time. This is why HTTPS and encrypted protocols exist — they turn that postcard into a sealed, tamper-proof envelope.

One of the most common pentest findings (and CTF challenges) involves extracting credentials from unencrypted traffic. Many protocols transmit credentials in cleartext or with weak encoding.

Protocols That Leak Credentials

FTP — credentials sent in plaintext (you'll see USER admin → PASS secretpassword):

ftp.request.command == "USER" || ftp.request.command == "PASS"

HTTP Basic Auth — Base64 encoded (trivially decoded with echo "YWRtaW46cGFzc3dvcmQ=" | base64 -d → admin:password):

http.authorization

HTTP Form Login — POST body in cleartext:

http.request.method == "POST" && frame contains "password"

Other cleartext protocols — use these display filters:

telnet                          # Everything in cleartext, character by character
smtp.req.command == "AUTH"      # SMTP Auth — Base64 encoded
pop.request.command == "USER" || pop.request.command == "PASS"   # POP3
imap.request contains "LOGIN"   # IMAP
ldap.bindRequest && !(ldap.bindRequest_element.authentication == 3)  # LDAP Simple Bind
snmp.community                  # SNMP community strings

Automated Credential Extraction

tshark -r capture.pcap -Y "ftp.request.command == USER || ftp.request.command == PASS" \
  -T fields -e ftp.request.command -e ftp.request.arg               # FTP credentials

tshark -r capture.pcap -Y "http.authorization" \
  -T fields -e ip.src -e http.authorization                         # HTTP Basic Auth

tshark -r capture.pcap -Y "snmp" \
  -T fields -e ip.src -e ip.dst -e snmp.community                  # SNMP community strings

tshark -r capture.pcap -Y "http.request.method == POST && http.request.uri contains login" \
  -T fields -e frame.time -e http.file_data | head -30              # Brute force detector

$ tshark -r capture.pcap -z "io,phs" -q
Protocol Hierarchy Statistics:
  eth
    ip
      tcp
        http    45.2%
        tls     30.1%
      udp
        dns     20.5%
        data     4.2%

💡 Pro Tip: Use Edit → Find Packet (Ctrl+F) in Wireshark, set it to "String" and search for common credential keywords: password, passwd, pass, login, user, token, secret, key, auth. This brute-force approach catches credentials across all protocols.

🔒 TLS/SSL Inspection

TLS (Transport Layer Security, the encryption behind HTTPS) makes traffic unreadable in Wireshark. All you see is "Application Data" with no visible content. But there are several ways to decrypt it if you have the right keys:

Extracting Information Without Decryption

Even without decryption keys, the TLS handshake reveals useful metadata:

tls.handshake                    # All handshake messages
tls.handshake.type == 1          # Client Hello
tls.handshake.type == 2          # Server Hello
tls.handshake.type == 11         # Certificate
tls.handshake.extensions_server_name  # SNI (Server Name Indication) — which hostname was requested

Extract SNI hostnames, TLS versions, and JA3 fingerprints (JA3 is a method of fingerprinting TLS clients by hashing their handshake parameters — useful for identifying specific tools or malware):

tshark -r capture.pcap -Y "tls.handshake.type == 1" \
  -T fields -e ip.dst -e tls.handshake.extensions_server_name | sort -u   # SNI hostnames

tshark -r capture.pcap -Y "tls.handshake.type == 2" \
  -T fields -e tls.handshake.version | sort | uniq -c                     # TLS versions

tshark -r capture.pcap -Y "tls.handshake.type == 1" \
  -T fields -e tls.handshake.ja3                                          # JA3 fingerprint

Decrypting TLS Traffic

If you have the server's private key (RSA key exchange only) or the SSLKEYLOGFILE (pre-master secrets), you can decrypt TLS traffic:

Method 1: SSLKEYLOGFILE (works with modern TLS including PFS — Perfect Forward Secrecy, where each session uses a unique key so compromising one session doesn't compromise others). Set this environment variable before starting the browser:

export SSLKEYLOGFILE=/tmp/tls_keys.log

Then in Wireshark: Edit → Preferences → Protocols → TLS → (Pre)-Master-Secret log filename → set to /tmp/tls_keys.log. Wireshark will now decrypt TLS traffic.

Method 2: RSA private key (only works with RSA key exchange, no PFS). In Wireshark: Edit → Preferences → Protocols → TLS → RSA keys list → add IP, Port, Protocol, Key file.

Decrypt with tshark:

tshark -r capture.pcap -o "tls.keylog_file:/tmp/tls_keys.log" -Y http

💡 Pro Tip: In CTF challenges, if you're given both a pcap and a private key file (.pem/.key), the challenge almost certainly wants you to decrypt TLS traffic. Load the key in Wireshark's TLS settings and the encrypted traffic will magically become readable HTTP.

📡 DNS Analysis

DNS traffic is a goldmine. It reveals what hosts were contacted, can expose data exfiltration, and in CTFs often hides flags in DNS queries or TXT records.

Basic DNS filters:

dns                              # All DNS traffic
dns.flags.response == 0          # DNS queries only
dns.flags.response == 1          # DNS responses only
dns.qry.name contains "target.htb"  # Queries for specific domain
dns.flags.rcode == 3             # NXDOMAIN (domain not found)

DNS query types:

dns.qry.type == 1               # A records
dns.qry.type == 28              # AAAA records
dns.qry.type == 5               # CNAME (Canonical Name — alias pointing to another domain)
dns.qry.type == 16              # TXT records (often hide data!)
dns.qry.type == 15              # MX records (mail servers)
dns.qry.type == 33              # SRV records (service discovery)
dns.qry.type == 252             # AXFR (zone transfer — downloads the ENTIRE DNS zone!)

Extract and analyze DNS data with tshark:

tshark -r capture.pcap -Y "dns.flags.response == 0" \
  -T fields -e dns.qry.name | sort -u                 # All queried domains

tshark -r capture.pcap -Y "dns.qry.name" \
  -T fields -e dns.qry.name | awk 'length > 50'       # DNS tunneling (long labels)

tshark -r capture.pcap -Y "dns.txt" \
  -T fields -e dns.txt                                 # TXT record answers

DNS Exfiltration Detection

DNS tunneling/exfiltration encodes data in DNS queries (usually as long subdomain labels). Watch for:

• Unusually long domain names (normal DNS labels are short)
• High volume of DNS queries to the same domain
• Base64 or hex-encoded subdomain labels
• TXT record queries with large responses

tshark -r capture.pcap -Y "dns.qry.name" \
  -T fields -e dns.qry.name | \
  awk -F. '{for(i=1;i<NF;i++) if(length($i)>20) print}' | sort -u    # Long labels

tshark -r capture.pcap -Y "dns.qry.name contains exfil.evil.com" \
  -T fields -e dns.qry.name | \
  sed 's/.exfil.evil.com//' | base64 -d                               # Decode exfil data

📊 Statistics & Conversations

Wireshark's statistics features give you a high-level overview before diving into individual packets. Always check statistics first when analyzing an unfamiliar pcap.

Key Statistics Views

In the GUI: Statistics menu → various options. With tshark:

tshark -r capture.pcap -z "io,phs"       # Protocol hierarchy (% per protocol)
tshark -r capture.pcap -z "conv,ip"       # Conversations — who's talking to whom?
tshark -r capture.pcap -z "conv,tcp"      # TCP conversations (src, dst, packets, bytes)
tshark -r capture.pcap -z "endpoints,ip"  # List all IP addresses
tshark -r capture.pcap -z "http,tree"     # All HTTP requests
tshark -r capture.pcap -z "dns,tree"      # DNS query statistics
tshark -r capture.pcap -z "io,stat,1"     # IO graph (1-second intervals)

💡 Pro Tip: When you first open a CTF pcap, go to Statistics → Protocol Hierarchy. This immediately tells you what protocols are present. If you see FTP → look for credentials. HTTP → look for web traffic. DNS → check for tunneling. This 5-second check sets your analysis direction.

📦 Exporting Objects

Wireshark can reconstruct and export files transferred over HTTP, SMB, TFTP, and other protocols. This is critical for CTF challenges where files are hidden in pcaps.

GUI Export

File → Export Objects → HTTP/SMB/TFTP/DICOM

This shows all files transferred over the selected protocol. You can save individual files or export all at once.

CLI Export with tshark

mkdir http_objects
tshark -r capture.pcap --export-objects http,http_objects/

mkdir smb_objects
tshark -r capture.pcap --export-objects smb,smb_objects/

mkdir tftp_objects
tshark -r capture.pcap --export-objects tftp,tftp_objects/

After exporting, always check file types — some files might be renamed or disguised:

file http_objects/*
xxd http_objects/suspicious_file | head   # Check magic bytes

Manual File Extraction

When automatic export doesn't work, you can manually extract files:

1. Find the file transfer in a TCP stream
2. Right-click → Follow → TCP Stream
3. Change "Show data as" to Raw
4. Click Save As to save the raw bytes

For binary files in HTTP: follow the HTTP stream, show as Raw, save — but remove the HTTP headers manually. Alternatively, use Export Packet Bytes (Ctrl+Shift+X) on just the data portion.

💡 Pro Tip: After exporting HTTP objects, run file * and strings on everything. CTF flags are often hidden in images (steganography), PDFs, or disguised files. An exported "image.png" might actually be a ZIP file — check the magic bytes!

⌨️ tshark CLI Automation

tshark is the command-line version of Wireshark. It has the same dissection capabilities but is perfect for scripting, automation, and working on remote servers without a GUI.

Essential tshark Commands

tshark -r capture.pcap                    # Basic read — like tcpdump
tshark -r capture.pcap -Y "http.request"  # Apply display filter

tshark -r capture.pcap -Y "http.request" \
  -T fields -e frame.number -e ip.src -e http.request.method -e http.request.uri   # Custom fields

tshark -r capture.pcap -Y "http.request" \
  -T fields -E separator=, -e ip.src -e http.host -e http.request.uri              # CSV output

tshark -r capture.pcap -Y "http.request" -T json | python3 -m json.tool            # JSON output
tshark -r capture.pcap -Y "http.response.code == 404" | wc -l                      # Count packets
tshark -r capture.pcap -Y "frame.number == 42" -V                                  # Packet details

Live capture and ring buffer:

sudo tshark -i tun0 -Y "http.request" -T fields -e http.host -e http.request.uri
sudo tshark -i eth0 -b filesize:10000 -b files:5 -w capture.pcap  # Rotate files

tshark Scripting Examples

tshark -r capture.pcap -T fields -e ip.src -e ip.dst | \
  tr '\t' '\n' | sort -u                                          # All unique IPs

tshark -r capture.pcap -Y "http.request" \
  -T fields -e frame.time -e ip.src -e http.request.method \
  -e http.request.full_uri                                        # HTTP timeline

tshark -r capture.pcap -Y "tcp.flags.syn == 1 && tcp.flags.ack == 0" \
  -T fields -e ip.src -e tcp.dstport | \
  sort | uniq -c | sort -rn | head -20                            # Detect port scanning

tshark -r capture.pcap -T fields -e frame.protocols -e data.data 2>/dev/null | \
  grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'     # Extract emails

tshark -r capture.pcap -z "endpoints,ip" -q                       # Bandwidth per IP

🏆 CTF Patterns & Techniques

Network forensics is a staple CTF category. Here are the most common patterns and how to solve them:

Pattern 1: Hidden Flag in HTTP Traffic

tshark -r challenge.pcap --export-objects http,exported/              # Step 1: Export objects
tshark -r challenge.pcap -Y 'frame contains "flag{"'                  # Step 2: Search for flag
tshark -r challenge.pcap -Y 'frame contains "CTF{"'
tshark -r challenge.pcap -Y "http.response" \
  -T fields -e http.file_data | strings | grep -i flag                # Step 3: Response bodies

Pattern 2: Credentials in FTP/Telnet

tshark -r challenge.pcap -Y "ftp.request.command == USER || ftp.request.command == PASS" \
  -T fields -e ftp.request.command -e ftp.request.arg               # FTP credentials

tshark -r challenge.pcap -Y "ftp-data" -z "follow,tcp,ascii,0"     # FTP transferred files
tshark -r challenge.pcap -z "follow,tcp,ascii,0" | grep -A 500 "Telnet"  # Telnet session

Pattern 3: File Carved from TCP Stream

Identify file transfers by looking for magic bytes:

tshark -r challenge.pcap -Y "tcp" -T fields -e data.data | \
  grep -i "504b0304"    # ZIP magic bytes (PK..)

tshark -r challenge.pcap -Y "tcp" -T fields -e data.data | \
  grep -i "89504e47"    # PNG magic bytes

To export: in Wireshark, Follow TCP Stream → Show as Raw → Save As.

Pattern 4: DNS Exfiltration / Hidden Data

Look for encoded subdomains (e.g., dGhlIGZsYWcgaXM.evil.com → base64 of flag data):

tshark -r challenge.pcap -Y "dns.qry.name" \
  -T fields -e dns.qry.name | sort -u                     # All DNS queries

tshark -r challenge.pcap -Y "dns.qry.name contains evil.com" \
  -T fields -e dns.qry.name | \
  sed 's/.evil.com//g' | tr -d '\n' | base64 -d           # Decode exfil subdomains

tshark -r challenge.pcap -Y "dns.txt" -T fields -e dns.txt  # Hidden TXT records

Pattern 5: Wireless (802.11) Challenges

WiFi management frame filters:

wlan.fc.type == 0              # Management frames
wlan.fc.type_subtype == 0x08   # Beacon frames (network names)
wlan.fc.type_subtype == 0x04   # Probe requests
wlan.fc.type_subtype == 0x0b   # Authentication frames
eapol                          # EAPOL (Extensible Authentication Protocol over LAN)
                               # — captures the WPA 4-way handshake needed for WiFi password cracking

tshark -r wifi.pcap -Y "wlan.fc.type_subtype == 0x08" \
  -T fields -e wlan.ssid | sort -u   # Extract SSIDs (network names)

Export EAPOL frames and crack with aircrack-ng or hashcat.

Pattern 6: ICMP Tunneling

Data hidden in ICMP echo request/reply payloads:

tshark -r challenge.pcap -Y "icmp" -T fields -e data.data             # Raw hex
tshark -r challenge.pcap -Y "icmp.type == 8" -T fields -e data.data | xxd -r -p  # Hex → ASCII

💡 Pro Tip: For CTF pcap challenges, always follow this checklist: (1) Protocol hierarchy — what's in the capture? (2) Export HTTP/SMB objects. (3) Search for flag format strings. (4) Follow every TCP stream. (5) Check DNS for hidden data. (6) Look for encoded payloads (Base64, hex). (7) Check ICMP payloads. (8) Extract and analyze any files found.

🎯 Real-World Methodology

When analyzing a pcap file, whether for a CTF, incident response, or pentest, follow this systematic approach:

Phase 1: Overview (2 minutes)

capinfos capture.pcap                          # Capture file info
tshark -r capture.pcap -z "io,phs" -q          # Protocol hierarchy
tshark -r capture.pcap -z "conv,ip" -q         # Conversations
tshark -r capture.pcap -z "endpoints,ip" -q    # Endpoints
tshark -r capture.pcap -T fields -e frame.time | head -1   # First packet time
tshark -r capture.pcap -T fields -e frame.time | tail -1   # Last packet time

Phase 2: Quick Wins (5 minutes)

mkdir exported && tshark -r capture.pcap --export-objects http,exported/   # Export HTTP objects

# Search for common flag formats
for pattern in "flag{" "CTF{" "FLAG{" "ctf{" "key{"; do
  echo "=== Searching: $pattern ==="
  tshark -r capture.pcap -Y "frame contains \"$pattern\"" 2>/dev/null
done

tshark -r capture.pcap -Y "ftp.request.command == USER || ftp.request.command == PASS" \
  -T fields -e ftp.request.arg 2>/dev/null                                # FTP creds

tshark -r capture.pcap -Y "http.authorization" \
  -T fields -e http.authorization 2>/dev/null                             # HTTP auth

Phase 3: Deep Dive (as needed)

tshark -r capture.pcap -Y "http.request" \
  -T fields -e frame.time -e ip.src -e http.request.method -e http.request.full_uri  # HTTP detail

tshark -r capture.pcap -z "follow,tcp,ascii,0"              # Follow streams

tshark -r capture.pcap -Y "dns.flags.response == 0" \
  -T fields -e dns.qry.name | sort -u                       # DNS queries

tshark -r capture.pcap -z "expert" -q                        # Expert info (anomalies)

Phase 4: Reconstruction

For complex file extraction, use the Wireshark GUI, NetworkMiner for automated carving, or foremost/binwalk on raw stream data for hidden files.

Timeline reconstruction:

tshark -r capture.pcap -Y "http.request || ftp.request || dns.flags.response==0" \
  -T fields -e frame.time_relative -e ip.src -e ip.dst \
  -e _ws.col.Protocol -e _ws.col.Info | head -50

⚠️ Common Mistakes

❌ Mistake #1: Confusing display filters with capture filters.
port 80 is BPF syntax (capture filter). tcp.port == 80 is Wireshark syntax (display filter). Using the wrong syntax in the wrong box gives you errors or no results. The display filter bar turns green when the syntax is valid, red when it's wrong.

❌ Mistake #2: Not checking Statistics → Protocol Hierarchy first.
Before searching for anything specific, understand what's in the capture. A 5-second protocol hierarchy check tells you whether to focus on HTTP, FTP, DNS, or something else entirely.

❌ Mistake #3: Ignoring DNS traffic.
DNS queries reveal every hostname contacted. DNS tunneling hides data in subdomain labels. DNS TXT records can contain flags, tokens, or configuration data. Always check DNS.

❌ Mistake #4: Only using the GUI.
The GUI is great for exploration, but tshark is essential for automation, large pcap files, and scripted analysis. Learn both. Many CTF challenges are faster to solve with a one-liner than clicking through the GUI.

❌ Mistake #5: Not exporting HTTP objects.
File → Export Objects → HTTP extracts all transferred files with one click. Many challenges hide flags in images, documents, or other files embedded in HTTP traffic. Always export and examine every object.

❌ Mistake #6: Forgetting to check ICMP payloads.
ICMP echo (ping) packets can carry data in their payload. This is commonly used for ICMP tunneling and data exfiltration. In CTFs, flags are frequently hidden in ICMP payloads.

🔄 Tool Comparison: Wireshark vs tcpdump vs tshark

📚 Further Reading

• Nmap Guide — Reconnaissance before capture
• Web Enumeration Guide — Understanding the HTTP traffic you're analyzing
• Wireshark Official Documentation — Comprehensive reference
• Wireshark Display Filter Reference — Complete filter syntax
• tshark Man Page — CLI reference
• Malware Traffic Analysis — Practice pcap analysis with real malware captures
• Learning Path — Where Wireshark fits in your pentesting journey