Usage In general, it is recommended load, run and explore the results.
Example PCAP files containing scenarios that demonstrates all BruteShark capabilities can be downloaded from here (https://github.com/odedshimon/BruteShark/tree/master/Pcap_Examples).
Note that analyzing network traffic is an operation that consumes time and resources, so it is recommended to select only the required modules when large files are loaded.
Particular attention should be paid to the "Build TCP Sessions" / "Build UDP Sessions" options. BruteSharkDesktop The GUI is pretty self-explanatory, just load the wanted files, configure the wanted modules and press the run button. BruteSharkCli BruteSharkCli is the CLI version of BruteShark for Linux & Windows users. It has all the features of BruteSharkDesktop and designed to operate from a shell. As a classic CLI tool it works by getting all the relevant parameters for the processing and then printing the results to stdout or files. Print the help menu: BruteSharkCli --help
Get credentials from all files in a directory (passwords and hashes will be printed to stdout): BruteSharkCli -m Credentials -d "C:\Users\King\Desktop\Pcap Files"
Get credentials from all files in a directory and also export extracted hashes (if found) to Hashcat input files. BruteSharkCli -m Credentials -d C:\Users\King\Desktop\Pcap_Examples -o C:\Users\King\Desktop\Results
Run multiple modules on all files in a directory and also export all the results. BruteSharkCli -m Credentials,NetworkMap,FileExtracting -d C:\Users\King\Desktop\Pcap_Examples -o C:\Users\King\Desktop\Results
Sniff an interface named "Wi-Fi", run multiple modules and also export all the results to a directory (the results will be exported only when stopping the sniffer by hitting CTRL + C). BruteSharkCli -l Wi-Fi -m Credentials,NetworkMap,FileExtracting,DNS -o C:\Users\King\Desktop\Test Export
Modules BruteShark is a modular tool, designed for expansion. Credentials Module This module is responsible for extracting and encoding usernames and passwords as well as authentication hashes. In fact this module is responsible for updating two display tables, passwords table and hashes table. While usernames and passwords are straight forward to use, hashes most often used in more complex attacks like pass-the-hash or by brute-forcing them to get the password. BruteShark is integrated with Hashcat (https://hashcat.net/hashcat/) so all the hashes extracted can be converted to a Hashcat input file. Protocol Hash Type Hascat Mode (-m) HTTP HTTP-Digest 11400 SMTP\IMAP CRAM-MD5 16400 NTLM (e.g. SMB) NTLMv1 5500 NTLM (e.g. SMB) NTLMv2 5600 Kerberos AS-REQ etype 23 7500 Kerberos AS-REP etype 23 18200 Kerberos TGS-REP etype 23 13100 Kerberos (AES128) TGS-REP etype 17 19600 Kerberos (AES256) TGS-REP etype 18 19700 Network Map Module This module is responsible for building the network map by identifying components in the network and the connections between them. The network map can be exported to two JSON files, one file contains all the connections in the network and one contains all the endpoints and the related information about them (like open ports, DNS mappings etc.). Those files can be used for analysis with external tools such as Neo4j (https://neo4j.com/).
Example PCAP files containing scenarios that demonstrates all BruteShark capabilities can be downloaded from here (https://github.com/odedshimon/BruteShark/tree/master/Pcap_Examples).
Note that analyzing network traffic is an operation that consumes time and resources, so it is recommended to select only the required modules when large files are loaded.
Particular attention should be paid to the "Build TCP Sessions" / "Build UDP Sessions" options. BruteSharkDesktop The GUI is pretty self-explanatory, just load the wanted files, configure the wanted modules and press the run button. BruteSharkCli BruteSharkCli is the CLI version of BruteShark for Linux & Windows users. It has all the features of BruteSharkDesktop and designed to operate from a shell. As a classic CLI tool it works by getting all the relevant parameters for the processing and then printing the results to stdout or files. Print the help menu: BruteSharkCli --help
Get credentials from all files in a directory (passwords and hashes will be printed to stdout): BruteSharkCli -m Credentials -d "C:\Users\King\Desktop\Pcap Files"
Get credentials from all files in a directory and also export extracted hashes (if found) to Hashcat input files. BruteSharkCli -m Credentials -d C:\Users\King\Desktop\Pcap_Examples -o C:\Users\King\Desktop\Results
Run multiple modules on all files in a directory and also export all the results. BruteSharkCli -m Credentials,NetworkMap,FileExtracting -d C:\Users\King\Desktop\Pcap_Examples -o C:\Users\King\Desktop\Results
Sniff an interface named "Wi-Fi", run multiple modules and also export all the results to a directory (the results will be exported only when stopping the sniffer by hitting CTRL + C). BruteSharkCli -l Wi-Fi -m Credentials,NetworkMap,FileExtracting,DNS -o C:\Users\King\Desktop\Test Export
Modules BruteShark is a modular tool, designed for expansion. Credentials Module This module is responsible for extracting and encoding usernames and passwords as well as authentication hashes. In fact this module is responsible for updating two display tables, passwords table and hashes table. While usernames and passwords are straight forward to use, hashes most often used in more complex attacks like pass-the-hash or by brute-forcing them to get the password. BruteShark is integrated with Hashcat (https://hashcat.net/hashcat/) so all the hashes extracted can be converted to a Hashcat input file. Protocol Hash Type Hascat Mode (-m) HTTP HTTP-Digest 11400 SMTP\IMAP CRAM-MD5 16400 NTLM (e.g. SMB) NTLMv1 5500 NTLM (e.g. SMB) NTLMv2 5600 Kerberos AS-REQ etype 23 7500 Kerberos AS-REP etype 23 18200 Kerberos TGS-REP etype 23 13100 Kerberos (AES128) TGS-REP etype 17 19600 Kerberos (AES256) TGS-REP etype 18 19700 Network Map Module This module is responsible for building the network map by identifying components in the network and the connections between them. The network map can be exported to two JSON files, one file contains all the connections in the network and one contains all the endpoints and the related information about them (like open ports, DNS mappings etc.). Those files can be used for analysis with external tools such as Neo4j (https://neo4j.com/).
{
// Create an instance for any available modules by looking for every class that
// implements IModule.
this._modules = AppDomain.CurrentDomain.GetAssemblies()
.SelectMany(s => s.GetTypes())
.Where(p => typeof(IModule).IsAssignableFrom(p) && !p.IsInterface)
.Select(t => (IModule)Activator.CreateInstance(t))
.ToList();
// Register to each module event.
foreach(var m in _modules)
{
m.ParsedItemDetected += (s, e) => this.ParsedItemDetected(s, e);
}
} BruteSharkDesktop (PL) Desktop application for Windows based on WinForms. Uses a cross-cutting project by the meaning it referrers both the DAL and BLL layers. This is done by composing each of the layers, register to their events, when event is triggered, cast the event object to the next layer equivalent object, and send it to next layer. (); // Create the DAL and BLL objects. _processor = new PcapProcessor.Processor(); _analyzer = new PcapAnalyzer.Analyzer(); _processor.BuildTcpSessions = true; // Create the user controls. _networkMapUserControl = new NetworkMapUserControl(); _networkMapUserControl.Dock = DockStyle.Fill; _sessionsExplorerUserControl = new SessionsExplorerUserControl(); _sessionsExplorerUserControl.Dock = DockStyle.Fill; _hashesUserControl = new HashesUserControl(); _hashesUserControl.Dock = DockStyle.Fill; _passwordsUserControl = new GenericTableUserControl(); _passwordsUserControl.Dock = DockStyle.Fill; // Contract the events. _processor.TcpPacketArived += (s, e) => _analyzer.Analyze(Casting.CastProcessorTcpPacketToAnalyzerTcpPacket(e.Packet)); _processor.TcpSessionArived += (s, e) => _analyzer.Analyze(Casting.CastProcessorTcpSessionToAnalyzerTcpSession(e.TcpSession)); _processor.FileProcessingStarted += (s, e) => SwitchToMainThreadContext(() => OnFileProcessStart(s, e)); _processor.FileProcessingEnded += (s, e) => SwitchToMainThreadContext(() => OnFileProcessEnd(s, e)); _processor.ProcessingPrecentsChanged += (s, e) => SwitchToMainThreadContext(() => OnProcessingPrecentsChanged(s, e)); _analyzer.ParsedItemDetected += (s, e) => SwitchToMainThreadContext(() => OnParsedItemDetected(s, e)); _processor.TcpSessionArived += (s, e) => SwitchToMainThreadContext(() => OnSessionArived(Casting.CastProcessorTcpSessionToBruteSharkDesktopTcpSession(e.TcpSession))); _processor.ProcessingFinished += (s, e) => SwitchToMainThreadContext(() => OnProcessingFinished(s, e)); InitilizeFilesIconsList(); this.modulesTreeView.ExpandAll(); }">public MainForm()
{
InitializeComponent();
_files = new HashSet();
// Create the DAL and BLL objects.
_processor = new PcapProcessor.Processor();
_analyzer = new PcapAnalyzer.Analyzer();
_processor.BuildTcpSessions = true;
// Create the user controls.
_networkMapUserControl = new NetworkMapUserControl();
_networkMapUserControl.Dock = DockStyle.Fill;
_sessionsExplorerUserControl = new SessionsExplorerUserControl();
_sessionsExplorerUserControl.Dock = DockStyle.Fill;
_hashesUserControl = new HashesUserControl();
_hashesUserControl.Dock = DockStyle.Fill;
_passwordsUserControl = new GenericTableUserControl();
_passwordsUserControl.Dock = DockStyle.Fill;
// Contract the events.
_processor.TcpPacketArived += (s, e) => _analyzer.Analyze(Casting.CastProcessorTcpPacketToAnalyzerTcpPacket(e.Packet));
_processor.TcpSessionArived += (s, e) => _analyzer.Analyze(Casting.CastProcessorTcpSessionToAnalyzerTcpSession(e.TcpSession));
_processor.FileProcessingStarted += (s, e) => SwitchToMainThreadContext(() => OnFileProcessStart(s, e));
_processor.FileProcessingEnded += (s, e) => SwitchToMainThreadContext(() => OnFileProcessEnd(s, e));
// Create an instance for any available modules by looking for every class that
// implements IModule.
this._modules = AppDomain.CurrentDomain.GetAssemblies()
.SelectMany(s => s.GetTypes())
.Where(p => typeof(IModule).IsAssignableFrom(p) && !p.IsInterface)
.Select(t => (IModule)Activator.CreateInstance(t))
.ToList();
// Register to each module event.
foreach(var m in _modules)
{
m.ParsedItemDetected += (s, e) => this.ParsedItemDetected(s, e);
}
} BruteSharkDesktop (PL) Desktop application for Windows based on WinForms. Uses a cross-cutting project by the meaning it referrers both the DAL and BLL layers. This is done by composing each of the layers, register to their events, when event is triggered, cast the event object to the next layer equivalent object, and send it to next layer. (); // Create the DAL and BLL objects. _processor = new PcapProcessor.Processor(); _analyzer = new PcapAnalyzer.Analyzer(); _processor.BuildTcpSessions = true; // Create the user controls. _networkMapUserControl = new NetworkMapUserControl(); _networkMapUserControl.Dock = DockStyle.Fill; _sessionsExplorerUserControl = new SessionsExplorerUserControl(); _sessionsExplorerUserControl.Dock = DockStyle.Fill; _hashesUserControl = new HashesUserControl(); _hashesUserControl.Dock = DockStyle.Fill; _passwordsUserControl = new GenericTableUserControl(); _passwordsUserControl.Dock = DockStyle.Fill; // Contract the events. _processor.TcpPacketArived += (s, e) => _analyzer.Analyze(Casting.CastProcessorTcpPacketToAnalyzerTcpPacket(e.Packet)); _processor.TcpSessionArived += (s, e) => _analyzer.Analyze(Casting.CastProcessorTcpSessionToAnalyzerTcpSession(e.TcpSession)); _processor.FileProcessingStarted += (s, e) => SwitchToMainThreadContext(() => OnFileProcessStart(s, e)); _processor.FileProcessingEnded += (s, e) => SwitchToMainThreadContext(() => OnFileProcessEnd(s, e)); _processor.ProcessingPrecentsChanged += (s, e) => SwitchToMainThreadContext(() => OnProcessingPrecentsChanged(s, e)); _analyzer.ParsedItemDetected += (s, e) => SwitchToMainThreadContext(() => OnParsedItemDetected(s, e)); _processor.TcpSessionArived += (s, e) => SwitchToMainThreadContext(() => OnSessionArived(Casting.CastProcessorTcpSessionToBruteSharkDesktopTcpSession(e.TcpSession))); _processor.ProcessingFinished += (s, e) => SwitchToMainThreadContext(() => OnProcessingFinished(s, e)); InitilizeFilesIconsList(); this.modulesTreeView.ExpandAll(); }">public MainForm()
{
InitializeComponent();
_files = new HashSet();
// Create the DAL and BLL objects.
_processor = new PcapProcessor.Processor();
_analyzer = new PcapAnalyzer.Analyzer();
_processor.BuildTcpSessions = true;
// Create the user controls.
_networkMapUserControl = new NetworkMapUserControl();
_networkMapUserControl.Dock = DockStyle.Fill;
_sessionsExplorerUserControl = new SessionsExplorerUserControl();
_sessionsExplorerUserControl.Dock = DockStyle.Fill;
_hashesUserControl = new HashesUserControl();
_hashesUserControl.Dock = DockStyle.Fill;
_passwordsUserControl = new GenericTableUserControl();
_passwordsUserControl.Dock = DockStyle.Fill;
// Contract the events.
_processor.TcpPacketArived += (s, e) => _analyzer.Analyze(Casting.CastProcessorTcpPacketToAnalyzerTcpPacket(e.Packet));
_processor.TcpSessionArived += (s, e) => _analyzer.Analyze(Casting.CastProcessorTcpSessionToAnalyzerTcpSession(e.TcpSession));
_processor.FileProcessingStarted += (s, e) => SwitchToMainThreadContext(() => OnFileProcessStart(s, e));
_processor.FileProcessingEnded += (s, e) => SwitchToMainThreadContext(() => OnFileProcessEnd(s, e));
_processor.ProcessingPrecentsChanged += (s, e) => SwitchToMainThreadContext(() => OnProcessingPrecentsChanged(s, e));
_analyzer.ParsedItemDetected += (s, e) => SwitchToMainThreadContext(() => OnParsedItemDetected(s, e));
_processor.TcpSessionArived += (s, e) => SwitchToMainThreadContext(() => OnSessionArived(Casting.CastProcessorTcpSessionToBruteSharkDesktopTcpSession(e.TcpSession)));
_processor.ProcessingFinished += (s, e) => SwitchToMainThreadContext(() => OnProcessingFinished(s, e));
InitilizeFilesIconsList();
this.modulesTreeView.ExpandAll();
} Contributing First off, thanks for taking the time to contribute! BruteShark welcomes contributions from everyone. When contributing to this repository, please first discuss the change you wish to make via issue or an email before making a change. How Can You Contribute? Implementing new features from BruteShark Issues (https://github.com/odedshimon/BruteShark/issues), look for "good first issue" and "help wanted" labels. Uploading example PCAP files, especially files, with interesting content. Proposing new features by Creating an Issue (https://github.com/odedshimon/BruteShark/issues). Reporting a bug by Creating an Issue (https://github.com/odedshimon/BruteShark/issues). Discussing the current state of the code. Creating videos and example tutorials of using BruteShark.
Download BruteShark (https://github.com/odedshimon/BruteShark/)
_analyzer.ParsedItemDetected += (s, e) => SwitchToMainThreadContext(() => OnParsedItemDetected(s, e));
_processor.TcpSessionArived += (s, e) => SwitchToMainThreadContext(() => OnSessionArived(Casting.CastProcessorTcpSessionToBruteSharkDesktopTcpSession(e.TcpSession)));
_processor.ProcessingFinished += (s, e) => SwitchToMainThreadContext(() => OnProcessingFinished(s, e));
InitilizeFilesIconsList();
this.modulesTreeView.ExpandAll();
} Contributing First off, thanks for taking the time to contribute! BruteShark welcomes contributions from everyone. When contributing to this repository, please first discuss the change you wish to make via issue or an email before making a change. How Can You Contribute? Implementing new features from BruteShark Issues (https://github.com/odedshimon/BruteShark/issues), look for "good first issue" and "help wanted" labels. Uploading example PCAP files, especially files, with interesting content. Proposing new features by Creating an Issue (https://github.com/odedshimon/BruteShark/issues). Reporting a bug by Creating an Issue (https://github.com/odedshimon/BruteShark/issues). Discussing the current state of the code. Creating videos and example tutorials of using BruteShark.
Download BruteShark (https://github.com/odedshimon/BruteShark/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Darktrace Forms New U.S. Federal Division to Assist With Global Cyberthreats
Sally Kenyon Grant has been appointed as VP of Darktrace Federal, leading initiatives supporting U.S. government cybersecurity operations.
Darktrace Forms New U.S. Federal Division to Assist With Global Cyberthreats
Sally Kenyon Grant has been appointed as VP of Darktrace Federal, leading initiatives supporting U.S. government cybersecurity operations.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
IRONSCALES Expands Product Offering Across Email, Communication Platforms
New solutions protect customers from expanding threats to cybersecurity landscape.
IRONSCALES Expands Product Offering Across Email, Communication Platforms
New solutions protect customers from expanding threats to cybersecurity landscape.