pyshark

pyshark Python wrapper for tshark, allowing python packet parsing using wireshark dissectors. Extended documentation: http://kiminewt.github.io/pyshark Looking for contributors - for various reasons I have a hard time finding time to maintain and enhance the package at the moment. Any...

BlueFish

BlueFish BlueFish is a Python-based automation tool designed to simplify the analysis of PCAP Packet Capture files. It leverages the power of Wireshark's command-line tool, tshark, to extract valuable information from network captures. With BlueFish, you can quickly identify potential login...

tsharkVM

💡 Update: tshark-opensearch More recent application tshark-opensearch is now available. You can find it in the https://github.com/h21-lab/apps-collection-info repository. 👉 Get Access tshark ELK VM appliance This project builds virtual machine which can be used for analytics of tshark -T ek ndjso...

sharker

Sharker: where Wireshark ends, we begin Sharker is a powerful and extensible tool for extracting valuable data from PCAP files or from live interfaces. It leverages the power of tshark to efficiently parse network captures and applies a flexible filtering system to pinpoint and extract juicy...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

Krb5RoastParser

Krb5RoastParser 📑 Table of Contents ❓ What is Krb5RoastParser? ⭐ Features ⚙️ Installation ▶️ Execution 📈 Post Execution 📜 License ❓ What is Krb5RoastParser? Krb5RoastParser is a tool designed to parse Kerberos authentication packets AS-REQ, AS-REP and TGS-REP from .pcap files and generate...

babyshark

babyshark Wireshark made easy in your terminal. Babyshark is a PCAP TUI that helps you answer: What’s using the network? What looks broken/weird? What should I select next? Status: v0.3.0 alpha. Offline .pcap / .pcapng viewing works without Wireshark Live capture requires tshark Wireshark CLI...

termshark

Termshark A terminal user-interface for tshark, inspired by Wireshark. V2.4 is out now with packet search and profiles for colors and columns! See theChangeLog. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Features Rea...

hfinger

Hfinger - fingerprinting malware HTTP requests Tool for fingerprinting HTTP requests of malware. Based on Tshark and written in Python3. Working prototype stage :- Its main objective is to provide unique representations fingerprints of malware requests, which help in their identification. Unique...

wifite2

Wifite This repo is a complete re-write of wifite, a Python script for auditing wireless networks. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Wifite is designed to use all known methods for retrieving the password of a wireless access point...

pyshark-legacy

pyshark This repository is for the legacy version of pyshark, which works on Python2.7+. It only receives bugfixes after version 0.3.8. For the new version that's only supported on Python 3.5+, please use themain repo Python wrapper for tshark, allowing python packet parsing using wireshark...

wireshark

General Information Wireshark is a network traffic analyzer, or "sniffer", for Linux, macOS, BSD and other Unix and Unix-like operating systems and for Windows. It uses Qt, a graphical user interface library, and libpcap and npcap as packet capture and filtering libraries. The Wireshark...

pcapinator

pcapinator An application to deal with lots of pcaps by running lots of tsharks Setup Install Python3, the one true Python... root@kitploit: pip install python-dateutil pandas Features Recursively process multiple PCAP files including those in subdirectories. Wrapper around editcap Wireshark Tool...

Wireshark

Общие сведения Wireshark — это анализатор сетевого трафика или «сниффер» для Linux, macOS, BSD и других Unix-подобных операционных систем, а также для Windows. Он использует Qt — библиотеку графического интерфейса пользователя, а также libpcap и npcap в качестве библиотек захвата и фильтрации...

termshark

Termshark tshark를 위한 터미널 사용자 인터페이스로, Wireshark에서 영감을 받았습니다. V2.4가 출시되었으며, 패킷 검색 및 색상 및 열 프로필을 지원합니다!변경 로그를 확인하세요. 원격 머신에서 대용량 pcap을 디버깅 중이고, scp로 데스크톱으로 다시 복사하고 싶지 않다면, termshark가 도움이 될 수 있습니다! 기능 pcap 파일 읽기 또는 실시간 인터페이스 스니핑 tshark가 허용되는 경우 Wireshark의 디스플레이 필터를 사용하여 pcap 또는 실시간 캡처 필터링 TCP 및 UDP 흐...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...

PYSEC-2026-3426 wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured

Description Impact wireshark-mcp exposes a wiresharkexportobjects MCP tool that accepts an attacker-controlled destdir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction. The path sandbox alloweddirs is None by default and only activates when the...

CVE-2026-43901

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wiresharkexportobjects MCP tool that accepts an attacker-controlled destdir parameter and passes it to tshark's...

CVE-2026-43901

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wiresharkexportobjects MCP tool that accepts an attacker-controlled destdir parameter and passes it to tshark's...

CVE-2026-43901 Wireshark MCP: Arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wiresharkexportobjects MCP tool that accepts an attacker-controlled destdir parameter and passes it to tshark's...