Multi Gigabit Packet Capturing: PFQ

PFQ is a functional networking framework designed for the Linux operating system that allows efficient packets capture/transmission 10G and beyond, in-kernel functional processing and packets steering across sockets/end-points. PFQ is highly optimized for multi-core architecture, as well as for...

[SECURITY] Fedora 23 Update: tcpreplay-4.1.1-2.fc23

Tcpreplay is a tool to replay captured network traffic. Currently, tcpreplay supports pcap tcpdump and snoop capture formats. Also included, is tcpprep a tool to pre-process capture files to allow increased performance under certain conditions as well as capinfo which provides basic information...

[SECURITY] Fedora 24 Update: tcpreplay-4.1.1-2.fc24

Tcpreplay is a tool to replay captured network traffic. Currently, tcpreplay supports pcap tcpdump and snoop capture formats. Also included, is tcpprep a tool to pre-process capture files to allow increased performance under certain conditions as well as capinfo which provides basic information...

CVE-2015-7360

Multiple cross-site scripting XSS vulnerabilities in the Web User Interface WebUI in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 serial parameter to alerts/summary/profile/; the 2 urlForCreatingReport parameter to csearch/report/export/...

IDS IPS Testing Framework: pytbull

pytbull is an Intrusion Detection/Prevention System IDS/IPS Testing Framework for Snort, Suricata and any IDS/IPS that generates an alert file. It can be used to test the detection and blocking capabilities of an IDS/IPS, to compare IDS/IPS, to compare configuration modifications and to...

Skydive - An Open Source Real-Time Network Topology and Protocols Analyzer

Skydive is an open source real-time network topology and protocols analyzer. It aims to provide a comprehensive way of understanding what is happening in the network infrastructure. Skydive agents collect topology informations and flows and forward them to a central agent for further analysis. Al...

WYSIWYG Network Packet Editor: WireEdit

WYSIWYG Network Packet Editor WireEdit is first-of-a-kind and the only full stack cross-platform WYSIWYG network packets editor. It allows editing packets data at all stack layers as “rich text” in a simple point-and-click interface. The input and output format is Pcap. Is WireEdit a Pcap Editor?...

NetworkMiner 2.0 - Network Forensic Analysis Tool (NFAT)

NetworkMiner is a Network Forensic Analysis Tool NFAT for Windows but also works in Linux / Mac OS X / FreeBSD. NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the...

Wireshark - dissect_nhdr_extopt Stack Based Buffer Overflow

Exploit for multiple platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=696 The following crash due to a stack-based buffer overflow can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...

Automated DeAuth Attack: zizzania

zizzania sniffs wireless traffic listening for WPA handshakes and dumping only those frames suitable to be decrypted one beacon + EAPOL frames + data. In order to speed up the process, zizzania sends IEEE 802.11 DeAuth frames to the stations whose handshake is needed, properly handling...

Scientific Linux Security Update : wireshark on SL7.x x86_64 (20151119)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. CVE-2015-2188, CVE-2015-2189, CVE-2015-2191, CVE-2015-3810, CVE-2015-3811, CVE-2015-3812, CVE-2015-3813, CVE-2014-8710,...

CentOS 7 : wireshark (CESA-2015:2393)

Updated wireshark packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...

Moderate: Red Hat Security Advisory: wireshark security, bug fix, and enhancement update

Updated wireshark packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...

Win10Pcap Kernel Mode Driver Local Lift Vulnerability

Win10Pcap is an Ethernet packet capture library. Win10Pcap has a security vulnerability that allows a local attacker to exploit the vulnerability to elevate privileges...

Microsoft Windows 10 - pcap Driver Privilege Escalation

Microsoft Windows 10 - pcap Driver Privilege Escalation // Source: https://github.com/Rootkitsmm/Win10Pcap-Exploit include include include include include include include include include define SLIOCTLGETEVENTNAME CTLCODE0x8000, 1, METHODNEITHER, FILEANYACCESS define STATUSSUCCESS...

Windows 10 pcap Drive Local Privilege Escalation

Source: https://github.com/Rootkitsmm/Win10Pcap-Exploit include include include include include include include include include define SLIOCTLGETEVENTNAME CTLCODE0x8000, 1, METHODNEITHER, FILEANYACCESS define STATUSSUCCESS NTSTATUS0x00000000L define STATUSINFOLENGTHMISMATCH NTSTATUS0xc0000004L /...

Wireshark 1.12.x < 1.12.6 Multiple DoS Vulnerabilities

The version of Wireshark installed on the remote Windows host is 1.12.x prior to 1.12.6. It is, therefore, affected by multiple denial of service vulnerabilities : - An unspecified flaw exists in the WCCP dissector. A remote attacker can exploit this flaw, by injecting a specially crafted packet ...

Fedora 21 : suricata-2.0.8-1.fc21 (2015-7886)

This update fixes a bug in the DER parser which is used to decode SSL/TLS certificates could crash Suricata. Also, those processing large numbers of untrusted pcap files need to update as a malformed pcap could crash Suricata. Note that Tenable Network Security has extracted the preceding...

Fedora 22 : suricata-2.0.8-1.fc22 (2015-7730)

This update fixes a bug in the DER parser which is used to decode SSL/TLS certificates could crash Suricata. Also, those processing large numbers of untrusted pcap files need to update as a malformed pcap could crash Suricata. Note that Tenable Network Security has extracted the preceding...

FreeBSD : suricata -- TLS/DER Parser Bug (DoS) (fe910ed6-f88d-11e4-9ae3-0050562a4d7b)

OISF Development Team reports : The OISF development team is pleased to announce Suricata 2.0.8. This release fixes a number of issues in the 2.0 series. The most important issue is a bug in the DER parser which is used to decode SSL/TLS certificates could crash Suricata. This issue was reported ...