# Analyzing Protocols: DNS and HTTP

Most malware needs to communicate with the outside world. To blend in, it often uses the same protocols as normal web browsing: DNS and HTTP. 

## DNS (Domain Name System)
Before malware can connect to `evil.com`, it must ask DNS for the IP address of that domain.
*   **Port:** UDP 53.
*   **Forensic Value:** DNS occurs *before* the connection. Because DNS is usually unencrypted, you can see every domain a computer tries to visit.
*   **Key Indicator:** Look for DGA (Domain Generation Algorithms). If you see a machine making DNS queries for `qbxvzmpklj.com`, `zxywqabcn.net`, etc., it is highly likely infected with malware trying to find its Command and Control server.

## HTTP (Hypertext Transfer Protocol)
HTTP is the foundation of the web, but it's also perfect for malware because it is almost never blocked by firewalls. 

When analyzing HTTP, look closely at these fields:
1.  **User-Agent:** This tells the server what browser the client is using (e.g., `Mozilla/5.0 (Windows NT 10.0...)`). 
    *   *Red Flag:* Malware often uses default, hardcoded User-Agents missing typical browser strings, like simply `curl/7.68.0`, `python-requests/2.25.1`, or even unique strings like `Go-http-client/1.1`.
2.  **URI (Uniform Resource Identifier):** The actual path of the file requested (e.g., `/images/logo.png`).
    *   *Red Flag:* Extremely long URIs with random characters might indicate data exfiltration encoded in the URL itself.
3.  **HTTP Status Codes:**
    *   **200 OK:** The server successfully received and answered the request (The malware successfully downloaded its payload).
    *   **404 Not Found:** The target file isn't there (The C2 server infrastructure might have been taken down).

## Extracting Files from PCAPs
If an employee downloads a suspicious executable over HTTP (unencrypted), that entire executable is stored inside the PCAP file. You can extract it.

In Wireshark:
1. Go to **File -> Export Objects -> HTTP**.
2. Wireshark will present a list of every file transferred over HTTP during the capture.
3. Select the file and click "Save As" to dump the actual file to your hard drive for malware analysis.