tshark / Wireshark
Analyses packet captures; filters cleartext creds (FTP, HTTP).
The command-line version of Wireshark. It analyses traffic captures or listens live, filtering by protocol and field, to extract credentials, tokens or files travelling in clear text.
Family File analysis & reversing
Flags -r -Y
Installation
sudo apt install -y tsharkUseful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- Symfonos 3VulnHub