NF Post 5 : Rebuild a website captured in pcap
It is possible to reconstruct a website in a packet. To do that, first of all, try to filter the packet to see only HTTP protocol. This way, it is easier to see packets that has a website that we can construct. select a packet that has a website on it .
Then, select a packet that has a website on it, and follow its TCP stream.
Below you can see that in the TCP stream of the selected packet, there’s several HTML code. But, we will not construct the website with this.
So the data above is displayed as ASCII. What we’re going to do is show the data as Raw and save as an HTML file.
Then, open the file that has been saved and open it in your browser, and you will see the website that has been rebuild.
