After downloading the executable, run it and follow the command prompts.Download the current version of the FileZilla Server Here (it’s free):.

As a Windows user, I recommend these two applications if your aim is to recreate this challenge. Other popular choices are VSFTPD for an FTP server and a simple Linux terminal as a client. The applications I chose (and you can shoose what works for you) are FileZilla for the FTP server and WinSCP as an FTP client. The first step to recreate this challenge is to acquire the sufficient applications to perform these operations. You can download the PCAP from my GitHub and try it yourself:įTP File Carving PCAP Setting Up The FileZilla FTP Server I have also kept the PCAP I used for this post to practice on. Steps 1 and 2 pertain to recreating the challenge for personal use. NOTE: If you are only interested in the PCAP analysis and file carving, start at step 3. This post is broken down into four sections: I will not be responsible for any damage, harm, or legal action derived from any information within this post. This post covers how to read unencrypted FTP traffic from a Wireshark PCAP and file carving techniques to be able to recreate a file from a PCAP stream.ĭisclaimer: This post is meant for educational purposes only and any information obtained sholuld not be used for malicious purposes. So, I set up a simple FileZilla FTP server on my Windows machine and attempted to recreate the challenge so I could have documentation on how to perform some of the actions. The PCAP was taken from a user downloading a file from a misconfigured or outdated FTP server that didn’t have SSL/TLS encryption.

This post pertains to a prior Capture-The-Flag (CTF) competition I was competing in where one of the challenges was to read the text (or flag) of a file from a packet capture (PCAP).

Using wireshark to recover flag