Hello, guys, and welcome to another video on this chapter
in this video, we are going to learn how to export all sorts of files, including
pdf, zip audio and video files from FTP traffic captured in Wireshark.
Before we begin, let me give you a quick introduction about FTP.
FTP stands for file transfer protocol,
which is used to transfer files from one host to another.
It makes use of two separate connections,
control and data connections before transferring files.
It uses TCP as its underlying network.
Most widely used applications are
File Zilla for Windows, Linux and Mac and FTP for Linux.
We will go ahead and look at how we can extract these type of files
which are transferred via FTP protocol, so back to our Linux machine.
We are going to access our FTP Server in this case file zilla that we have set up
on our Windows system and we can and we are going to login using some username and
password and trying to download files from there.
Meanwhile, we are going to capture all this traffic and see how we can extract
these files from this network captured file that we are going to create.
So let us go and visit the FTP Server by typing ftp
192 an then you type, the IP address of your Server.
So you can see that it prompts me with a username and password, so let's.
Type username and password, so we can.
So we we've accessed our HTTP Server, and you can see there is some files.
Being stored there, on mp4
for video and pdf file a zip file and an mp3 file.
So before we start downloading these files.
And stole them locally in our computer.
We need to first start capturing the traffic.
So let me go ahead and just look out first.
So we can start capturing before we looking into FTP Server.
So let's go ahead and start capturing
the packets and then we continue accessing to FTP server again.
Type username and password.
And then we have access again.
So let us actually go ahead and make it a little bit difficult this time and
download all the files at once and store them in our computer and then see how we
can extract each one of those from the network traffic.
So let's just save the mp3 file to our downloads folder.
Then the zip file.
Then the PDF file.
And then the mp4 file.
So now that we saved all the
files from our FTP Server lets just stop the traffic capture and.
Let's explore this traffic.
So you can in order, you can filter out all this traffic to the necessary ones and
in this case for the files that we have downloaded, so you can
go ahead on the display filter section and type.
FTP.
request dot command.
So hit enter.
And you can see all the FTP traffic from the beginning that we looked in and then.
In the following process.
What we downloaded from that Server.
You can see the username and the password that I use looking to the FTP Server in
order to download all these files and all the information is here.
So now that we have a very good idea of the files that were retrieved and sent, we
can review the traffic from the FTP data channel using this specific filter.
FTP dash data, then you hit enter and you can see.
Here.
The FTP data for all the files the mp3 file,
the zip file, the mp4 file and so on and so forth, from all the
files that we have downloaded locally and stored locally in our computer,
so you can in order now to extract let's say let's start with mp3.
First, we would like to extract that from the traffic.
So you just select any of these lines that
indicate the dotmp3 file that we downloaded.
Right. Click.
Follow TCP stream,
so now you are presented with all sorts of checks data, none of that, so now.
We need to change the show and save data
as to Raw format, and you can see immediately that everything changed.
All the information changed here and then you can go ahead and click save as
you choose the location to where you would like.
To store the extracted file is just go ahead and.
Delete those first.
From a download folder.
So in order to save this mp3 file,
it doesn't have it doesn't necessarily have to be the
exact name of the MP three files that you downloaded from FTP Server.
You can put any name like Q As long as it has the DOT MP
three extension in it, you can go ahead and click save and save it.
So now let's go to our downloads folder and see if we really saved it and.
Check out.
You can see that the file is playing, which means the section from this network,
traffic was successful, so you can follow the same procedure.
For all the files that you would like to
extract, sort of just go ahead and do the same for.
Let's say the.
PDF file so just go ahead and type ftp-data again and let's do these for.
We can do this for our zip file, the
problem or for the MP four file, just go ahead and do this for the MP four file.
Again, the same follow TCP stream.
So we are waiting a little bit,
show and save data as raw and go ahead and click save us just type.
Any kind of name you would like to werty.mp for extension.
And let's just save this one and then go to our downloads folder and see if
the extraction of the file was successful and if we can play this.
We do so, as you can see.
We can play this video
pretty successfully, so another extraction was successful.
That was it for this video.
I hope you've enjoyed this lesson
and now you can go ahead and click on the next video.
What are you going to learn how to capture Telnet, Password with Wireshark.