T-cogne and PDF? 2
No. 1 No. 2
# User comment START
#
# See the above (and a similar line further below)? I'm marking this sole major addition in the top, and there is one major
# addition at the bottom, of the original file:
#
# tshark-hosts-conv_161210_171653.log
#
# obtained with my (simple) program: https://github.com/miroR/tshark-hosts-conv
#
# as well as minor modifications (not really additions) to that file, with "User comment START" and "User comment END" where I
# edited that tshark-hosts-conv_161210_171653.log which was made on, as the timestamp says, on: 2016-12-10 at 17:16:53.
#
# Apart from the obvious uncovering of abuse by the provider in question ("t-cogne" is pronounced the same like "t-konj" in Croatian,
# but that latter means t-horse, clearly a term of endearment invented by users to their, the major, provider; it provides to around
# 80% of all users in Croatia, so almost a monopoly)...
#
# Apart from that, this is also meant for computer users who want to learn about reading the network, and if they ask about my
# claims here to any network experts they might know, they can only get confirmation of the truthfulness of my claims I present in
# this study.
#
# But I can't make even vaster attempts to open the world of network analysis to people even less versed in computing. It's
# already been too much work... Some basic knowledge of computing and network is the prerequisite for reader's understanding here.
# So enough of intro.
#
# User comment END
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -qz hosts > dump_161121_1129_g0n.hosts
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -qz conv,ip > dump_161121_1129_g0n.conv-ip
-rw-r--r-- 1 miro miro 1357 2016-12-10 17:16 dump_161121_1129_g0n.hosts
-rw-r--r-- 1 miro miro 2824 2016-12-10 17:16 dump_161121_1129_g0n.conv-ip
-rw-r--r-- 1 miro miro 26964 2016-12-10 17:17 dump_161121_1129_g0n.POST
tshark-http-uri.sh -k dump_161121_1129_g0n_SSLKEYLOGFILE.txt -r dump_161121_1129_g0n.pcap
-rw-r--r-- 1 miro miro 23124 2016-12-10 17:17 dump_161121_1129_g0n-frame-http-request-full_uri.txt
# User comment START
# (typed in manually during the run of the script) will have the format that you see here. The prose text will
# be commented, and the commands will be such that, all prerequisites there, simple copying & pasting them can easily be done,
# just like the command lines that the script writes in this file can be copied and pasted and run.
#
# Here's how I prepared the filter for the main PCAP (there may be some extracted PCAPs yet). At this stage the
# dump_161121_1129_g0n-frame-http-request-full_uri.txt, just above, was produced. I inspected it.
#
# The website connected with some firm that does the tracking for T-cogne is represented by the most frequent string in the
# requested uri's. Just grep it like this:
cat dump_161121_1129_g0n-frame-http-request-full_uri.txt \
| grep \
'https://server.lon.liveperson.net/hc/62370768/?'
# Most of those 43 lines you get grep'd out, i.e. 40 of them, start with this longer string:
cat dump_161121_1129_g0n-frame-http-request-full_uri.txt \
| grep \
'https://server.lon.liveperson.net/hc/62370768/?&visitor=172480676440713&msessionkey=5756825085274454102&siteContainer=STANDALONE&site=62370768&cmd=mTa'
# Most of those you get to see how many they are if you append, to the first, and then to the second command, this piped addition:
# ' | wc -l ' but see 'man wc' pls.
#
# Whoever that firm are, behind the liveperson.net, I don't know. They may well be some alias for some big and reknowned company
# known for all the privacy mess they did throughout the world, and which is now often hiding under aliases. I don't know. Just,
# that's not domestic knowledge. But that's tracking, and that's regular routine, and as far as open abuse on the user like what
# you will see that I figured out below, there is no misbehavior nor prank there, only total data collectin, I'm only pointing it
# out as it is courious to me. And for one other thing.
#
# And for one other thing. To grep it out, and see which other uri's were requested..
cat dump_161121_1129_g0n-frame-http-request-full_uri.txt \
| grep -v \
'liveperson.net'
# And then there's only 24 lines left, of which two are mozilla (because I use Firefox for browsing), and another two are
# hotjar.com, probably to do with some commercials showed there. Again, the half-of-the-world dominating company might be hiding
# under that alias.
#
# Indeed, here we go:
cat dump_161121_1129_g0n-frame-http-request-full_uri.txt | grep 'hrvatsk' | wc -l
# gives: 47
cat dump_161121_1129_g0n-frame-http-request-full_uri.txt | grep 'hrvatsk' | grep -v liveperson | wc -l
# gives: 20
#
# So for 20 lines of requested uri's my dear T-cogne was directly responsible.
#
# BTW, T-cogne wasn't even entirely responsible for tracking my presence or absence at/from the website of theirs but it delegated
# some of # those tasks to "liveperson.net".
#
# How do I know that? Because my login name, or username, at https://moj.hrvatskitelekom.hr , is: rovismi1, and if you grep for
# it, you get it in three (3) places, all under "liverperson.net" domain:
cat dump_161121_1129_g0n-frame-http-request-full_uri.txt | grep CustomerLoggedIn=rovismi1
# Add " | awk '{ print $1 }'" to that line just above pls., like this:
cat dump_161121_1129_g0n-frame-http-request-full_uri.txt | grep CustomerLoggedIn=rovismi1 | awk '{ print $1 }'
# and you get:
#
# 393
# 756
# 1835
#
# Just without the '# ' at start of line. What are those? Look up the source of the command called in, find it on:
# https://github.com/miroR/tshark-hosts-conv where currently that script lives: tshark-http-uri.sh. That is the frame.number or
# the ordinal number of the packet in that PCAP.
#
# So these three of the filter lines:
#
# frame.number==393
# frame.number==756
# frame.number==1835
#
# I put in the, what did the standard output say? It said it will look for: dump_161121_1129_g0n_FILTER.ls-1 . So therein the
# three (3) lines go. I've learned to read the network a little, but I'm really not an expert. I don't yet know if looking into
# those will get me any particular information of relevance, not at this time.
#
# But there is more that I found, and what I understand is undeniably relevant for this story.
cat dump_161121_1129_g0n-frame-http-request-full_uri.txt | grep '\.pdf'
# gives you (without '# ':
#
# 885 https://moj.hrvatskitelekom.hr/racuni/pregled-racuna-pdf?serviceid=12018216&metaid=418703738&filename=418703738.pdf
# 1073 https://moj.hrvatskitelekom.hr/racuni/pregled-racuna-pdf?serviceid=12018216&metaid=424888813&filename=424888813.pdf
# 1223 https://moj.hrvatskitelekom.hr/racuni/pregled-racuna-pdf?serviceid=12018216&metaid=431372012&filename=431372012.pdf
# 1358 https://moj.hrvatskitelekom.hr/racuni/pregled-racuna-pdf?serviceid=12018216&metaid=435518423&filename=435518423.pdf
#
# And these are the uri's requested at the click, wait, I'll give you the exact couple of seconds for the, respectively:
# frame.number==885 :
# frame.number==1073
# frame.number==1223
# frame.number==1358
#
firefox https://www.croatiafidelis.hr/foss/cap/cap-161121-t-cogne-pdf/Screen_161121_1129_g0n.webm#t=00:00:40
firefox https://www.croatiafidelis.hr/foss/cap/cap-161121-t-cogne-pdf/Screen_161121_1129_g0n.webm#t=00:01:15
firefox https://www.croatiafidelis.hr/foss/cap/cap-161121-t-cogne-pdf/Screen_161121_1129_g0n.webm#t=00:01:45
firefox https://www.croatiafidelis.hr/foss/cap/cap-161121-t-cogne-pdf/Screen_161121_1129_g0n.webm#t=00:02:07
# You can try replacing 'firefox' in the lines above with maybe 'mpv' or 'mplayer' (if you have any of them installed), or with
# another browser, if it supports HTML5.
#
# That trace was posted very soon after it was taken, which is verifiable by my emails to my provider. So first I'll show to
# anybody interested that indeed it is my trace, because it has my login name on it. That I'll do by filtering on the first batch
# of three frame.number's further above.
#
# And next if I filter those second batch of four frame.number's and I get the Stream numbers out when I filter those, I'll be
# able to give Tshark commands that will extract the tcp.stream's that contain those files requested and served.
#
# Which tcp.stream will contain those fake? or true? --you'll see for yourself-- PDF files so that anybody with even newbie level
# of understanding (but maybe quite some perseverance and/or talent in that case), let alone any IT professional deign of their
# name, for whom this is, or should be, kid's stuff, will be able to extract exactly those files that have been served to me, from
# those tcp.stream's.
#
# Why do I want to give a means to anybody interested to recover exactly the files that served to me from T-cogne's server, during
# my 4 minutes visit to my provider's page?
#
# Because my provider has consistently been claiming those files were fine PDF files, and that they can be opened with, take
# notice, Acrobat Reader (sic!).
#
# Note at proofreading time: and in some way, they were right. Read on.
#
# What follows two lines below is again automatic writing to this file by the script. I will consistently mark User comments with
# START and END.
#
# User comment END
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -V -Y "frame.number==393" > dump_161121_1129_g0n_frame.number==393.txt
-rw-r--r-- 1 miro miro 7371 2016-12-10 20:22 dump_161121_1129_g0n_frame.number==393.txt
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -V -Y "frame.number==756" > dump_161121_1129_g0n_frame.number==756.txt
-rw-r--r-- 1 miro miro 7544 2016-12-10 20:28 dump_161121_1129_g0n_frame.number==756.txt
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -V -Y "frame.number==1835" > dump_161121_1129_g0n_frame.number==1835.txt
-rw-r--r-- 1 miro miro 7585 2016-12-10 20:29 dump_161121_1129_g0n_frame.number==1835.txt
# User comment START
#
# Simple. Nicer those dissections are then what you get about "liveperson.net" from the
# dump_161121_1129_g0n-frame-http-request-full_uri.txt. And if you view these three files just produced, starting from
# dump_161121_1129_g0n_frame.number==393.txt to ...756.txt and to ...1835.txt you'll see that all three of them are part of:
#
# [Stream index: 13]
#
# So I need to remember to run, at the right stage of this run of the script, the filter:
#
# tcp.stream==13
#
# Ah, and, if you viewed them, there's a cookie there, of same characteristics, so same cookie in all three. So I'll also try to
# remember and run the filter:
#
# http.cookie
#
# The first batch of three done, the frame.number's part.
#
# User comment END
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -V -Y "frame.number==885" > dump_161121_1129_g0n_frame.number==885.txt
-rw-r--r-- 1 miro miro 6044 2016-12-10 21:22 dump_161121_1129_g0n_frame.number==885.txt
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -V -Y "frame.number==1073" > dump_161121_1129_g0n_frame.number==1073.txt
-rw-r--r-- 1 miro miro 6048 2016-12-10 21:27 dump_161121_1129_g0n_frame.number==1073.txt
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -V -Y "frame.number==1223" > dump_161121_1129_g0n_frame.number==1223.txt
-rw-r--r-- 1 miro miro 6054 2016-12-10 21:28 dump_161121_1129_g0n_frame.number==1223.txt
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -V -Y "frame.number==1358" > dump_161121_1129_g0n_frame.number==1358.txt
-rw-r--r-- 1 miro miro 6054 2016-12-10 21:29 dump_161121_1129_g0n_frame.number==1358.txt
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -V -Y "tcp.stream==1" > dump_161121_1129_g0n_tcp.stream==1.txt
-rw-r--r-- 1 miro miro 1536192 2016-12-10 21:36 dump_161121_1129_g0n_tcp.stream==1.txt
# User comment START
#
# That's a huge dissection... And I can't even believe. They use M$ servers... Find the line:
#
# Server: Microsoft-IIS/8.5
#
# M$ of any kind is detrimental to society... Also they use ASP pages. And also, Linux servers are dominant in the world,
# corporate or small business or minor entities, and regarded widely to outperform M$ servers.
#
# But at this stage, we need to employ another one of my scripts, the tshark-streams.sh
#
# Pls. find it at:
#
# https://github.com/miroR/tshark-streams
#
# Download it. Issue exactly these commands:
mkdir tStreams
cd tStreams
ln -s ../dump_161121_1129_g0n.pcap
ln -s ../dump_161121_1129_g0n_SSLKEYLOGFILE.txt
tshark-streams.sh -r dump_161121_1129_g0n.pcap -k dump_161121_1129_g0n_SSLKEYLOGFILE.txt
cd -
# Now it should be running. A couple of minutes, unless your machine is very slow/old.
#
# And now we have all the streams extracted from the main PCAP. 37 of them (by four, the files, each tcp.stream gets plain and
# ssl, and ascii and raw).
#
# But if my understanding is correct, the true-or-fake PDF files that T-cogne's M$ server served to me should all four of them to be
# in the tcp.stream==1, which we just got the dissection of by the script.
#
# First, just try and see if you can read anything much from:
#
# tStreams/dump_161121_1129_g0n_s001.txt
#
# That's all you would get to know what is contained in that connection! All is obsured! That's SSL, [S]ecure [S]ocket [L]ayer,
# or TLS, [T]ransport [L]ayer [S]ecurity, the "political" rename of it.
#
# If I didn't give you the SSL keys all of if would remain encrypted mumbo-jumbo like that.
#
# Now try and view:
#
# tStreams/dump_161121_1129_g0n_s001-ssl.txt
#
# Lots of files that I could extract from there, many html/txt, but gzip'ed, others text/javascript, there's also exactly one
# image/png...
#
# But, of course, my target has already been declared earlier in this particular log that you are reading. So, if you:
cat tStreams/dump_161121_1129_g0n_s001-ssl.txt | grep 'GET /racuni/pregled-racuna-pdf?serviceid=12018216&metaid='
# you'll get exactly four founds:
#
# GET /racuni/pregled-racuna-pdf?serviceid=12018216&metaid=418703738&filename=418703738.pdf HTTP/1.1
# GET /racuni/pregled-racuna-pdf?serviceid=12018216&metaid=424888813&filename=424888813.pdf HTTP/1.1
# GET /racuni/pregled-racuna-pdf?serviceid=12018216&metaid=431372012&filename=431372012.pdf HTTP/1.1
# GET /racuni/pregled-racuna-pdf?serviceid=12018216&metaid=435518423&filename=435518423.pdf HTTP/1.1
#
# and sure we are talking exactly those four moments that I gave to-the-second links above, and I'm repasting them here:
firefox https://www.croatiafidelis.hr/foss/cap/cap-161121-t-cogne-pdf/Screen_161121_1129_g0n.webm#t=00:00:40
firefox https://www.croatiafidelis.hr/foss/cap/cap-161121-t-cogne-pdf/Screen_161121_1129_g0n.webm#t=00:01:15
firefox https://www.croatiafidelis.hr/foss/cap/cap-161121-t-cogne-pdf/Screen_161121_1129_g0n.webm#t=00:01:45
firefox https://www.croatiafidelis.hr/foss/cap/cap-161121-t-cogne-pdf/Screen_161121_1129_g0n.webm#t=00:02:07
# (only more compact this time, but it's the same links to peruse)
#
# But the extraction is not done, well it can not be properly done from the ascii extracted stream, but from the binary one.
#
# In case you don't have the hexedit program installed, you'll need to find your own tool. Can't expand on it, I've already spent
# such huge time on this. But for those who do have the hexedit program, here's the explanation what to do.
hexedit dump_161121_1129_g0n_s001-ssl.bin
# Hit tab to go to ascii side (the right side). Now, since the string to find starts with 'racuni/pregled-racuna-pdf', hit "/"
# key, which will open a search for you. In the
# 'Ascii string to search: '
# which presents to you in the middle of the terminal, paste that string, and hit Enter. That's the first found. '/' agiain, what
# you pasted reappears, Enter, you go to second found. '/', Enter, third. '/', Enter, fourth. '/', Enter, but now:
# not found
# (press any key)
# is all you see. So far, just as what I expected I would be seing.
#
# Now, we'll take the last entry, going in reverse, because it's easier for me, at this time.
#
# In the ...tcp.stream==1.txt dissection it looks like this:
#
# GET /racuni/pregled-racuna-pdf?serviceid=12018216&metaid=435518423&filename=435518423.pdf HTTP/1.1
# Host: moj.hrvatskitelekom.hr
# User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
# ...
# Accept-Encoding: gzip, deflate
# Referer: https://moj.hrvatskitelekom.hr/racuni?serviceid=12018216
# Cookie: ...
# Content-Type: application/pdf
# Server: Microsoft-IIS/8.5
# X-RequestId: 4f997372-c2ac-4010-86be-2c8c76c1001b
# Content-Disposition: attachment; filename="435518423.pdf"
# X-AspNet-Version: 4.0.30319
# X-Powered-By: ASP.NET
# Date: Mon, 21 Nov 2016 10:31:55 GMT
# Content-Length: 48347
# %%0.0.062
# %PDF-1.4
# %....
# 6 0 obj
# << /Creator (HP Exstream Version 9.0.110 64-bit)
# /CreationDate (D:20161003000858ZZ)
# /Author (Registered to: HRVATELE)
# /Title ()
# >>
# endobj
# 7 0 obj
# [/Separation /PANTONE#20Rhodamine#20Red#20C /DeviceRGB <</FunctionType 2
# /N 1.0
# /Range [0.0 1.0 0.0 1.0 0.0 1.0]
#
# I looked up a good PDF file from T-cogne, and their PDFs all should apparently start with the string:
#
# %PDF-1.4
#
# But pls. have a look at the "Content-Length: 48347" above. That's exactly the file that they served to me. In the opening pages
# of this story, some twenty days ago now, I have already posted the four files that I'm hunting from the SSL-encrypted trace.
#
# And one of the files is, the fourth one that I downloaded, this one which you can download from:
wget https://www.croatiafidelis.hr/foss/cap/cap-161121-t-cogne-pdf/t-cogne-q-pdf-q/435518423.pdf
# Anyhow you look at it, and you can also see it in the screencast, that in the trace is the file in question. But let's get
# it out from the trace. That should prove my point.
#
# If I set the cursor in the hexedit, in which the dump_161121_1129_g0n_s001-ssl.bin is still open, to the byte just at the start
# of '%PDF' in ascii (of that last found), I see this in the bottom:
#
# --- dump_161121_1129_g0n_s001-ssl.bin --0x2E754/0x42B1E---------------------------------------------------
#
# So I need to convert the 0x2E754 into decimal, and cut, with split ('man split'), that tcp-stream-extracted file (the
# dump_161121_1129_g0n_s001-ssl.bin) at exactly there. Then the part second of the cut will start with '%PDF'.
#
cat dump_161121_1129_g0n_s001-ssl.bin | split -d -b190292 - dump_161121_1129_g0n_s001-ssl.bin
# Now:
ls -ABRgo dump_161121_1129_g0n_s001-ssl.bin01
# must tell you:
#
# -rw-r--r-- 1 82890 2016-12-10 23:54 dump_161121_1129_g0n_s001-ssl.bin01
#
# And opening dump_161121_1129_g0n_s001-ssl.bin01 in hexedit shows you a file that starts with '%PDF'.
hexedit dump_161121_1129_g0n_s001-ssl.bin01
# And that file already is recognized as a PDF file:
file dump_161121_1129_g0n_s001-ssl.bin01
# must give you:
#
# dump_161121_1129_g0n_s001-ssl.bin01: PDF document, version 1.4
#
# and it can be opened by qpdfview (or likely any other PDF viewer):
qpdfview dump_161121_1129_g0n_s001-ssl.bin01
# And in a normal PDF file, this would be the way to go to recover the content from the trace:
# Tab. '/' paste in: 'EOF'. One single found. Move just after it. And one more byte. You see this in bottom:
#
# --- dump_161121_1129_g0n_s001-ssl.bin01 --0xBCD2/0x143CA---------------------------------
#
# And then convert 0xBCD1 to decimal: 48337
cat dump_161121_1129_g0n_s001-ssl.bin01 | split -d -b48337 - dump_161121_1129_g0n_s001-ssl.bin01
# And that would be the correct PDF they should have served to me.
#
# But that's not the file that was served to me.
#
# To get the file, bit by bit, that was served to me, a more trickier dd'ing ('man dd') needs to be done. First, it started
# earlier, 10 bytes earlier. So:
cat dump_161121_1129_g0n_s001-ssl.bin | split -d -b190282 - dump_161121_1129_g0n_s001-ssl.bin
cat dump_161121_1129_g0n_s001-ssl.bin01 | split -d -b48347 - dump_161121_1129_g0n_s001-ssl.bin01
# And now the result, dump_161121_1129_g0n_s001-ssl.bin0100, corresponds, bit by bit, to what T-cogne served to me:
sha256sum dump_161121_1129_g0n_s001-ssl.bin0100 435518423.pdf
1a96e647be941043af47f2ce9fe7ad7283ec2f01fc08813cd363e6b42f3ad416 dump_161121_1129_g0n_s001-ssl.bin0100
1a96e647be941043af47f2ce9fe7ad7283ec2f01fc08813cd363e6b42f3ad416 435518423.pdf
# However, you try and see if the usual good Unix file program ('man file') recognizes that file (it's the same file by content,
# the above, just two different names) as PDF, and you will get:
file dump_161121_1129_g0n_s001-ssl.bin0100
# dump_161121_1129_g0n_s001-ssl.bin0100: data
file 435518423.pdf
# 435518423.pdf: data
#
# And trying to open it in the FOSS program Qpdfview, which I use, because I don't care for frills not GUI thrills, just fails:
qpdfview 435518423.pdf
# Unknown MIME type: application/octet-stream
# "Could not match file type of '435518423.pdf'!"
#
# Let's see if their beloved Acrobat Reader really does it (By now I have figured out what they served to me, and I sure guess
# that it does...)
emerge acroread
# Compiling was next. But it was necessary to manually download that dirt from Adobe's website, because that's not FOSS, Tuxian!
acroread 435518423.pdf
# And, sure enough, first thing, the license!
#
# ADOBE SYSTEMS INCORPORATED
#
# Warranty Disclaimer and Software License Agreement.
#
# THIS DOCUMENT INCLUDES WARRANTY INFORMATION (PART I) AND A LICENSE AGREEMENT GOVERNING
# ...
#
# and I sure accepted it, which is a humiliating experience to me, and it freaking shows that wrongly-put-together PDF file just
# as if it was a correct document.
#
# Of course, the first thing next (did you think I installed it to keep it, that nice looking crap?)
emerge -C acroread
# I have no doubt that they did it on purpose. Wait. What I mean, they absolutely knew what they served to me. They're not as
# stupid to not understand that. To the contrary, although I would have easily understood if any information they related to me as
# to why the file wouldn't open, they intentionally didn't explain what the issue was. That is for sure.
#
# That I claim.
#
# But also, it is likely that they intentionally served what is absolutely not standard PDF, what is broken PDF, to elicit the fud
# here.
#
# And how can you easily figure out a trick like that which those seasoned but malevolent admins play on you?
#
# This issue has been solved, and I now only need to close the run of my script and post all of this in some fashion. I don't
# want to investigate the event with this trace/cast any longer now and maybe not again even later. But this is something to
# remember, and get back, the moral hypocrisy of those dirt needs to be gotten back at.
#
# User comment END
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -V -Y "http.cookie" > dump_161121_1129_g0n_http.cookie.txt
ls: cannot access 'dump_161121_1129_g0n_http.cookie.txt': No such file or directory
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -V -Y "http.cookie_pair" > dump_161121_1129_g0n_http.cookie_pair.txt
ls: cannot access 'dump_161121_1129_g0n_http.cookie_pair.txt': No such file or directory
tshark -o "ssl.keylog_file: dump_161121_1129_g0n_SSLKEYLOGFILE.txt" -r dump_161121_1129_g0n.pcap -V -Y "tcp.stream==13" > dump_161121_1129_g0n_tcp.stream==13.txt
-rw-r--r-- 1 miro miro 1444862 2016-12-11 08:44 dump_161121_1129_g0n_tcp.stream==13.txt
-rw-r--r-- 1 miro miro 200 2016-12-11 11:08 dump_161121_1129_g0n.non-local-hosts-ls-1
# User comment START
#
# Edited the dump_161121_1129_g0n.conv-ip by "Relative start" at this stage, to get the dump_161121_1129_g0n.non-local-hosts-ls-1
# out of it by relative start. Both backed as dump_161121_1129_g0n.conv-ip.O and dump_161121_1129_g0n.non-local-hosts-ls-1.O. From
# the non-local list also removed the local 192.168.1.2.
#
# User comment END
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
81.2.237.32 <-> 192.168.1.2 73 6219 73 10416 146 16635 11.380656313 184.5446
---
2.16.192.225 e199.d.akamaiedge.net
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
2.16.192.225 <-> 192.168.1.2 7 1083 17 1590 24 2673 12.574572536 62.3909
---
54.230.11.156 dnn506yrbagrg.cloudfront.net
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
54.230.11.156 <-> 192.168.1.2 19 2260 14 6270 33 8530 12.840199213 16.6952
---
108.161.188.192 static.hotjar.netdna-cdn.com
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
108.161.188.192 <-> 192.168.1.2 36 4974 31 8975 67 13949 12.951220436 179.1595
---
23.111.9.32 hj-script.hotjar.netdna-cdn.com
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
23.111.9.32 <-> 192.168.1.2 19 2077 13 5846 32 7923 13.118320799 16.3654
---
178.249.99.3 sr4.liveperson.net
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
178.249.99.3 <-> 192.168.1.2 57 5397 57 28392 114 33789 13.125738914 180.4194
---
178.249.99.1 server.lon.liveperson.net
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
178.249.99.1 <-> 192.168.1.2 245 50319 262 233249 507 283568 13.162136250 226.4450
---
54.230.11.48 dnn506yrbagrg.cloudfront.net
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
54.230.11.48 <-> 192.168.1.2 11 1109 7 5419 18 6528 187.756531003 5.8363
---
94.31.29.64 hj-script.hotjar.netdna-cdn.com
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
94.31.29.64 <-> 192.168.1.2 12 1034 9 5434 21 6468 187.916766451 5.6276
---
52.42.26.69 tiles.r53-2.services.mozilla.com
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
52.42.26.69 <-> 192.168.1.2 49 5740 52 17375 101 23115 23.817296769 61.6496
---
54.192.11.47 dcky6u1m8u6el.cloudfront.net
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
54.192.11.47 <-> 192.168.1.2 11 1113 7 5126 18 6239 24.669420637 5.8742
---
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# User comment START
#
# I don't deny that I am disgusted, and also disappointed for having failed myself to figure this out sooner.
# (
# It was in front of my nose, in the very "data" file as the file program called it, but I kept on holding on to the wrong premise
# that those were not PDF files, and it only started dawning on me when I went to analyze the trace, while all that was needed was
# to open that file in the hex editor!
# )
# They were, they were PDF files, only they were (intentionally?) skewed and damaged, with the malformed, offset header at the
# start, for the exact purpose to create FUD here that they actually achieved.
#
# So any Windoze user running their fine Acrobat nice looking crap can open those files, as it recognizes those as PDF. And a
# minimalist Linux user like me, using programs like Qpdfview, of course, can't open those.
#
# By the way, the Qpdfview has never failed opening and viewing any PDF files for me since years! Never once! And I've opened
# dozens and dozens of different files in these years, from various sources. Never once do I remember Qpdfview failing with any!
# Not until I started getting sent by these dirt those skewed PDF files.
#
# So how could I have expected it was this simple trick how they were doing it?
#
# It's not just the Windoze that is dirt. It's some Windoze admins as well. I'm really sorry that this puts in bad light the use
# of a free OS like I use. And I'll see if I can mend to that by contributing in the future to FOSS, however tiny little that I
# will be able to do.
#
# I've forgone analyzing the cookie filters (and why the errors), as well as the tcp.stream==13. The analysis completed so far
# should still be useful for people learning to read the network, I hope.
#
# And you know, I thought of something. You can see I managed to figure all this out on my own. And this file will be the
# testimony to it. I am going to leave it as it is at the end of another one day study on this issue, because I will include, in
# some way, the SHA256 hash of it, and I'll go and ask those dirt (that I pay money that they sopport me, and not hinder me in my
# time on the internet through their servers)...
#
# And I'm going to ask them in the email again (email with the SHA256 of this file), why it is that those files were broken for Qpdfview and for the Unix file
# program? I'll enquire again about it repeatedly if necessary, so this page 2 of the "T-cogne and PDF?" may see the light of day
# only in a few more days. So this very text that you're reading, which will be two things, the log file which it
# originally started as, when it was created, some 26 hours ago:
#
# tshark-hosts-conv_161210_171653.log
#
# and also it will be the page:
#
# https://www.croatiafidelis.hr/foss/cap/cap-161121-t-cogne-pdf/t-cogne-pdf-2.php
#
# and both will have the same content, but the SHA256 that I will include somehow in (some of) my PGP-signed emails to them will
# be of it as the file (because the same text included in the php-html file should be enriched by turning some of the links
# clickable) and...
#
# ...And the link to the email(s) with the SHA256 hash of this file will, once the queries are done, be in the new text, that I
# will add just under:
#
# https://www.croatiafidelis.hr/foss/cenz/iskon-tcom-mr/index.html#fake-pdf
#
# and this will be the local link, in that base T-cogne censorship page, to that which is, at the time of my writing of what you
# are reading in the future from my time, only a planned text:
#
# https://www.croatiafidelis.hr/foss/cenz/iskon-tcom-mr/index.html#broken-pdf
#
# So this file, even if it were to contain gross errors, can't be edited any more. Should there be need for corrections, there
# will be link to errata page for this file, from the base address of the whole story, which is:
#
# https://www.croatiafidelis.hr/foss/cap/cap-161121-t-cogne-pdf/
#
# NOTE: E.g., I can't correct the typo "errara" instead of "errata" in the original document tshark-hosts-conv_161210_171653.log,
# which does not contain this note, but I can correct it in this HTML page that you're reading.
#
# NOTE: A separate errata page may not be necessary. Not many errors, and this very document you're reading, I can, if need be,
# modify/update in the future.
#
# And in the base address page (the index.php, the third previous link above), you will also be able to find the links to (and
# these links here are also those promised in the original document, here modified now --"now" being the time that I'm finally
# preparing to publish this study: 2017-03-23 17:29:59+01:00--):
ls-1pg2, which lists:
pg2/dump_161121_1129_g0n.conv-ip
pg2/dump_161121_1129_g0n.conv-ip.O
pg2/dump_161121_1129_g0n_FILTER.ls-1
pg2/dump_161121_1129_g0n-frame-http-request-full_uri.txt
pg2/dump_161121_1129_g0n_frame.number==1073.txt
pg2/dump_161121_1129_g0n_frame.number==1223.txt
pg2/dump_161121_1129_g0n_frame.number==1358.txt
pg2/dump_161121_1129_g0n_frame.number==1835.txt
pg2/dump_161121_1129_g0n_frame.number==393.txt
pg2/dump_161121_1129_g0n_frame.number==756.txt
pg2/dump_161121_1129_g0n_frame.number==885.txt
pg2/dump_161121_1129_g0n.hosts
pg2/dump_161121_1129_g0n.non-local-hosts-ls-1
pg2/dump_161121_1129_g0n.non-local-hosts-ls-1.O
pg2/dump_161121_1129_g0n.POST
pg2/dump_161121_1129_g0n_tcp.stream==13.txt
pg2/dump_161121_1129_g0n_tcp.stream==1.txt
tStreams/dump_161121_1129_g0n_s001.bin
tStreams/dump_161121_1129_g0n_s001-ssl.bin
tStreams/dump_161121_1129_g0n_s001-ssl.txt
tStreams/dump_161121_1129_g0n_s001.txt
tStreams/dump_161121_1129_g0n_s013.bin
tStreams/dump_161121_1129_g0n_s013-ssl.bin
tStreams/dump_161121_1129_g0n_s013-ssl.txt
tStreams/dump_161121_1129_g0n_s013.txt
and each is hashed in ls-1pg2.sum
which hashes file can be PGP-verified with ls-1pg2.sum.asc.
# And while you can download any of the files necessary for this study separately, if you would like to evaluate for yourself my
# methods I used in this study more seriously, for learning or other purposes, you might be better off using my dump_dLo.sh script
# from my (primitive) program https://github.com/miroR/uncenz.
#
# User comment END
