"I see a lot of ZIP files in my packet capture. What’s inside them?"
unzip -l suspicious.zip Or, if you can’t write to disk: wireshark zip
tshark -r capture.pcap -Y "tcp.payload contains PK\x03\x04" -T fields -e data | xxd -r -p > output.zip This extracts the raw payload data and converts it back to a binary ZIP file. Want to quickly see if the ZIP contains something interesting (like malware or a sensitive config)? "I see a lot of ZIP files in my packet capture