I have a pcap with a HTTP upload of an image. Wonder if there is a way to extract the image to file with Wireshark.
My Wireshark has version 1.10.6. When I tried "Export Objects" --> HTTP, I got the entire HTTP body of the HTTP POST message. The body includes things like Multi-part boundary etc and so it's not an image.
asked 05 Dec '15, 16:03
I get a similar result with 1.12.7., so it looks like a bug of the object export. Please file a bug report at https://bugs.wireshark.org
UPDATE: same with Wireshark 2.0.0, so definitely a bug or some form of encoding that is not yet implemented in the code. However if you remove the leading text lines in the exported file with a HEX editor up to '%PNG', you will get the correct image.