5

Is there any tool to extract cookies from network sniffs generated by tcpdump (.pcap files).

I know I can open it in wireshark but it will take a while until I find the domain I am interested into and the cookies (is there a filter I can use ?)

Thanks

opc0de
  • 697
  • 4
  • 7
  • 14

2 Answers2

6

It looks like you should be able to easily pull the cookies from your pcaps with Wireshark or tshark using filters based around HTTP Cookies.

You should be able to match against http.cookie as a string according to the filters protocol reference: http://www.wireshark.org/docs/dfref/h/http.html

Some more general information about filter syntax (including operators) is here: http://wiki.wireshark.org/DisplayFilters

I'd fire up Wireshark on your pcap and use Find Packet with a known string and then use the right click menus to have Wireshark craft the filter for you (as described some in the manual section 6.2.2. Pop-up menu of the "Packet List" pane at http://www.wireshark.org/docs/wsug_html_chunked/ChWorkDisplayPopUpSection.html

You can then use that filter (copy and paste) in a console with tshark to rapidly search large pcaps or script the searches trivially.

adric
  • 380
  • 2
  • 10
  • A tshark command that will filter on packets with cookie and display the host and cookie: tshark -r some.pcap -T fields -e http.host -e http.cookie -Y http.cookie (note: perhaps the http.host field will be empty for server-originated cookies (responses from the server)). – Lekensteyn Apr 02 '14 at 20:16
1

The best solution is probably to load the PCAP file into NetworkMiner. All cookies will be automatically extracted by NetworkMiner and displayed on the "Credentials" tab.

This has already been suggested at the Wireshark-users mailing list: http://www.wireshark.org/lists/wireshark-users/201209/msg00054.html

netresec
  • 21
  • 2