Section 0x0008 will be talking about the dumping section as well as some extra utilities that is used to find files on web servers and dump them. Alot of this will revolve around dumping pcap files and trying to find certian data in files.

---

> dump pe info This is a simple PE file information dumper to find things like premissions, filename, file size, magic bytes of start sections, offsets of certian locations, COFF headers, etc information that can be used for things like PROC/DLL injection in the further future. example output (in this example i am using the file bootres.DLL from the windows 10 OS in the following folder / location examples/win10/windows10-boot-config-and-res-dll-inspection-example/bootres.dll)

---

> dump image metadata Dump image metadata will output a simple table from an image it asks you for, if you do not specify the flag -i it will simply prompt you for a direct filepath to an image or file to dump the following example is of a table that is outputted upon running and testing the function on the filename examples2/ss.jpg

---

> dump file binary this utility is simply to just check if a certian payload or item was injected properly, i left this here for really anyone to use to see if something that was tampered with in a file was supposed to be there. this tool simply dumps a file into hex data, take the following output of the image in the filepath examples/stego/injected.png as an example to what this tool shows you example output if you look closely you can see in the hex hello world was an injected message / payload in the IEND chunk / EOF of the PNG image

---

> dump file info Command dumps general information on a filepath or file, using the following example filepath we can see the information we get from this function examples/stego/injected.png

---

> dump png meta Now this one is a bit wackier than most, for the most part this will dump PNG metadata such as the chunk, section, section offset, chunk offset, chunk name, chunk importance, chunk CRC, chunk data etc. A weird thing i have found and experienced alot with this command is it will execute only once within one session, currently there is no known bug that is making this happen but its quite obvious there is a bug in there preventing it from working a second time. Either way take the following example filepath as a target to test on examples/stego/injected.png

---

> dump pcap dot11 NOTE: for any of the pcap dumping you can use --filepath to specify a PCAP file or filepath to a PCAP file, all example PCAP files are in filepath examples/pcap This command will ask the user for a PCAP file PCAPNG or PCAP, and will simply itterate over the pcap file to find certian 802.11 data such as BSSID's, SSID's and mac addresses from maybe say a previous attack you made on a network. example output

---

> dump pcap ftp NOTE: for any of the pcap dumping you can use --filepath to specify a PCAP file or filepath to a PCAP file, all example PCAP files are in filepath examples/pcap This command will parse through a given PCAP file to find FTP credentials and search for byte responses like USER and PASS example output using -> examples2/Ftp.pcap

---

> dump pcap ospf NOTE: for any of the pcap dumping you can use --filepath to specify a PCAP file or filepath to a PCAP file, all example PCAP files are in filepath examples/pcap This command will attempt to find and dump all OSPF authentication keys in a file, here is an example output of that dumping tool using the filepath -> examples/pcap/ospf-simple.cap

---

> dump pcap smtppa NOTE: for any of the pcap dumping you can use --filepath to specify a PCAP file or filepath to a PCAP file, all example PCAP files are in filepath examples/pcap This command will parse through a pcap or PCAPNG file and attempt to find all basic SMTP authentication messages, the username and password that is used in the payloads, then format them in a formal maner example output using -> examples/pcap/smtp.pcap

---

> dump pcap smtpe NOTE: for any of the pcap dumping you can use --filepath to specify a PCAP file or filepath to a PCAP file, all example PCAP files are in filepath examples/pcap This command will do the same as the one above but instead of searching for plaina authentication from a SSH server it will search for emails, chats, usernames, and bodies that may include sensative information in the responses, note some of this may be messed up and not such a formatted output but that is due to the =non snip function in the code. using example -> examples/pcap/smtp.pcap

---

> dump pcap sipa NOTE: for any of the pcap dumping you can use --filepath to specify a PCAP file or filepath to a PCAP file, all example PCAP files are in filepath examples/pcap command root -> dump pcap SIP authentication this command will parse through a PCAP or PCAPNG file and find all SIP authentication messages and payloads that may have the PARAM USER | PASS | or OK+ using example -> examples/pcap/SIP CALL.pcap

---

> dump pcap sipok NOTE: for any of the pcap dumping you can use --filepath to specify a PCAP file or filepath to a PCAP file, all example PCAP files are in filepath examples/pcap command root -> dump pcap SIP OK message this command will parse through a PCAP or PCAPNG file and try to find all SIP OK or SIP OK+ authentication messages and format them to a specific need using example -> examples/pcap/SIP CALL.pcap

---

> dump pcap sipin NOTE: for any of the pcap dumping you can use --filepath to specify a PCAP file or filepath to a PCAP file, all example PCAP files are in filepath examples/pcap command root -> dump pcap SIP OK INVITE MESSAGES This command will parse through a PCAP or PCAPNG file and try to find all SIP INVITE messages in a payload that were sucessful and were authenticated properly using example -> examples/pcap/SIP CALL.pcap

---

> dump pcap sipreg NOTE: for any of the pcap dumping you can use --filepath to specify a PCAP file or filepath to a PCAP file, all example PCAP files are in filepath examples/pcap command root -> dump pcap SIP REGISTER this command will parse through a PCAP or a PCAPNG file and attempt to find all possible REGISTER requests made to the host within the packets payload body using standard parsing NO EXAMPLE OUTPUT

---

> dump pcap sippg NOTE: for any of the pcap dumping you can use --filepath to specify a PCAP file or filepath to a PCAP file, all example PCAP files are in filepath examples/pcap command root -> dump pcap SIP POST GET this command will simply parse through a PCAP or CAP/PCAPNG file and attempt to find every POST and GET request made within an IMAP packet response body. using example -> examples/pcap/SIP CALL.pcap

---

> dump pcap imaplogn NOTE: for any of the pcap dumping you can use --filepath to specify a PCAP file or filepath to a PCAP file, all example PCAP files are in filepath examples/pcap command root -> dump pcap IMAP login and auth This command parses through a given PCAP/CAP/PCAPNG file and attempts to find a username and passwords as well as authentication attmepts made to the IMAP server using example -> examples/pcap/'IMAP - Login (Plaintext) 1.pcap'

---

> dump pcap custom This command might confuse some people with its wacky output. SO this command is intended to give the user full control over what THEY want to search in the file, not automated and not pre chosen, so here we are given some pre set choices and examples of filters we use say we have the following PCAP file example -> examples/pcap/HTTP - Basic Authentication.pcap and we want to find all authorized users or successful authorization messages that happened when making requests, we can simply type Authentication and it will output all fields found with the authentication field and payload NOTE: This is a very wacky output sometimes depending on the field and the custom payload to be found can be really weird and really large, but not be snipped as stated before, there is no current function to snip large output cause some people would like to have the larger outputs for more information that was parsed or found, the further development goes on the more you will be able to as a user customize via YAML files or even terminal based input about how the output is set