convert pcap file to mitm file format

chakka.lokesh · 03-04-2014, 12:07 AM

hello,

i am working with MITM and i met with a requirement of converting pcap, which I got it using tcpdump, into mitm dump format.

does any one know how to do this or any help is appreciated...

thanks.

unSpawn · 03-04-2014, 04:36 PM

There's quite a few packet capture formats around but I've never heard of a "mitm dump format"...

chakka.lokesh · 03-05-2014, 03:03 AM

mitm stands for man it the middle.

using mitmproxy, i can get the complete Layer 7 data, both request and response, in plain text.

for more information you can refer http://mitmproxy.org/

unSpawn · 03-05-2014, 05:57 PM

Thanks but I know well what MiTM stands for. Your reply still explain what you'd expect a "mitm dump format" to contain.

chakka.lokesh · 03-05-2014, 11:22 PM

mitmproxy has an option to save the traffic. this is the dump i am referring to. this holds the L7 data in plain text.

unSpawn · 03-07-2014, 01:16 AM

pcap format holds all the nfo in whatever unfiltered format it's gleaned from the wire. Wireshark (and possibly its helper apps) may allow you to "massage", report and export data the way you want it. Obviously for decrypting SSL traffic you'd need to have and import the certificate first: see the Wireshark documentation.
*Please note MiTM may have legitimate uses but we aren't able to check if your use is in accordance with local Law, and without unambiguous proof of that I'm rather hesitant to answer more questions.