Week-12 - Network Forensics Lab 2: Email Reconstruction

Aim

Reconstruct email communications from captured SMTP traffic. You will extract sender/recipient information, decode Base64-encoded credentials, and recover the full email content including attachments.

Learning Objectives

• Understand the SMTP protocol and how email is transmitted
• Identify email metadata in packet captures
• Decode Base64-encoded usernames and passwords
• Reconstruct complete email messages from network traffic
• Extract timestamps for forensic timelines

Resources Needed

• Wireshark
• Lab file: smtp.pcap, you can find the file in you Cyberlab or you can download from here.
• Python 3 (for Base64 decoding) or online Base64 decoder OR you can use this decoder https://www.base64decode.org

Background

RECAP: Simple Mail Transfer Protocol (SMTP)

SMTP is used for sending email across the Internet. It is a plain text protocol, meaning data is not encrypted by default.

SMTP Commands

SMTP Response Codes

Base64 Encoding

SMTP uses Base64 to encode credentials during AUTH LOGIN. Base64 is encoding, not encryption - it can be easily decoded. This is why unencrypted SMTP is a security risk.

Part A: Initial Traffic Analysis

Task 1: Open and Filter SMTP Traffic

1. Open smtp.pcap in Wireshark
2. Observe the packet list

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Task 2: Identify the Mail Server

3. Find the first SMTP response packet (look for code 220 "Service ready")
4. Examine the server's greeting message

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Part B: Authentication Analysis

Task 3: Find the Authentication Sequence

5. Look for the AUTH LOGIN command from the client
6. Examine the server's responses (334 codes) and client's replies

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Task 4: Extract and Decode Credentials

7. Find the client's response to the username challenge (packet after 334)
8. Find the client's response to the password challenge

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Task 5: Decode the Credentials

9. Use Python or an online decoder to decode the Base64 strings:

Python method:

import base64
print(base64.b64decode("Z3VycGFydGFwQHBhdHJpb3RzLmlu").decode('utf-8'))
print(base64.b64decode("cHVuamFiQDEyMw==").decode('utf-8'))

Command line method:

echo "Z3VycGFydGFwQHBhdHJpb3RzLmlu" | base64 -d
echo "cHVuamFiQDEyMw==" | base64 -d

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Part C: Email Reconstruction

Task 6: Extract Email Metadata

10. Find the MAIL FROM command
11. Find the RCPT TO command

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Task 7: Follow the TCP Stream

12. Right-click on any SMTP packet → Follow → TCP Stream
13. This displays the complete SMTP conversation

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Task 8: Extract Email Content

14. In the TCP stream, find the email body (after the DATA command and headers)

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Hello

I send u smtp pcap file

Find the attachment

GPS

Your Answer: _______________________________________________

Part D: Timeline Construction

Task 9: Build a Forensic Timeline

Using packet timestamps and the email headers, complete this timeline:

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Part E: Export and Verification

Task 10: Export Email Objects

15. Go to File → Export Objects → IMF (Internet Message Format)
16. Check if Wireshark can extract the email message

Your Answer: _______________________________________________

Your Answer: _______________________________________________

Key Findings

In this lab, you reconstructed an email with the following details:

Useful Wireshark Filters

Base64 Decoding Reference

import base64
decoded = base64.b64decode("encoded_string").decode('utf-8')
print(decoded)

Best,

Ali.