curveball_lua

curveballlua Repo containing lua scripts and PCAP to find CVE-2020-0601 exploit attempts via network traffic...

crackle

crackle cracks BLE Encryption AKA Bluetooth Smart. crackle exploits a flaw in the BLE pairing process that allows an attacker to guess or very quickly brute force the TK Temporary Key. With the TK and other data collected from the pairing process, the STK Short Term Key and later the LTK Long Ter...

PcapViz

PcapViz PcapViz draws networks as device topologies and as information flows using the packet information in pcap files captured from a network device using tcpcap or other capture software. It filters and optionally displays the captured packets at any one of 3 "layers". These are: device level...

Network_Assessment

Network Assessment With Wireshark or TCPdump, you can determine whether there is harmful activity on your network traffic that you have recorded on the network you monitor. This Python script analyzes network traffic in a given .pcap file and attempts to detect the following suspicious network...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...

Woeful

Woeful A high performance Wisp server that has packet analysis. Features Wisp V1 Support Pcap network capture Blacklisting & Whitelisting ports and domains Is it fast? It's faster then WispServerCpp. The other benchmarks are more nuanced. Dependencies Big thanks to all of these projects:...

so-crates

SO-CRATES Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus A standalone web application for analyzing pcap files, log files, email messages, and binary files. Features include Suricata network analysis with tshark adding the protocols Suricata doesn't parse, YARA binary...

drovorub-hunt

Dispatches from Drovorub: Network Threat Hunting for Russia GRU GTsSS' Malware at Scale Recently, the National Security Agency and Federal Bureau of Investigation released a report outlining command and control capabilities leveraged by the Russian General Staff Main Intelligence Directorate GRU...

TrafficWatch

TrafficWatch TrafficWatch, a packet sniffer tool, allows you to monitor and analyze network traffic from PCAP files. It provides insights into various network protocols and can help with network troubleshooting, security analysis, and more. Features Protocol-specific packet analysis for ARP, ICMP...

XLS-to-DBatLoader-or-GuLoader-for-AgentTesla-variant

THE ANALYZED FILE PCAP-Based Analysis | Date: 2025-03-12 | Author: BlackOclock TABLE OF CONTENTS 1. ANALYSIS OVERVIEW 1.1 The Analyzed File PCAP Only 1.2 Infection Timeline & CVE Mapping 2. NETWORK TRAFFIC ANALYSIS 2.1 Protocol Hierarchy – Big Picture 2.2 Conversations – Top Talkers & Data...

tcpreplay

Tcpreplay Tcpreplay is a suite of GPLv3 licensed utilities for UNIX and Windows under Cygwin for editing and replaying network traffic previously captured by tools like tcpdump and Wireshark. It classifies traffic as client or server, rewrites Layer 2/3/4 headers, and replays it back onto the...

PcapXray

PcapXray A network forensics tool — visualize PCAP files or live traffic as an annotated network diagram with device identification, protocol classification, Tor detection, and malicious traffic flagging. Module Overview graph TD UIuserinterface.py\nGUI controller -- PRpcapreader\nFile + Live...

netsniff-ng

////////////////////////////////////////////////////////////////////////////// netsniff-ng - the packet sniffing beast \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ . . netsniff-ng is a free, performant / Linux network analyzer and .' '. networking toolkit. If you...

Absolutely-Positively-NOT-Hacking-Back-with-Pcap

Absolutely Positively NOT Hacking Back with Pcap Streaming Unexpected Network Byte Sequences with High Probability of Blue Screening or Otherwise Crashing Attacker Command-and-Control Nodes This was presented at TheSAS2019: https://www.youtube.com/watch?v=Z1-4-amGdaM...

log4j-pcap-activity

log4j-pcap-activity A fun activity using a packet capture file from the log4j exploit CVE-2021-44228 Instructions Open wireshark and import the PCAP located in this repository: log4j-exploit.pcap. Looking at the packets, answer the following questions. Questions Easy 1. Which Packet numbers conta...

Bryobio

Bryobio🕷️ NETWORK Pcap File Analysis It was developed to speed up the processes of SOC Analysts during analysis🕷️ This tool is valuable for cybersecurity professionals, particularly in analyzing and understanding network traffic and potential security threats. The provided illustration reflects the...

challenge_CVE-2020-13777

Chanllenge CVE-2020-13777 Try to prove if TLS 1.3 MITM is possible and decrypt 0-RTT early data in pcap here Server: 192.168.100.23:5556. See https://jovi0608.hatenablog.com/entry/2020/06/13/104905 and CVE-2020-13777 for details...

Sniffle

Sniffle Sniffle is a sniffer for Bluetooth 5 and 4.x LE using TI CC1352/CC26x2 hardware. Sniffle has a number of useful features, including: Support for BT5/4.2 extended length advertisement and data packets Support for BT5 Channel Selection Algorithms 1 and 2 Support for all BT5 PHY modes regula...

pcapan

pcapan A pcap capture analysis helper Usage: $ git clone https://github.com/synacktiv/pcapan $ cd pcapan $ cargo run -- --pcap /tmp/capture.pcap --google -w whitelist.yaml Finished dev unoptimized + debuginfo targets in 0.04s Running target/debug/pcapan --pcap /tmp/log.tcpdump --google -w...

Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...