BruteShark - A Network Analysis Tool

BruteShark is a Network Forensic Analysis Tool (NFAT) that performs deep processing and inspection of network traffic (mainly PCAP files). It includes: password extracting, building a network map, reconstruct TCP sessions, extract hashes of encrypted passwords and even convert them to a Hashcat format in order to perform an offline Brute Force attack.

The main goal of the project is to provide solution to security researchers and network administrators with the task of network traffic analysis while they try to identify weaknesses that can be used by a potential attacker to gain access to critical points on the network.

What it can do

• Extracting and encoding usernames and passwords (HTTP, FTP, Telnet, IMAP, SMTP...)
• Extract authentication hashes and crack them using Hashcat (Kerberos, NTLM, CRAM-MD5, HTTP-Digest...)
• Build a visual network diagram (Network nodes & users)
• Reconstruct all TCP Sessions

Download

• Windows - download Windows Installer (64 Bit).
• Linux - download BruteSharkCli.zip and run BruteSharkCli.exe using MONO:

$ wget https://github.com/odedshimon/BruteShark/releases/latest/download/BruteSharkCli.zip
$ unzip BruteSharkCli.zip
$ mono BruteSharkCli/BruteSharkCli.exe

Links:

• https://github.com/odedshimon/BruteShark/
• https://hakin9.org/brute-shark-a-network-analysis-tool/
  

Network Forensic Analysis Tool (NFAT)

BruteShark is a Network Forensic Analysis Tool (NFAT) that performs deep processing and inspection of network traffic (mainly PCAP files). 

It includes: password extracting, building a network map, reconstruct TCP sessions, extract hashes of encrypted passwords fo offline Brute Force attack.

Two (2) BruteShark versions are available, A GUI based application (Windows) and a Command Line Interface tool (Windows and Linux).

BruteSharkCLI

Links:

• Install Mono - https://linuxize.com/post/how-to-install-mono-on-ubuntu-20-04/
• BruteShark - https://github.com/odedshimon/BruteShark
• https://hakin9.org/brute-shark-a-network-analysis-tool/
  

Extracting URL from Pcap

Here's the quick way to extract all the URL from a pcap file using tshark.

$ wget https://s3.amazonaws.com/tcpreplay-pcap-files/smallFlows.pcap

$ tshark -r smallFlows.pcap -T fields -e http.request.full_uri | grep -v "^$"