In this section, we will see how to export some
objects that we access or that
exist in the network traffic. We obtained.
Let's consider a scenario like this. Let's say
venetize that some suspicious. JPEG files
were transferred to the decline while performing
HTTP analysis. And
in order to examine whether there
are some harmful or hidden data in these
JPEG files. We first need to export
these files. So let's reapply the
filter. We applied in the
last lesson.
Maybe you will remember this.
in this filter
We will apply this filter again and click
the enter.
So here we see that it actually comes from the
server that has the IP address.
10.1.1.1 and from
this server
to the client side along with
some HTML pages and some
image in jpeg format
and here is you can see
A format jfif format
which stands for
gpac file interchange format is
a minimal file format that enables
gpack bitstreams to
be exchanged between a white
variety of platforms and
applications in order to check for the
existence of jfif files
in the HTTP traffic.
We can also apply this filter.
Can see this filter?
And click the enter.
Now we have the image files only
the image files now in order to
export the image. You will select 5 menu
under the file menu, you
will select export objects and
we are going to the http.
And in here you can see some files. I
want to export one of these objects at this
point. Now we have the object
some objects in
here on our HTTP traffic
and we can choose the content type that
we want to see and I want
to see just only the image gpeg
files. So if you choose the image
JPEG, you will see the only image
file JPEG files in here as you
can see and I want to at this
point. I want to export one of
these objects.
For example, I want to select this
one and now
we can click on the save.
And I want to save on the my desktop.
This file so click the
save again.
And this is okay. Now close. I'm opening
the image right now.
And you can see the image file is
in here.
So after exporting process, there are
a few ways to determine if any
data is hidden within a JPEG file.
The first way to do this using
a x editor a
hex editor is a tool that allows you
to view and edit the role
data of a file by opening the jpeg file
in a hex editor. You can look for any unusual
patterns or data that might be
hidden within the fire.
At the second way is using a stagnography
detection tool.
There are several tools available that
are specifically designed to detect hidden data
within files including GPX these
tools work by analyzing the file and
looking for patterns that are characteristic of
of the stenography and
the Third Way is using metadata
many image editing programs
allow you to view the metadata
of a JPEG file which includes
information about image such as its Dimensions resolution
and any comments
or keywords that have been added to
the to the file if they met data
estimated data contains unusual or
unexpected information. It could
indicate that data has been hidden within
the five.
And check for anti other
way is checking for unusual file
size. You can check for unusual
file size. And the other
way is checking for unusual file size.
You can check for unusual file size
if the file size of the gpac is significantly larger
than expected for an image of its dimensions and
quality. It could be an indication that
that data has been hidden within
the file and inspect inspecting.
The image can be
another way in some cases
you may be able to visually inspect the
image itself for any hints that
has been hidden within it. For
example, you might look for patterns or
anomalies in the image that are deterrent
normally present. It is
important to
not that these methods may
not be foolproof and it
is possible for data to
be hidden within a JPEG file in a
way is not detectable using these methods.
So keep in mind that
And that's all for now. See you on the next video.