Wireshark tshark

tshark -r cap.pcap -Y 'http.request.method==POST'

Filter a pcap with tshark by HTTP POST method, the quick way to see data uploads (exfiltration, C2) in web traffic.

Run it on captures when you want to see upload HTTP traffic: the filter http.request.method==POST gives you all POST requests with their destination, size, and content — the typical channel for exfiltration (the attacker uploads stolen data to C2 or a storage service) and for HTTP C2 payloads. In a pcap from a compromised host, POSTs to unusual destinations with suspicious sizes are the finding. tshark also lets you extract fields (uri, content-length) and follow the stream to see the payload.

Don't use it if the traffic is encrypted: HTTPS POSTs are not visible with this filter (only the TLS handshake) — for content you need the session key or decryption. The filter only sees the method: legitimate POSTs (forms, APIs) are the majority in any capture — analyzing destinations and sizes is what separates exfiltration from normal traffic. And watch performance: the display filter (-Y) processes the whole pcap; on large captures, read filters (they don't exist as such, but -Y over the whole file) take time — split or narrow down. For the content of a specific POST, -z follow,http,tcp gives you the full stream.