views:

825

answers:

5

I have a file that apparently contains some sort of dump of a keep-alive HTTP conversation, i.e. multiple GET requests and responses including headers, containing an HTML page and some images. However, there is some binary junk in between - maybe it's a dump on the TCP or even IP level (I'm not sure how to determine what it is).

Basically, I need to extract the files that were transferred. Are there any free tools I could use for this?

+1  A: 

Use Wireshark.

Look into the file format for its dumps and convert your dump to it. Its very simple. Its called the pcap file format. Then you can open it in Wireshark no problem and it should be able to recognize the contents. Wireshark supports many dozens if not many hundred communication formats at various OSI layers (including TCP/IP/HTTP) and is great for this kind of debugging.

Doug T.
+2  A: 

Wireshark will analyze on the packet level. If you want to analyze on the protocol level, I recommend Fiddler: http://www.fiddlertool.com/fiddler/

It will show you the headers sent, the responses, and will decrypt HTTPS sessions as well. And a ton more.

Tom Ritter
A: 

Bingo - my dump actually WAS in pcap format, as evidenced by the magic number.

Thanks!

Michael Borgwardt
A: 

The Net tab in the Firebug plugin for Firefox might be of use.

A: 

Stool Samples :D

orlandu63