2021-09-21

2022-10-15

My Account at Open.Tube Peertube Instance Compromized 3

Recovering The Lost Video Upload on My Traffic Incident

(No. 0)  No. 1  No. 2  No. 3 

---

Here the network trace pertaining to this screencast:
dump_210214_2100_gdO.pcap

From that screencast you can recover the video that I uploaded in that session to Open.Tube.

View from 1:20. You can see a file is named:
VID_20201105_zov_svjedoci_x265_ALL.mp4
in my computer, and you can see I chose that file to upload it to Open.Tube.

Now, you can open the trace in Wireshark, give it the:
dump_210214_2100_gdO_TLSKEYLOGFILE.txt
so it can decrypt the TLS and extract http objects into a folder somewhere. A lot of files will be extracted. The largest one will be named:
upload
and from byte 1042 it contains fully and only that video.

You can also run this command, after you download the files listed below:

tshark -otls.keylog_file:dump_210214_2100_gdO_TLSKEYLOGFILE.txt \
	-r dump_210214_2100_gdO.pcap -q --export-object http,some-folder
Same as with Wireshark, the largest file will be: upload
Now execute this:
tail -c+1042 upload > VID_20201105_zov_svjedoci_x265_ALL.mp4

That is bit-to-bit undeniably the video file that was at that time in my computer, which I chose to upload to Open.Tube.

---

The files necessary for this study:
dump_210214_2100_gdO.pcap
dump_210214_2100_gdO_TLSKEYLOGFILE.txt
Screen_210214_2100_gdO.webm
pg3.txt
are also listed in: ls-1pg3
and verify to these SHA256: ls-1pg3.sum
signed: ls-1pg3.sum.asc
with my public PGP-key).