Cyber Security Academy · Lesson

Extracting Artifacts

Recover files and creds.

Extracting Artifacts is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Are Artifacts

Artifacts are the meaningful items hidden inside a capture: transferred files, credentials, images, and session data.

Recovering them turns a stream of packets into concrete evidence of what was sent and seen.

Reassembly Is Key

A single file is split across many TCP segments. To recover it you must reassemble the stream in order.

Wireshark and specialized tools handle this automatically when you follow a stream or export objects.

Exporting HTTP Objects

Wireshark can list every file transferred over HTTP and export it with one click.

This recovers downloaded documents, images, and even malware samples directly from the capture.

File -> Export Objects -> HTTP
(select files and Save)

Cleartext Credentials

Protocols like HTTP, FTP, and Telnet send credentials in cleartext. Following the stream reveals usernames and passwords directly.

This demonstrates exactly why those protocols are dangerous on untrusted networks.

FTP stream:
  USER admin
  PASS S3cr3tPass
(credentials in plaintext)

Finding Credentials Fast

Display filters quickly surface authentication traffic so you do not hunt by hand.

Filter for login forms, basic auth headers, and known credential protocols.

http.authorization
ftp.request.command == 'PASS'
http.request.method == 'POST' and
  http contains 'password'

Decoding Basic Auth

HTTP Basic authentication sends credentials Base64-encoded, not encrypted. Decoding the header reveals them instantly.

Base64 is encoding, not security.

Authorization: Basic YWRtaW46cGFzcw==
  decode Base64 -> admin:pass

Carving Files

When a protocol is not natively supported, you can carve files from raw bytes by recognizing file signatures, or magic numbers.

Tools like foremost or binwalk scan a capture's payload for these markers.

Magic numbers:
  PNG  89 50 4E 47
  PDF  25 50 44 46
  ZIP  50 4B 03 04

NetworkMiner

NetworkMiner is a tool built for artifact extraction. Feed it a pcap and it automatically pulls out files, images, credentials, and host details.

It is a fast first pass before manual digging in Wireshark.

Extracting Images and Media

Recovered images can reveal what a user viewed or uploaded. Wireshark's Export Objects and NetworkMiner both reconstruct images from web and email traffic.

Viewing them can directly establish what data left the network.

Handling Encrypted Traffic

If traffic is TLS-encrypted, you cannot extract artifacts without the session keys. With a key log file you can decrypt and then extract normally.

Without keys, encryption protects the payload, which is the point of HTTPS.

(set SSLKEYLOGFILE before capture)
Wireshark -> Preferences -> TLS
  -> (Pre)-Master-Secret log filename

Chain of Custody

Extracted artifacts may become evidence. Hash each file, record where and when it was recovered, and store it unaltered.

A documented chain of custody keeps your findings credible and admissible.

sha256sum recovered_file.pdf
(record hash, source pcap, timestamp)

Quick Check

Test your understanding of artifact extraction.

Recap

You learned to extract artifacts from captures.

Reassemble TCP streams to recover files.
Export HTTP Objects; follow streams for cleartext credentials.
Basic auth is Base64, not encryption.
Carve files by magic numbers; use NetworkMiner for fast extraction.
Decrypt TLS only with session keys; keep a chain of custody.

You have completed the Network Traffic Analysis course.

Frequently asked questions

Is the “Extracting Artifacts” lesson free?

Yes — the full text of “Extracting Artifacts” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Extracting Artifacts”?

Recover files and creds. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Extracting Artifacts” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy