def test_scenario4_6(self):
target = open('4.6/file.aes', 'rb').read()
d = Dispatcher('4.6/4.6.pcap',
self.OUTPUT_PATH,
True,
verifyChecksums=False)
d.run()
h = 'this is the header!(§$%113550987'
t = 'TRAILER_'
self.assertTrue(self.findFile(h + target + t))
help="disable IP/TCP/UDP checksum verification",
action="store_false",
default=True)
parser.add_argument("--T",
dest='udpTimeout',
help="set timeout for UDP-stream heuristics",
type=int,
default=120)
print('pcapfex - Packet Capture Forensic Evidence Extractor - version %s' %
(VERSION, ))
print('----------=------===-----=--------=---------=------------------' +
'-' * len(VERSION) + '\n')
args = parser.parse_args()
if not args.verifyChecksums:
print('Packet checksum verification disabled.')
if args.entropy:
print(
'Using entropy and statistical analysis for raw extraction and classification of unknown data.'
)
dispatcher = Dispatcher(
args.input,
args.output,
args.entropy,
verifyChecksums=args.verifyChecksums,
udpTimeout=args.udpTimeout,
)
dispatcher.run()
def test_scenario4_5(self):
target = open('4.5/file.mp3', 'rb').read()
d = Dispatcher('4.5/4.5.pcap', self.OUTPUT_PATH, verifyChecksums=False)
d.run()
self.assertTrue(self.findFile(target))
VERSION = "1.0"
parser = argparse.ArgumentParser(description='Extract files from a pcap-file.')
parser.add_argument('input', metavar='PCAP_FILE', help='the input file')
parser.add_argument('output', metavar='OUTPUT_FOLDER', help='the target folder for extraction',
nargs='?', default='output')
parser.add_argument("-e", dest='entropy', help="use entropy based rawdata extraction",
action="store_true", default=False)
parser.add_argument("-nv", dest='verifyChecksums', help="disable IP/TCP/UDP checksum verification",
action="store_false", default=True)
parser.add_argument("--T", dest='udpTimeout', help="set timeout for UDP-stream heuristics",
type=int, default=120)
print 'pcapfex - Packet Capture Forensic Evidence Extractor - version %s' % (VERSION,)
print '----------=------===-----=--------=---------=------------------' + '-'*len(VERSION) + '\n'
args = parser.parse_args()
if not args.verifyChecksums:
print 'Packet checksum verification disabled.'
if args.entropy:
print 'Using entropy and statistical analysis for raw extraction and classification of unknown data.'
dispatcher = Dispatcher(args.input, args.output, args.entropy,
verifyChecksums=args.verifyChecksums,
udpTimeout=args.udpTimeout,
)
dispatcher.run()
