Quick and Easy Commands for Tshark (Terminal Version of Wireshark) скачать в хорошем качестве

Quick and Easy Commands for Tshark (Terminal Version of Wireshark)

3) Create .cap file and give permissions: $ sudo touch {FILENAME.cap} && sudo chmod 755 {FILENAME.cap} eg$ sudo touch capture.cap && sudo chmod 755 /capture.cap 4) Start the CAPTURING/WRITING data: $ sudo tshark -i {INTERFACE} -w {FILENAME.cap} eg$ sudo tshark -i wlan1 -w /home/pi/collect/capture.cap 5) Stop with Ctl+C. READ for POST requests for passwords. $ sudo tshark -r {FILENAME.cap} -Y "http.request.method==POST" -T field -e text eg$ sudo tshark -r capture.cap -Y "http.request.method==POST" -T fields -e text 5) If you want both GET and POST: eg$ sudo tshark -r capture.cap -Y "http.request " -T fields -e text 6) You can be search the DNS and ip address: $ sudo tshark -r {FILENAME.cap} -Y "{FILTER}" -T field -e text eg$ sudo tshark -r capture.cap -Y "ip.address==192.168.0.123" -T fields -e text eg$ sudo tshark -r capture.cap -Y 'frame contains "facebook"' -T fields -e text 7) Filter by PORT: $ sudo tshark -r {FILENAME.cap} port {PORT_NUM} eg$ sudo tshark -r capture.cap port 22 8) Filter 'follow' TCP Stream (-q=quiet, z=statistics) -- FIND CREDENTIALS: $ sudo tshark -nr {FILENAME.pcap} -q -z follow,tcp,ascii,{LINE_NUM} eg$ sudo tshark -nr capture.pcap -q -z follow,tcp,ascii,0 eg$ sudo tshark -nr capture.pcap -q -z follow,tcp,ascii,0 | grep password 9) Use wireshark to read cap files: $ sudo wireshare {FILENAME.cap} 10) Use Dsniff to read cap files: $ sudo tshark -i {INTERFACE} -w {FILENAME.cap} $ sudo dsniff -p {FILENAME.cap} 11) Filter by protocol (e.g. icmp ping) $ sudo tshark -i {INTERFACE} {PROTOCOL} eg$ sudo tshark -i wlan0 icmp 12) See protocol hierarchy statistics: $ sudo tshark -i {INTERFACE} -q -z io,phs,{PROTOCOL} eg$ sudo tshark -i wlan0 -q -z io,phs,tcp 13) See ip communication: $ sudo tshark -i {INTERFACE} -q -z conv,{PROTOCOL} eg$ sudo tshark -i wlan0 -q -z conv,tcp DONATE: --------------- PAT:   / rezatahirkheli   PP: https://www.paypal.com/paypalme/rezat... BTC: 3EUQBWZKX9Vcwdffd3cUGATQopxrAQQxJ9 LTC: MBXE6hJgxxFYSD8SjmR7sHCHGTqFXmNGoU GFM: https://gofund.me/7d6500bd