Hello, guys, and welcome to another video on this chapter.
In this video, we're going to learn how to
convert, PCAP file to an XML format in order to do that.
We are going to use a command line based
tool called the tshark. T shark is being developed by Wireshark.
And the only difference between the
Wireshark and the tshark command is that Wireshark is a gui based tool.
If you go ahead and your Kali Linux terminal and tshark space dash
h, you're going to see the how the users of tshark command, how the Tshark command
is being structured and used, and what sorts of flags and arguments you can use.
Tshark is a tool that can be used by people who do
capturing and investigating packets via command line. We will
use Tshark come online with external source
we can also view our data packets in XML format and also later on we can.
Well, this XML command into a more presentable HTML format,
so to achieve that, first we need to save our Data packets
in the PDML format and then convert it to an XML format using the commands you can
see in front of you, which is Tshark space.
Dash r and then you type the path of the pcap file together with the extension.
And then as we said, we are going to use the dash t argument Pdml.
And then you are going to.
Use that to the new XML
name that you're going to type next and bonus from this lesson.
We also going to use the building written command.
To convert the XML File into HTML. So lets
just jump right into our Kali Linux machine and see how the first command
is done, and then we are going to explore the second in command.
That's the Bonus of this lesson.
So back to our Kali Linux Machine,
you will see that I have placed on my desktop and
HTTP traffic that I have captured through Wireshark and we are going to use this
capture format and we are going to convert it to an XML format.
You can use command or you can just go Switch to Route account
and always navigate, as I do most of the times, to the location where the file that
you would like to convert is placed in makes it easier because in the same
folder you can save the other five from that.
You would like to convert it to the check first where we are.
So we are on desktop.
That's a good at last at least all the files that we have.
And there you go. You have it.
So let's just go ahead and use the tshark command space -r.
And then we type the name of the captured file on our desktop.
As we said next, we are going to use the -t flag space pdml.
And then we are going to save that into
let's say let's change the name as well so it can be Azure to type.
And to be packets xML.
So go ahead and press enter and you will see that.
So we made a mistake here.
We typed pcap.
But the extension of the file is cap, so
let's go ahead and press and hit enter one more time and you will see that.
Now, it's written you saw earlier, it has been created.
With the previous command.
Faulty, but we set up the correct command and now the XML
file being created, you can go ahead and open it with.
Any kind of ID that you have in this case, are we going to use the Gvim
to see it from and its very colorful you can distinguish between it
list, so let's just expand a little bit so you can see it better.
You can see that we have all the
information, the XML version, everything, encapsulation and so on and so forth.
And also it's presented Kali, Linux in a colorful
way and you can separate out the information between them.
You can use this XML format to any kind of purposes that you want to.
So this XML file
will be safe in a location under usr, Wireshark
and so we are going to use the XSml tool to execute these file.
Which will help us to create our HTML
Breach, which, as I told you earlier, it's the bonus for this video,
creating the XML page will format all the necessary information.
And only let us use the usable data.
So this is very useful when you're using
that tshark like the command line based tool to search and capture package, which
will present presented in a very structured way in a human readable.
More simple human readable format, you can use the command, as we indicated
in our slides earlier, so we are going to use the xsltproc space.
As we said, we are going to type the delegation that the XML file is named.
So this is going to be
a /usr/share/wireshark/pdml2html.xsl
then space we are going to use.
The name of the file that we created, so in this case, it was.
So in this case, it's going to be the packet.
XML.
we're going to type the name that we would like to have.
In HTML format so we're going to basically use the same name.
It is packets.html.
So from the moment that we are going to
press enter, you will see that an e-mail file has been created in our desktop
so we can just go ahead and open this with any Browser of your like.
So I have opened with Firefox and see.
So you can see that pretty much everything
is appearing from this capture file that we did with Tshark.
And we converted it in a more presentable way, like having the.
The graphical user interface of.
Like your viewing it in Wireshark, so you can see you can expand the frame
here and you can see all the information pretty similar to as you see it.
In Wireshark, you can see the Internet source.
They didn't protocol very soon and so on
and so forth, see that this is makes it a lot easier.
For an operator to see and view. It captured it in a more structured manner.
And so that was it for this video.
I hope you learned something and when
you're ready, you can go ahead and click on the next video.
What you are going to learn how to detect
ICMP Flooding or otherwise known as Smurf Attack.