2021-09-21
2022-10-15
My Account at Open.Tube Peertube Instance Compromized 3
Recovering The Lost Video Upload on My Traffic Incident
---
Here the network trace pertaining to this screencast:
dump_210214_2100_gdO.pcap
From that screencast you can recover the video that I uploaded in that session to Open.Tube.
View from 1:20. You can see a file is named:
VID_20201105_zov_svjedoci_x265_ALL.mp4
in my computer, and you can see I chose that file to upload it to Open.Tube.
Now, you can open the trace in Wireshark, give it the:
dump_210214_2100_gdO_TLSKEYLOGFILE.txt
so it can decrypt the TLS and extract http objects into a folder somewhere. A lot of files will be extracted. The largest one will be named:
upload
and from byte 1042 it contains fully and only that video.
You can also run this command, after you download the files listed below:
tshark -otls.keylog_file:dump_210214_2100_gdO_TLSKEYLOGFILE.txt \ -r dump_210214_2100_gdO.pcap -q --export-object http,some-folderSame as with Wireshark, the largest file will be: upload
Now execute this:
tail -c+1042 upload > VID_20201105_zov_svjedoci_x265_ALL.mp4That is bit-to-bit undeniably the video file that was at that time in my computer, which I chose to upload to Open.Tube.
---
The files necessary for this study:
dump_210214_2100_gdO.pcap
dump_210214_2100_gdO_TLSKEYLOGFILE.txt
Screen_210214_2100_gdO.webm
pg3.txt
are also listed in: ls-1pg3
and verify to these SHA256: ls-1pg3.sum
signed: ls-1pg3.sum.asc
with my public PGP-key).