Ncovert2 – How it works, pt.2

Receiver sniffs for packet for destination address with destination port of 80
Receiver extracts session key from IP ID and source port using SHA-1 hash
Receiver extracts file size from ISN using session key
Sender and receiver generate session hash from session key and SHA-1 password hash, for creating predictable source ports

Receiver sniffs for packet for destination address with destination port of 80