Angeline's Blog

Post 3: Recreate a Website from a Pcap Capture

January 8, 2019 at | In Network Forensics | No Comments

Recreating a website to see what the website looks like using pcap capture is possible, by first finding the packet that has HTTP protocol. Filter the packet to only show HTTP by using the command ‘http’.

Find the packet that has a website on it, by looking at the info, and right click then select follow TCP stream.

A new window will pop and show the HTML code of the selected website, as shown below.

Change the data into raw data by selecting ‘Raw’ from the show and save data on the bottom part of the window, then save it by clicking ‘save as’.

Go to the location of the saved file and open it in a browser, and you will see that the website has been successfully created.