sslsplit

SSLsplit - 透明的SSL/TLS中间人攻击 https://www.roe.ch/SSLsplit 概述 SSLsplit是一种针对SSL/TLS加密网络连接执行中间人攻击的工具。它旨在用于网络取证、应用程序安全分析和渗透测试。...

aiengine

AIEngine（人工智能引擎） AIEngine 是新一代交互式/可编程的 Python/Ruby/Java/Lua 数据包检测引擎，具备无需人工干预的学习能力、NIDS（网络入侵检测系统）功能、DNS 域名分类、网络收集器、网络取证等众多功能。 本项目实际托管于 https://bitbucket.org/camp0/aiengine AIEngine 还能帮助网络/安全专业人士识别流量，并开发签名，用于 NIDS、防火墙、流量分类器等场景。 AIEngine 的主要功能包括： 支持在引擎运行时与用户进行交互/编程。 支持 PCRE JIT 进行正则匹配。 支持正则图（复杂检测模式）...

PcapXray

PcapXray 一款网络取证工具——将PCAP文件或实时流量可视化为带有设备识别、协议分类、Tor检测和恶意流量标记的注释网络图。 模块概览 graph TD UIuserinterface.py\nGUI controller -- PRpcapreader\nFile + Live capture PR -- ENGengines/\nauto · dpkt · scapy · pyshark PR -- MEMmemory.py\nShared state MEM -- CDFcommunicationdetailsfetch\nDNS · whois MEM --...

pcapan

pcapan Un asistente de análisis de capturas pcap Uso: $ git clone https://github.com/synacktiv/pcapan $ cd pcapan $ cargo run -- --pcap /tmp/capture.pcap --google -w whitelist.yaml Finished dev unoptimized + debuginfo targets in 0.04s Running target/debug/pcapan --pcap /tmp/log.tcpdump --google -...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark 是使用最广泛的网络流量分析器。对于取证/恶意软件分析人员来说，它既是实时流量分析的重要工具，也是取证分析的重要工具。尽管 Wireshark 在协议解析和过滤方面提供了极其强大的功能，但它并未提供任何有关网络端点的上下文信息。对于需要梳理数 GB 的 PCAP 文件以识别恶意活动的典型分析师来说，这就像大海捞针。 Wireshark 取证工具包是一个跨平台的 Wireshark 插件，它将网络流量数据与威胁情报、资产分类和漏洞数据关联起来，以加速网络取证分析。它通过扩展 Wireshark...

Mortimer

Mortimer Una colección de scripts para procesar datos y threat intelligence de tipo forensia de red, principalmente en una base de datos postgres. Publicado como código abierto por NCC Group Plc - http://www.nccgroup.com/ Desarrollado para John Green, cirt at nccgroup dot com...

Dshell

Dshell 一个可扩展的网络取证分析框架。支持通过快速开发插件来解析网络数据包捕获。 主要特点： 使用专用插件进行深度数据包分析 强大的流重组能力 支持 IPv4 和 IPv6 多种用户可选的输出格式，并可创建自定义输出处理程序 可链式组合的插件 并行处理选项，可将数据处理分配到独立的 Python 进程 支持开发外部插件包，以便共享和安装新开发的外部插件，而不会与核心 Dshell 插件目录重叠 指南 Dshell 用户指南 包含安装指南以及基于示例的基础和高级分析 帮助新手和有经验的终端用户理解和使用解码器外壳（Dshell）框架 Dshell 开发指南...

incriminator

Incriminator Incriminator 是一个开源项目，仅供教育目的，允许你在网络犯罪中诬陷其他设备。 项目目前为 1.0 版本。 如果你发现了一个 bug，请报告它。 感谢下载…… 仅供教育目的使用！！！！！！！ 我对本工具造成的损害不承担任何责任！！！！ 使用的软件： BeeLogger https://github.com/4w4k3/BeeLogger AP-Fucker https://github.com/mattoufoutu/scripts/blob/master/AP-Fucker.py DHCPwn...

An-Integrated-Wireless-Network-Forensic-Analysis-Framework

An-Integrated-Wireless-Network-Forensic-Analysis-Framework 该框架将一组现有开源工具整合为一个集成包，自动化取证调查流程。它能够捕获无线网络流量，根据调查需求分析捕获的流量，并从分析后的流量中提取和记录数字证据。 攻击特征 该框架能够分析3种类型的攻击： DoS Evil Twin（邪恶双子星） WEP Crack（WEP破解） 先决条件 Kali Linux 1.0.9 如何运行该框架 ./applicationMain.py 框架的快速概念验证 https://youtu.be/H5VqpB3ales &...

network-forensics

Network Forensics Investigations Blue-team network-forensics...

Network-Filesystem-Forensics

Forense de red y sistema de archivos Informes sobre post-explotación en honeypot explotando wu-ftpd vulnerable CVE-2001-0550...

Cyber-Defenders-lab-

CyberDefenders Blue Team Labs My write-ups from CyberDefenders' Blue Team labs, solved using Wireshark. Each lab is a real network forensics investigation — starting from a PCAP file and ending with a full reconstruction of the attack. 📄 Full combined PDF report — includes every lab write-up,...

info-security-portfolio

Information Security Portfolio A curated collection of nine e...

Before You Hand over the Wheel: Evaluating LLMs for Security Incident Analysis

Security incident analysis SIA poses a major challenge for security operations centers, which must manage overwhelming alert volumes, large and diverse data sources, complex toolchains, and limited analyst expertise. These difficulties intensify because incidents evolve dynamically and require...

ctf-writeups

CTF Writeups A collection of Capture The Flag challenge write...

Enhanced Cyber Threat Intelligence by Network Forensic Analysis for Ransomware As a Service(RaaS) Malwares

In the current era of interconnected cyberspace, there is an adverse effect of ransomware on individuals, startups, and large companies. Cybercriminals hold digital assets till the demand for payment is made. The success of ransomware upsurged with the introduction of Ransomware as a ServiceRaaS...

Are students prepared for real-world cyber curveballs?

With a projected “skills gap” numbering in the millions for open cyber headcount, educating a diverse workforce is critical to corporate and national cyber defense moving forward. However, are today’s students getting the preparation they need to do the cybersecurity work of tomorrow? To help...

PcapXray v2.5 - A Network Forensics Tool To Visualize A Packet Capture Offline As A Network Diagram

PcapXray is a Network Forensics Tool To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction. PcapXray Design Specification Goal: Given a Pcap File, plot a network diagram displaying hosts in the network,...

Network Security Monitoring: Security Onion

Network Security Monitoring NSM is, put simply, monitoring your network for security related events. It might be proactive, when used to identify vulnerabilities or expiring SSL certificates, or it might be reactive, such as in incident response and network forensics. Whether you’re tracking an...

PcapXray - A Network Forensics Tool To visualize a Packet Capture offline as a Network Diagram

PcapXray is a Network Forensics Tool To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction. PcapXray Design Specification Goal: Given a Pcap File, plot a network diagram displaying hosts in the network,...