tsharkVM

💡 Update: tshark-opensearch More recent application tshark-opensearch is now available. You can find it in the https://github.com/h21-lab/apps-collection-info repository. 👉 Get Access tshark ELK VM appliance This project builds virtual machine which can be used for analytics of tshark -T ek ndjso...

pyshark

pyshark Python wrapper for tshark, allowing python packet parsing using wireshark dissectors. Extended documentation: http://kiminewt.github.io/pyshark Looking for contributors - for various reasons I have a hard time finding time to maintain and enhance the package at the moment. Any...

Krb5RoastParser

Krb5RoastParser 📑 Table of Contents ❓ What is Krb5RoastParser? ⭐ Features ⚙️ Installation ▶️ Execution 📈 Post Execution 📜 License ❓ What is Krb5RoastParser? Krb5RoastParser is a tool designed to parse Kerberos authentication packets AS-REQ, AS-REP and TGS-REP from .pcap files and generate...

Wireshark

General Information Wireshark is a network traffic analyzer, or "sniffer", for Linux, macOS, BSD and other Unix and Unix-like operating systems and for Windows. It uses Qt, a graphical user interface library, and libpcap and npcap as packet capture and filtering libraries. The Wireshark...

babyshark

babyshark Wireshark made easy in your terminal. Babyshark is a PCAP TUI that helps you answer: What’s using the network? What looks broken/weird? What should I select next? Status: v0.3.0 alpha. Offline .pcap / .pcapng viewing works without Wireshark Live capture requires tshark Wireshark CLI...

hfinger

Hfinger - fingerprinting malware HTTP requests Tool for fingerprinting HTTP requests of malware. Based on Tshark and written in Python3. Working prototype stage :- Its main objective is to provide unique representations fingerprints of malware requests, which help in their identification. Unique...

pcapinator

pcapinator An application to deal with lots of pcaps by running lots of tsharks Setup Install Python3, the one true Python... pip install python-dateutil pandas Features Recursively process multiple PCAP files including those in subdirectories. Wrapper around editcap Wireshark Tool that will let...

wifite2

Wifite This repo is a complete re-write of wifite, a Python script for auditing wireless networks. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Wifite is designed to use all known methods for retrieving the password of a wireless access point...

termshark

Termshark A terminal user-interface for tshark, inspired by Wireshark. V2.4 is out now with packet search and profiles for colors and columns! See theChangeLog. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Features Rea...

wireshark

General Information Wireshark is a network traffic analyzer, or "sniffer", for Linux, macOS, BSD and other Unix and Unix-like operating systems and for Windows. It uses Qt, a graphical user interface library, and libpcap and npcap as packet capture and filtering libraries. The Wireshark...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

pyshark-legacy

pyshark This repository is for the legacy version of pyshark, which works on Python2.7+. It only receives bugfixes after version 0.3.8. For the new version that's only supported on Python 3.5+, please use themain repo Python wrapper for tshark, allowing python packet parsing using wireshark...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...

sharker

Sharker: where Wireshark ends, we begin Sharker is a powerful and extensible tool for extracting valuable data from PCAP files or from live interfaces. It leverages the power of tshark to efficiently parse network captures and applies a flexible filtering system to pinpoint and extract juicy...

BlueFish

BlueFish BlueFish is a Python-based automation tool designed to simplify the analysis of PCAP Packet Capture files. It leverages the power of Wireshark's command-line tool, tshark, to extract valuable information from network captures. With BlueFish, you can quickly identify potential login...

termshark

Termshark Una interfaz de usuario de terminal para tshark, inspirada en Wireshark. ¡V2.4 ya está disponible con búsqueda de paquetes y perfiles de colores y columnas! Consulta elChangeLog. Si estás depurando en una máquina remota con un pcap grande y sin ganas de hacer scp de vuelta a tu...

PYSEC-2026-3426 wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured

Description Impact wireshark-mcp exposes a wiresharkexportobjects MCP tool that accepts an attacker-controlled destdir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction. The path sandbox alloweddirs is None by default and only activates when the...

CVE-2026-43901

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wiresharkexportobjects MCP tool that accepts an attacker-controlled destdir parameter and passes it to tshark's...

CVE-2026-43901

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wiresharkexportobjects MCP tool that accepts an attacker-controlled destdir parameter and passes it to tshark's...

CVE-2026-43901

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wiresharkexportobjects MCP tool that accepts an attacker-controlled destdir parameter and passes it to tshark's...