add Using section to readmeHEADmaster

1 files changed, 18 insertions, 1 deletions

diff --git a/README.md b/README.md
index 57349e5..1299011 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,22 @@ Remote Desktop Protocol (rdp) has the ability to use TLS certificates to encrypt
 
 This project can read a packet capture, really any pcap that contains the TLSv1 Certificate protocol, and save from the TLSv1 Certificates packets any pem-format certificates to disk. Of course this project is open-source, so you can adapt it to do whatever you want.
 
+
+## Using
+You need to generate a packet capture file, which can be done with `wireshark` or `tcpdump`. I used filters:
+
+    sudo tcpdump -w ~/packets.in -n -v -A "port 3389 and (tcp[((tcp[12] & 0xf0) >> 2)] = 0x16)"
+
+This filter is taken from [Reference 2](https://stackoverflow.com/questions/39624745/capture-only-ssl-handshake-with-tcpdump).
+
+In wireshark, you can even use a display filter of `tls.handshake.type == 11` as well.
+
+With the output file `~/packets.in`, run the main utility with this file as a parameter.
+
+    ./read_rdp_cert.py --pcapfile ~/packets.in
+
+The utility will extract all certificates that it can find from the tls handshake packets, into the current directory.
+
 ## Reason for existence
 I have not found on the Internet appears how to read RDP certificates.
 
@@ -14,7 +30,8 @@ I have not researched these alternatives thoroughly, but they showed possible al
 * pyshark lib [https://security.stackexchange.com/questions/123851/how-can-i-extract-the-certificate-from-this-pcap-file](https://security.stackexchange.com/questions/123851/how-can-i-extract-the-certificate-from-this-pcap-file)
 
 ## References
-The `iplayer_from_raw` function is almost directly from [cuckoolinux -> network.py](https://github.com/0x71/cuckoo-linux/blob/82263c5df40ebe70dc35976b917293eb54a363af/modules/processing/network.py) and is licensed GPL-3.
+1. The `iplayer_from_raw` function is almost directly from [cuckoolinux -> network.py](https://github.com/0x71/cuckoo-linux/blob/82263c5df40ebe70dc35976b917293eb54a363af/modules/processing/network.py) and is licensed GPL-3.
+2. [https://stackoverflow.com/questions/39624745/capture-only-ssl-handshake-with-tcpdump](https://stackoverflow.com/questions/39624745/capture-only-ssl-handshake-with-tcpdump)
 
 ## License
 GPL-3