How to extract files from network traffic using Wireshark

  1. Install Wireshark and start to capture network traffic
  2. Download a .exe file which in this example is putty.exe
  3. When the file is downloaded to your machine stop the capture process
  4. Search and identify the session related to the download activity (hint look for GET activities)







  1. Right click the session and select Follow Stream
  2. Instead of selecting the entire conversation, select only the traffic originating from the webserver in this case ->


7. Click Save as and save is as for example dump

8. Now open the dump file using your favorite HEX editor & remove the HTTP header which in below screenshot is the red part:


  1. After you have remove the HTTP Header info you file should start with MV


  1. Save the file as dump.exe


  1. See the result, you have now obtained the .exe from network traffic


Geef een reactie

Vul je gegevens in of klik op een icoon om in te loggen. logo

Je reageert onder je account. Log uit /  Bijwerken )

Facebook foto

Je reageert onder je Facebook account. Log uit /  Bijwerken )

Verbinden met %s

Deze site gebruikt Akismet om spam te bestrijden. Ontdek hoe de data van je reactie verwerkt wordt.