HTTP and web analysis using Xplico

In this exercise, we upload the HTTP (web) (xplico.org_sample_capture_web_must_use_xplico_nc.cfg.pcap) sample packet capture file.

For this HTTP analysis, we use Xplico to search for artifacts associated with the HTTP protocol such as URLs, images from websites, and possible browser-related activities.

Once Xplico has been started, log in using the following credentials:

  • Username: xplico
  • Password: xplico

We then choose New Case from the menu on the left and select the Uploading PCAP capture file/s button as we will be uploading files and not performing live captures or acquisition. For each case we must also specify a Case name:

In the following screenshot, I have entered HTTP-WEB for the Case name. Click  ...

Get Digital Forensics with Kali Linux now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.