Brute Shark v1.2.2 releases: Network Analysis Tool
Brute Shark is a Network Forensic Analysis Tool (NFAT) that performs deep processing and inspection of network traffic (mainly PCAP files). It includes: password extracting, building a network map, reconstruct TCP sessions, extract hashes of encrypted passwords, and even convert them to a Hashcat format in order to perform an offline Brute Force attack.
The main goal of the project is to provide a solution to security researchers and network administrators with the task of network traffic analysis while they try to identify weaknesses that can be used by a potential attacker to gain access to critical points on the network.
Two Brute Shark versions are available, A GUI-based application (Windows) and a Command Line Interface tool (Windows and Linux).
The various projects in the solution can also be used independently as infrastructure for analyzing network traffic on Linux or Windows machines. For further details see the Architecture section.
The project was developed in my spare time to address two main passions of mine: software architecture and analyzing network data.
What it can do
- Extracting and encoding user credentials
- Extract authentication hashes and crack them using Hashcat
- Build visual network diagram
- Reconstruct all TCP Sessions
Password Extracting (HTTP, TELNET, IMAP, FTP, SMTP)
Hashes Extracting (HTTP-Digest, NTLM, CRAM-MD5)
Building a Network Diagram
Reconstruct all TCP Sessions
- Fix a bug that cause Kerberos hashes over TCP hashes was not extracted due to lack of proper parsing of “Record mark” section parsing (See issue: #90 )
- Implement Kerberos TGS-REP Etype 17 and 18 hashes parsing include Hashcat export.
- Upgrade all projects NuGets.
- Add a link to download BruteSharkCli for windows.
Copyright (C) 2020 odedshimon