> For the complete documentation index, see [llms.txt](https://pwnsec-notes.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pwnsec-notes.gitbook.io/ctf-notes/forensics/network-captures.md).

# Network Captures

## Extract Creds

[Pcredz](https://github.com/lgandx/PCredz) extracts Credit card numbers, NTLM(DCE-RPC, HTTP, SQL, LDAP, etc), Kerberos (AS-REQ Pre-Auth type 23), HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, etc from a **pcap file** or from a **live interface.**

<pre class="language-bash" data-overflow="wrap"><code class="lang-bash"># Install requirements
apt install python3-pip &#x26;&#x26; sudo apt-get install libpcap-dev &#x26;&#x26; pip3 install Cython &#x26;&#x26; pip3 install python-libpcap
# Clone and build docker image
<strong>git clone https://github.com/lgandx/PCredz
</strong>cd PCredz
docker build . -t pcredz
docker run --net=host -v $(pwd):/opt/Pcredz -it pcredz
</code></pre>

**Usage**

```bash
# extract credentials from a pcap file
python3 ./Pcredz -f file-to-parse.pcap

# extract credentials from all pcap files in a folder
python3 ./Pcredz -d /tmp/pcap-directory-to-parse/

# extract credentials from a live packet capture on a network interface (need root privileges)
python3 ./Pcredz -i eth0 -v
```

## Parsing

```bash
sudo apt install tshark
```

### Unique IPs & Macs & Ports

```bash
# IPS
tshark -r <PCAP> -T fields -e ip.src -e ip.dst | tr "\t" "\n" | tr "," "\n" | sort | uniq
# MAC
tshark -r <PCAP> -T fields -e eth.src -e eth.dst | tr "\t" "\n" | tr "," "\n" | sort | uniq
# Ports
tshark -r <PCAP> -T fields -e tcp.port -e tcp.port | tr "\t" "\n" | tr "," "\n" | sort | uniq
```