Following a recent security incident on a web server the security analyst takes HTTP traffic captures for further investigation. The analyst suspects certain jpg files have important data hidden…

The correct answer is A. tshark. tshark is the command-line version of Wireshark and supports the --export-objects option, which can extract files (including JPEG images) embedded in captured HTTP traffic and save them to a specified output directory. This makes it the ideal forensic tool for recovering files…

Enterprise Security Operations

Question

Following a recent security incident on a web server the security analyst takes HTTP traffic captures for further investigation. The analyst suspects certain jpg files have important data hidden within them. Which of the following tools will help get all the pictures from within the HTTP traffic captured to a specified folder?

Options

Atshark
Bmemdump
Cnbtstat
Ddd

How the community answered

(44 responses)

A
95% (42)
C
2% (1)
D
2% (1)

Explanation

tshark is the command-line version of Wireshark and supports the --export-objects option, which can extract files (including JPEG images) embedded in captured HTTP traffic and save them to a specified output directory. This makes it the ideal forensic tool for recovering files from .pcap captures. memdump is used for extracting memory contents, nbtstat queries NetBIOS name tables, and dd is a block-level disk/data copying utility - none of which can parse application-layer HTTP object streams to extract embedded files.

Topics

#network forensics#traffic analysis#steganography#packet capture

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice