Malcolm

Malcolm Malcolm 是一个强大的网络流量分析工具套件，旨在实现以下目标： 易于使用 – Malcolm 接受全包捕获（PCAP）文件、Zeek 日志和 Suricata 警报形式的网络流量数据。这些工件可以通过简单的基于浏览器的界面上传，或使用轻量级转发器被动捕获并实时转发给 Malcolm。无论哪种方式，数据都会被自动标准化、丰富并关联以进行分析。 强大的流量分析 – 通过两个直观的界面提供网络通信的可见性：OpenSearch Dashboards（一种灵活的数据可视化插件，提供数十个预置仪表板，可一目了然地查看网络协议）和...

squidmagic

Squidmagic 是一个旨在分析基于 Web 的网络流量，利用 Squid 代理服务器和 Spamhaus 来检测中央命令与控制（C&C）服务器及恶意站点的工具。 安装依赖 root@kitploit: pip install -r requirements.txt 使用方法 root@kitploit: python squidmagic.py /squid/access.log | | | | / |/ | | | | |/ | ' \ / |/ | |/ | \ \ | | || | | | | | | | | | | | | | | |/, |,||,|| ||...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

rita

RITA（实时智能威胁分析） 如果您从RITA中获得了价值，并希望进一步实现狩猎自动化、未来可视化及数据增强，那么请查看 AC-Hunter。 由 Active Countermeasures 为您呈现。 由 BHIS 赞助。 RITA 是一个用于网络流量分析的开源框架。 该框架支持以 TSV 或 JSON 格式导入 Zeek 日志，目前主要支持以下功能： 信标检测 ：搜索网络内部和外部的信标行为迹象 长连接检测 ：轻松查看长时间通信的连接 DNS 隧道检测 ：搜索基于 DNS 的隐蔽信道迹象 威胁情报源检查 ：查询威胁情报源以搜索可疑域名和主机 快速开始 请参阅我们推荐的...

Malcolm

Malcolm Malcolm 是一套强大的网络流量分析工具套件，其设计目标如下： 易于使用 – Malcolm 接受全流量数据包捕获（PCAP）文件、Zeek 日志和 Suricata 告警等形式的数据。这些内容可通过简单的浏览器界面上传，或使用轻量级转发器进行被动实时捕获并转发至 Malcolm。无论采用哪种方式，数据都会被自动归一化、丰富化并关联以进行分析。 强大的流量分析能力 – 通过两个直观界面提供网络通信可见性：OpenSearch Dashboards（一个灵活的数据可视化插件，内置数十个预建仪表板，可概览网络协议）和...

Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

Web-Attack-Detection-Lab

!Kali Linuxhttps://img.shields.io/badge/KaliLinux-557C94?sty...

Ethical-Hacking-Tools-Level2

🛡️ Cybersecurity & Python Portfolio - Level 2 Author: Pa...

ReGAIN: Retrieval-Grounded AI Framework for Network Traffic Analysis

Modern networks generate vast, heterogeneous traffic that must be continuously analyzed for security and performance. Traditional network traffic analysis systems, whether rule-based or machine learning-driven, often suffer from high false positives and lack interpretability, limiting analyst...

Binary and Multiclass Cyberattack Classification on GeNIS Dataset

The integration of Artificial Intelligence AI in Network Intrusion Detection Systems NIDS is a promising approach to tackle the increasing sophistication of cyberattacks. However, since Machine Learning ML and Deep Learning DL models rely heavily on the quality of their training data, the lack of...

EUVD-2020-4276

Malware in sbrugna...

Exploit for Missing Authorization in Elementor Website_Builder

Отчёт по учебной практике Содержание - 1. Введение1-в...

maltrail

It is an offensive tool for network traffic analysis. The primary CVE ID is not present in the provided context, but the tool is designed to detect malicious traffic. The target product/service or framework is not explicitly stated, but it is likely a network traffic analysis system. The...

The vulnerability of the network traffic analysis, network detection, and response tool Palo Alto Networks Cortex XDR Agent, related to the handling of the zero pointer, allows attackers to trigger a service failure.

The vulnerability of the Palo Alto Networks Cortex XDR Agent, which is used for network traffic analysis, network detection, and response, relates to the handling of the zero pointer. Exploiting this vulnerability could allow attackers to trigger service failures...

The vulnerability of the detection mechanism for network traffic analysis tools, network detection, and response by Palo Alto Networks’ Cortex XDR Agent on Windows operating systems allows attackers to disable the Cortex XDR Agent and execute arbitrary code.

The vulnerability of the detection mechanism for network traffic analysis, network detection, and response by Palo Alto Networks’ Cortex XDR Agent in Windows operating systems is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could allow an attack...

TrafficWatch - TrafficWatch, A Packet Sniffer Tool, Allows You To Monitor And Analyze Network Traffic From PCAP Files

TrafficWatch, a packet sniffer tool, allows you to monitor and analyze network traffic from PCAP files. It provides insights into various network protocols and can help with network troubleshooting, security analysis, and more. Protocol-specific packet analysis for ARP, ICMP, TCP, UDP, DNS, DHCP,...

Input validation

A Denial of Service Dos vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionality of our IDS, allows an unauthenticated attacker to crash the IDS module by sending specially crafted malformed network packets...

PT-2022-37672 · Palo Alto Networks · Cortex Xdr Agent

Уязвимость средства анализа сетевого трафика, сетевого обнаружения и реагирования Cortex XDR Agent связана с недостатками разграничения доступа. Эксплуатация уязвимости может позволить нарушителю получить несанкционированный доступ к защищаемой информации...

Cisco Secure Network Analytics Remote Code Execution Vulnerability

Cisco Secure Network Analytics is one of the most comprehensive visibility and network traffic analysis Nta/network detection and response Ndr solutions from Cisco. Cisco Secure Network Analytics is vulnerable to a remote code execution vulnerability that could be exploited by an attacker to...

The vulnerability of the print_prefix function in tcpdump software for network traffic analysis, related to reading data beyond the buffer’s allowed limits, allows a hacker to gain access to confidential data.

The vulnerability of the printprefix function in software for analyzing network traffic using tcpdump relates to reading data from within allowable buffer limits. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data...