wireshark and other tools like network miner are great for interactively exploring packet capture filesbut there will be times where you want to slice and dice pcaps using python and scapy some great use cases are generating fuzzing test cases based on captured network traffic or even something as simple as replaying traffic that you have previously captured we are going to take slightly different spin on this and attempt to carve out image files from http traffic with these image files in handwe will use opencv,[ computer vision toolto attempt to detect images that contain human faces so that we can narrow down images that might be interesting we can use our previous arp poisoning script to generate the pcap files or you could extend the arp poisoning sniffer to do on-thefly facial detection of images while the target is browsing let' get started by dropping in the code necessary to perform the pcap analysis open pic_carver py and enter the following codeimport re import zlib import cv from scapy all import pictures_directory "/home/justin/pic_carver/picturesfaces_directory "/home/justin/pic_carver/facespcap_file "bhp pcapdef http_assembler(pcap_file)carved_images faces_detected rdpcap(pcap_filesessions sessions(for session in sessionshttp_payload "for packet in sessions[session]tryif packet[tcpdport = or packet[tcpsport = reassemble the stream http_payload +str(packet[tcppayloadexceptpass headers get_http_headers(http_payloadif headers is nonecontinue image,image_type extract_image(headers,http_payloadif image is not none and image_type is not nonestore the image file_name "% -pic_carver_% % (pcap_file,carved_images,image_typefd open("% /% (pictures_directory,file_name),"wb"