drovorub-hunt

Dispatches from Drovorub: Network Threat Hunting for Russia GRU GTsSS' Malware at Scale Recently, the National Security Agency and Federal Bureau of Investigation released a report outlining command and control capabilities leveraged by the Russian General Staff Main Intelligence Directorate GRU...

IpGeo

IPGeo IpGeo is a python tool to extract IP addresses from captured network traffic file pcap/pcapng and generate csv report containing details about the geolocation of each ip in the packets. The report contains: 1. Country: 2. Country Code. 3. Region 4. Region Name 5. City 6. Zip 7. Latitude 8...

PcapViz

PcapViz PcapViz draws networks as device topologies and as information flows using the packet information in pcap files captured from a network device using tcpcap or other capture software. It filters and optionally displays the captured packets at any one of 3 "layers". These are: device level...

Bryobio

Bryobio🕷️ NETWORK Pcap File Analysis It was developed to speed up the processes of SOC Analysts during analysis🕷️ This tool is valuable for cybersecurity professionals, particularly in analyzing and understanding network traffic and potential security threats. The provided illustration reflects the...

so-crates

SO-CRATES Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus A standalone web application for analyzing pcap files, log files, and binary files. Features include Suricata network analysis, YARA binary scanning, Sigma rule detection for logs, and a single-page UI for browsing...

doublepulsar-c2-traffic-decryptor

著者: Luke Jennings [email protected] - @jukelennings 会社: Countercept @countercept ウェブサイト: https://countercept.com PCAPファイルからDOUBLEPULSAR...

BlueFish

BlueFish BlueFish is a Python-based automation tool designed to simplify the analysis of PCAP Packet Capture files. It leverages the power of Wireshark's command-line tool, tshark, to extract valuable information from network captures. With BlueFish, you can quickly identify potential login...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark는 가장 널리 사용되는 네트워크 트래픽 분석기입니다. 라이브 트래픽 분석과 포렌식/멀웨어 분석가를 위한 포렌식 분석 모두에 중요한 도구입니다. Wireshark가 프로토콜 파싱 및 필터링을 위한 엄청나게 강력한 기능을 제공하지만, 네트워크 엔드포인트에 대한 컨텍스트 정보는 제공하지 않습니다. 악성 활동을 식별하기 위해 GBs 단위의 PCAP 파일을 샅샅이 뒤져야 하는 일반 분석가에게는 건초더미에서 바늘을 찾는 것과 같습니다. Wireshark Forensics...

TrafficWatch

TrafficWatch TrafficWatch, a packet sniffer tool, allows you to monitor and analyze network traffic from PCAP files. It provides insights into various network protocols and can help with network troubleshooting, security analysis, and more. Features Protocol-specific packet analysis for ARP, ICMP...

NetworkAssessment

NetworkAssessment: Network Compromise Assessment Tool The Network Compromise Assessment Tool is designed to analyze pcap files to detect potential suspicious network traffic. This tool focuses on spotting abnormal activities in the network traffic and searching for suspicious keywords. Features D...

sharker

Sharker: Wiresharkが終わったところから、私たちは始まる Sharkerは、PCAPファイルやライブインターフェースから価値あるデータを抽出するための、強力で拡張可能なツールです。tshark のパワーを活用してネットワークキャプチャを効率的に解析し、柔軟なフィルタリングシステムを適用して、有益な情報を正確に特定・抽出します。 主な機能 拡張可能なフィルタリング: Pythonベースのフィルタを作成して、ネットワークパケットからあらゆるデータを抽出できます。 強力なフィルタリングエンジン: フィルタやフィルタカテゴリを選択的に有効/無効にして、分析を微調整し高速化できます...

XLS-to-DBatLoader-or-GuLoader-for-AgentTesla-variant

THE ANALYZED FILE PCAP-Based Analysis | Date: 2025-03-12 | Author: BlackOclock TABLE OF CONTENTS 1. ANALYSIS OVERVIEW 1.1 The Analyzed File PCAP Only 1.2 Infection Timeline & CVE Mapping 2. NETWORK TRAFFIC ANALYSIS 2.1 Protocol Hierarchy – Big Picture 2.2 Conversations – Top Talkers & Data...

Network-Analysis-Tools

Pcap Capture File Analysis Toolv.1 !CONTACT! | Email: [email protected] | | Github: github/azizaltuntas | | Twitter: @esccopyright | Features 1-Top 10 Visited Sites 2-Emails 3-All Request Urls 4-User-Agents List 5-String Grep Mode 6-Connection details 7-Ports Used 8-ALL Ip List 9-Manuel Pack...

ipdecap

ipdecap pcapファイルから、GRE、IPIP、6in4、ESP（ipsec）プロトコルでカプセル化されたトラフィックをデカプセル化します。 IEEE 802.1Q（仮想LAN - VLAN）ヘッダーの削除も可能です。 ドキュメントは http://loicpefferkorn.net/ipdecap で入手可能です。...

ramnit_traffic_parser

ramnittrafficparser Ramnit と C2 間のトラフィックデータがあれば、設定とモジュールをダンプできます。 必要なもの PHP 7 tshark 使い方 $ php main.php pcap/URL 例 $ php main.php "https://content.any.run/tasks/b1cf6c3e-f079-49b4-9798-44a7c511d194/download/pcap" + REGISTERBOT0xe2 : output/00e2.bin + REGISTERBOT0xe2 : output/01e2.bin +...

log4j-pcap-activity

log4j-pcap-activity A fun activity using a packet capture file from the log4j exploit CVE-2021-44228 Instructions Open wireshark and import the PCAP located in this repository: log4j-exploit.pcap. Looking at the packets, answer the following questions. Questions Easy 1. Which Packet numbers conta...

termshark

Termshark tshark のターミナルユーザーインターフェースで、Wireshark に触発されたものです。 V2.4 がリリースされました。パケット検索、カラーとカラムのプロファイル機能を搭載！詳細はチェンジログ をご覧ください。 リモートマシンで大きな pcap ファイルをデバッグしていて、scp でデスクトップに戻したくない場合、termshark が役立ちます！ 機能 pcap ファイルの読み取り、またはライブインターフェースのスニッフィング（tshark が許可されている場合） Wireshark のディスプレイフィルターを使用した pcap...

PrintNightmare

PrintNightmare Check if your post-Patch machine is still vulnerable Guidance on how to implement a non-malicious, 'defanged' version of the exploit. Research piece that dissects captured network traffic of the PrintNightmare exploit Analysis of a PCAP that contains malicious traffic from...

pcapan

pcapan pcapキャプチャ解析ヘルパー 使用方法: $ git clone https://github.com/synacktiv/pcapan $ cd pcapan $ cargo run -- --pcap /tmp/capture.pcap --google -w whitelist.yaml Finished dev unoptimized + debuginfo targets in 0.04s Running target/debug/pcapan --pcap /tmp/log.tcpdump --google -w whitelist.yaml loading...

qub-network-security-cve-2023-20198

🛡️ qub-network-security-cve-2023-20198 Analysis, detection, and mitigation of CVE-2023-20198 exploitation in Cisco IOS XE 📘 Queen’s University Belfast – CSC3064 Network Security Assessment 📋 Assessment Overview This project involves analyzing PCAP files provided by Fox-IT to: Identify Indicators o...