rita

RITA（实时智能威胁分析） 如果您从RITA中获得了价值，并希望进一步实现狩猎自动化、未来可视化及数据增强，那么请查看 AC-Hunter。 由 Active Countermeasures 为您呈现。 由 BHIS 赞助。 RITA 是一个用于网络流量分析的开源框架。 该框架支持以 TSV 或 JSON 格式导入 Zeek 日志，目前主要支持以下功能： 信标检测 ：搜索网络内部和外部的信标行为迹象 长连接检测 ：轻松查看长时间通信的连接 DNS 隧道检测 ：搜索基于 DNS 的隐蔽信道迹象 威胁情报源检查 ：查询威胁情报源以搜索可疑域名和主机 快速开始 请参阅我们推荐的...

wireshark

Información general Wireshark es un analizador de tráfico de red, o "sniffer", para Linux, macOS, BSD y otros sistemas operativos Unix y similares a Unix, y para Windows. Utiliza Qt, una biblioteca de interfaz gráfica de usuario, y libpcap y npcap como bibliotecas de captura y filtrado de paquete...

tcpflow

TCPFLOW 1.5.0 Downloads directory: http://digitalcorpora.org/downloads/tcpflow/ Installation Most common GNU/Linux distributions ship tcpflow in their repositories. So on Debian/Ubuntu/etc you can say root@kitploit: sudo apt-get install tcpflow and on Fedora/RedHat/CentOS/etc you can say...

Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

libretto

Libretto Libretto es un conjunto de herramientas para construir integraciones web robustas. Le proporciona a tu agente de codificación un navegador en vivo y una CLI eficiente en tokens para: Inspeccionar páginas en vivo con mínimo overhead de contexto Capturar tráfico de red para realizar...

PCAPdroid

PCAPdroid PCAPdroid es una aplicación de código abierto respetuosa con la privacidad que te permite rastrear, analizar y bloquear las conexiones realizadas por otras aplicaciones en tu dispositivo. También te permite exportar un volcado PCAP del tráfico, inspeccionar HTTP, descifrar tráfico TLS y...

Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

NetworkAssessment

NetworkAssessment: 网络入侵评估工具 网络入侵评估工具旨在分析pcap文件以检测潜在的可疑网络流量。该工具专注于发现网络流量中的异常活动并搜索可疑关键词。 功能特性 DNS隧道检测 ：识别通过DNS的潜在隐蔽通信通道。 SSH隧道检测 ：发现可能用于绕过网络限制或隐藏恶意活动的SSH会话迹象。 TCP会话劫持识别 ：监控可能指示未授权接管行为的可疑TCP会话。 多种攻击特征 ：识别SYN洪水、UDP洪水、Slowloris、SMB攻击等指标。 可疑关键词搜索 ：主动扫描网络流量中用户定义的关键词，这些关键词可能表明恶意意图或敏感数据泄露。 协议特定扫描...

OpenFPC

OpenFPC 全包捕获：开源且运行在你自己的普通硬件上。 OpenFPC 是一组脚本，它们组合起来提供轻量级全包网络流量记录和缓冲工具。其设计目标是允许非专家用户在商用现成（COTS）硬件上部署分布式网络流量记录器，同时集成到现有的警报和日志工具中。 寻找文档？ 安装说明 开始使用 Openfpc-client 请注意，所有文档仍在完善中... 更多信息请访问 www.openfpc.org...

tsusen

Tsusen 津波センサー is a standalone network sensor made for gathering information from the regular traffic coming from the outside i.e. Internet on a daily basis e.g. mass-scans, service-scanners, etc.. Any disturbances should be closely watched for as those can become a good prediction base of...

sniffles

Sniffles--Packet Capture Generator for IDS and Regular Expression Evaluation Sniffles is a tool for creating packet captures that will test IDS that use fixed patterns or regular expressions for detecting suspicious behavior. Sniffles works very simply. It takes a set of regular expressions or...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...

StreamDivert

StreamDivert StreamDivert is a tool to man-in-the-middle or relay in and outgoing network connections on a system. It has the ability to, for example, relay all incoming SMB connections to port 445 to another server, or only relay specific incoming SMB connections from a specific set of source IP...

fapro

FaPro Free,Cross-platform,Single-file mass network protocol server simulator 中文Readme Description FaPro is a Fake Protocol Server tool, Can easily start or stop multiple network services. The goal is to support as many protocols as possible, and support as many deep interactions as possible for...

curveball_lua

curveballlua Repo containing lua scripts and PCAP to find CVE-2020-0601 exploit attempts via network traffic...

sdnpwn

What is sdnpwn? sdnpwn is a toolkit and framework for testing the security of Software-Defined Networks SDNs. For more information check out this article: https://sdnpwn.net/2017/08/22/what-is-sdnpwn/ Installation First download sdnpwn using git root@kitploit: git clone...

chameleon

19个可定制的蜜罐，用于监控网络流量、机器人活动以及用户名/密码凭证（DNS、HTTP代理、HTTP、HTTPS、SSH、POP3、IMAP、STMP、RDP、VNC、SMB、SOCKS5、Redis、TELNET、Postgres、MySQL、MSSQL、Elastic和LDAP） 如果你想在自己的项目中实现这些蜜罐，请查看 QeeqBox蜜罐 Chameleon被认为非常有效。这是一个主动防御工具。该系统模拟开放的、未受保护的端口，并应对漏洞探测尝试 — Dean Chester，cooltechzone 主编 把蜜罐带进你的生活 by Héctor Herrero, bujarra...

chameleon

19 Customizable honeypots for monitoring network traffic, bots activities, and username\password credentials DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, RDP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres, MySQL, MSSQL, Elastic and ldap If you want to implement the honeypots in your project,...

PacketSpy

PacketSpy 描述 PacketSpy 是一款强大的网络数据包嗅探工具，专为捕获和分析网络流量而设计。它提供了一套全面的功能，用于检查 HTTP 请求与响应、查看原始负载数据以及收集网络设备信息。借助 PacketSpy，您可以深入了解网络的通信模式，并有效排查网络问题。 特点 数据包捕获 ：实时捕获并分析网络数据包。 HTTP 检查 ：检查 HTTP 请求与响应，进行详细分析。 原始负载查看 ：查看原始负载数据，用于深入调查。 设备信息 ：收集网络设备信息，包括 IP 地址和 MAC 地址。 安装 root@kitploit: git clone...

squidmagic

Squidmagic is a tool designed to analyze a web-based network traffic to detect central command and control C&C servers and Malicious site, using Squid proxy server and Spamhaus. Install dependencies root@kitploit: pip install -r requirements.txt Usage root@kitploit: python squidmagic.py...