TShark Challenge II: Directory Curiosity! [TryHackMe Writeup]

In this video, we investigate a network packet capture file (directory-curiosity.pcap) from the TryHackMe room "TShark Challenge II: Directory Curiosity!". Using command-line network analysis tools like TShark, along with CyberChef and VirusTotal, we analyze DNS queries, count HTTP requests, extract web server banners, analyze open directory listings, extract malicious HTTP objects, and identify malware signatures. 🔗 TryHackMe Room: https://tryhackme.com/room/tsharkchallenge... 📌 Key Topics & Commands Covered: • Filtering DNS Queries & Defanging Domain IOCs: tshark -r directory-curiosity.pcap -Y dns • Counting HTTP Requests for Specific Hosts: tshark -r directory-curiosity.pcap -Y 'http.request and http.host contains "jx2-bavuong.com"' | wc -l • Extracting Web Server Header Banners: tshark -r directory-curiosity.pcap -Y "http.server" -T fields -e ip.src -e http.server | sort -u • Following TCP Streams in ASCII Mode: tshark -r directory-curiosity.pcap -z follow,tcp,ascii,0 -q • Carving Executable Files from PCAP Traffic: tshark -r directory-curiosity.pcap --export-objects http,./extracted/ -q • Computing SHA-256 Hashes & VirusTotal Threat Intelligence Analysis #TryHackMe #TShark #NetworkForensics #CyberSecurity #SOC #Wireshark #MalwareAnalysis #VirusTotal #PCAP Analysis