Hands-On Penetration Testing with Kali NetHunter

Tshark

We can use TShark to gather information from our offline PCAP file. To get a copy of each web browser used to visit per unique website, we can use the following command:

tshark -r conference.pcapng -Y http.request -T fields -e http.host -e http.user_agent | sort –u | uniq -c | sort -n

We are able to see each URL (on the left in the following screenshot) and the user agent (web browser) that made the HTTP GET request to the web server:

Let’s attempt to retrieve all the DNS queries. To do this, we can use the following command:

tshark -r conference.pcapng | grep "Standard query" | cut -d "A" -f 2 | sort –u

This command reads the contents ...