odedshimon / bruteshark

Network Analysis Tool

Hi!

My name is Oded and I'm a Software developer and a Cybersecurity expert. My greatest passion is to build software that people want to use and to share my years of experience with the community.

I'm the author of BruteShark a free-open-source tool that aims to provide solution to security researchers and network administrators with the task of network traffic analysis while they try to identify weaknesses in their networks.

In addition, in my spare time I write Medium articles and guides about Software Architecture, Cyber, Open-Source and DevOps.

My Recent Medium Articles

Let's Get In Touch!

Take a look at my repositories, write me, or even buy me a coffee

bruteshark's Issues

Help json import on neo4j

Hi, I have installed the tool on Linux, how can I import the json generated on neo4j to see the connection graph, like the image you entered in the tool homepage? Can you give me the commands please? Thank you!!

Bug: Progress bar is stay at 100% after the first time it reaches 100%

That happens because the class ProcessingPrecentsPredicator state is not re-initialize properly.

Have you considered increasing the exported and captured pcap data?

Will you consider the function

Will you consider adding similar functions such as USB packet capture and SSL protocol analysis to the program in the future?

Improve Installer: Enforce .NET Core SDK As Prerequisites Of BrueSharkDesktop

Edit BruteSharkInstaller project so it will enforce existence / installation of .NET Core SDK before installing BruteSharkDesktop.

NOTE: BruteSharkInstaller is a WiX Toolset project, if you are not familiar with this type projects it's worth to learn how to use WiX Toolset before working on this issue.

Reconstruct UDP Streams

Reconstruct UDP Streams (Same way PcapProcessor reconstruct TCP Sessions)

ASN.1 support

Create (or use an open source) class that can decode ASN.1 buffers.
That will be useful for parsing protocols like Kerberos.

Hi heyy can we get a one just like this but for injecting js and html ?

For Windows for sure .

Double clicking on it does nothing at all WIN 10

version 1909 build 18363.1379

i have wireshark and it works perfectly if that helps .

Feature Request

Can we add an option of adding more features to the JSON file. Right now i see the Source, Destination, Protocol, SrcPort, DestPort. Other options can be details about the packet itself (Time, Sequence Number, Flags etc..). I am trying to build a graph in neo4j.

I currently am able to create a graph with the code below

WITH "file:///home/xxx/dump/output.json" AS url
CALL apoc.load.json(url)
YIELD value AS NetworkTraffic
UNWIND NetworkTraffic AS items
MERGE (s:Packet{id: items.Source, protocol:items.Prtocol, Srcport:Items.SrcPort})
MERGE (d:Packet{id: items.Destination, Destport:Items.DestPort})
CREATE (s) -[r:connects]->(d)
RETURN s,d,r;

[Question] Linux build steps?

Title says it all. Forgive me if its already there, I can't find it

An assembly specified in the application dependencies manifest (BruteSharkDesktop.deps.json) was not found

Hello :)

I just installed Brute Shark but nothing happens at launch. I have Wireshark, Npcap, .NET SDK and .NET Core SDK installed.

From Windows event viewer:

Description: A .NET Core application failed.
Application: BruteSharkDesktop.exe
Path: C:\Program Files (x86)\BruteSharkDesktop\BruteSharkDesktop.exe
Message: Error:
  An assembly specified in the application dependencies manifest (BruteSharkDesktop.deps.json) was not found:
    package: 'System.Text.Json', version: '5.0.0'
    path: 'lib/netcoreapp3.0/System.Text.Json.dll'

Improve Performance - implement multi thread mechanism

Improve BruteShark performance by refactor the BLL layer (aka PcapAnalyzer project to use multi thread mechanism).
That includes:

• Design the solution and discuss about it with me.
• Implement it.
• Writing tests that will test exactly this mechanism.

Clear the analyzed data, re-analyze again, and re-assign

I have a question. I want to clear the results of the analysis, and then re-analyze the assignment. Now there is only NetworkMap, I don't know how to solve it. When I clear the data and analyze the allocation again, the NetworkMap is blank and will not be assigned again. how to solve this problem?

Improve Files Extraction Module: Extract Files From SMB Traffic

Runing error?

See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.

************** Exception Text **************
SharpPcap.PcapException: Error setting PcapDevice mode. : driver error: working mode not recognized
at SharpPcap.Npcap.NpcapDevice.set_Mode(CaptureMode value)
at PcapProcessor.Sniffer.StartSniffing(CancellationToken ct)
at BruteSharkDesktop.MainForm.<>c__DisplayClass35_0.b__0()
at System.Threading.Tasks.Task.InnerInvoke()
at System.Threading.Tasks.Task.<>c.<.cctor>b__274_0(Object obj)
at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
--- End of stack trace from previous location where exception was thrown ---
at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Task& currentTaskSlot, Thread threadPoolThread)
--- End of stack trace from previous location where exception was thrown ---
at BruteSharkDesktop.MainForm.StartLiveCaptureAsync()
at System.Threading.Tasks.Task.<>c.b__139_0(Object state)

************** Loaded Assemblies **************
System.Private.CoreLib
Assembly Version: 4.0.0.0
Win32 Version: 4.700.21.35901
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Private.CoreLib.dll

BruteSharkDesktop
Assembly Version: 1.4.0.0
Win32 Version: 1.4.0.0
CodeBase: file:///C:/Program%20Files%20(x86)/BruteSharkDesktop/BruteSharkDesktop.dll

System.Runtime
Assembly Version: 4.2.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Runtime.dll

System.Windows.Forms
Assembly Version: 4.0.0.0
Win32 Version: 4.800.121.35902
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.WindowsDesktop.App/3.1.18/System.Windows.Forms.dll

System.ComponentModel.Primitives
Assembly Version: 4.2.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.ComponentModel.Primitives.dll

System.Drawing.Primitives
Assembly Version: 4.2.1.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Drawing.Primitives.dll

System.Collections.Specialized
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Collections.Specialized.dll

System.Runtime.InteropServices
Assembly Version: 4.2.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Runtime.InteropServices.dll

System.Threading
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Threading.dll

System.Diagnostics.TraceSource
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Diagnostics.TraceSource.dll

System.Collections
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Collections.dll

System.Runtime.Extensions
Assembly Version: 4.2.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Runtime.Extensions.dll

System.Diagnostics.Debug
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Diagnostics.Debug.dll

System.Threading.Tasks
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Threading.Tasks.dll

PcapAnalyzer
Assembly Version: 1.0.0.0
Win32 Version: 1.0.0.0
CodeBase: file:///C:/Program%20Files%20(x86)/BruteSharkDesktop/PcapAnalyzer.dll

netstandard
Assembly Version: 2.1.0.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/netstandard.dll

PcapProcessor
Assembly Version: 1.0.0.0
Win32 Version: 1.0.0.0
CodeBase: file:///C:/Program%20Files%20(x86)/BruteSharkDesktop/PcapProcessor.dll

System.Drawing.Common
Assembly Version: 4.0.2.2
Win32 Version: 4.700.21.6905
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.WindowsDesktop.App/3.1.18/System.Drawing.Common.dll

Microsoft.Win32.Primitives
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/Microsoft.Win32.Primitives.dll

System.ComponentModel.EventBasedAsync
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.ComponentModel.EventBasedAsync.dll

System.Threading.Thread
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Threading.Thread.dll

Accessibility
Assembly Version: 4.0.0.0
Win32 Version: 4.800.121.35902
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.WindowsDesktop.App/3.1.18/Accessibility.dll

System.Collections.NonGeneric
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Collections.NonGeneric.dll

System.Memory
Assembly Version: 4.2.1.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Memory.dll

System.ComponentModel.TypeConverter
Assembly Version: 4.2.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.ComponentModel.TypeConverter.dll

System.ComponentModel
Assembly Version: 4.0.4.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.ComponentModel.dll

Microsoft.Win32.SystemEvents
Assembly Version: 4.0.2.0
Win32 Version: 4.700.19.56404
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.WindowsDesktop.App/3.1.18/Microsoft.Win32.SystemEvents.dll

System.IO.FileSystem
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.IO.FileSystem.dll

PacketDotNet
Assembly Version: 1.1.2.0
Win32 Version: 1.1.2.0
CodeBase: file:///C:/Program%20Files%20(x86)/BruteSharkDesktop/PacketDotNet.dll

System.Linq
Assembly Version: 4.2.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Linq.dll

System.Configuration.ConfigurationManager
Assembly Version: 4.0.3.0
Win32 Version: 4.700.19.56404
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.WindowsDesktop.App/3.1.18/System.Configuration.ConfigurationManager.dll

System.ObjectModel
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.ObjectModel.dll

System.Runtime.Serialization.Formatters
Assembly Version: 4.0.4.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Runtime.Serialization.Formatters.dll

System.Resources.ResourceManager
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Resources.ResourceManager.dll

System.Resources.Writer
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Resources.Writer.dll

System.Text.RegularExpressions
Assembly Version: 4.2.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Text.RegularExpressions.dll

System.Buffers
Assembly Version: 4.0.5.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Buffers.dll

System.Xml.XDocument
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Xml.XDocument.dll

System.Private.Xml.Linq
Assembly Version: 4.0.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Private.Xml.Linq.dll

System.Private.Xml
Assembly Version: 4.0.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Private.Xml.dll

System.Security.Cryptography.Primitives
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Security.Cryptography.Primitives.dll

System.Xml.ReaderWriter
Assembly Version: 4.2.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Xml.ReaderWriter.dll

System.Private.Uri
Assembly Version: 4.0.6.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Private.Uri.dll

Microsoft.Msagl.GraphViewerGdi
Assembly Version: 0.0.0.0
Win32 Version: 0.0.0.0
CodeBase: file:///C:/Program%20Files%20(x86)/BruteSharkDesktop/Microsoft.Msagl.GraphViewerGdi.dll

AutomaticGraphLayout.Drawing
Assembly Version: 0.0.0.0
Win32 Version: 0.0.0.0
CodeBase: file:///C:/Program%20Files%20(x86)/BruteSharkDesktop/AutomaticGraphLayout.Drawing.dll

mscorlib
Assembly Version: 4.0.0.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/mscorlib.dll

AutomaticGraphLayout
Assembly Version: 0.0.0.0
Win32 Version: 0.0.0.0
CodeBase: file:///C:/Program%20Files%20(x86)/BruteSharkDesktop/AutomaticGraphLayout.dll

System.Drawing
Assembly Version: 4.0.0.0
Win32 Version: 4.800.121.35902
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.WindowsDesktop.App/3.1.18/System.Drawing.dll

System
Assembly Version: 4.0.0.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.dll

System.Collections.Concurrent
Assembly Version: 4.0.15.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Collections.Concurrent.dll

System.Diagnostics.FileVersionInfo
Assembly Version: 4.0.4.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Diagnostics.FileVersionInfo.dll

System.Windows.Extensions
Assembly Version: 4.0.1.0
Win32 Version: 4.700.19.56404
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.WindowsDesktop.App/3.1.18/System.Windows.Extensions.dll

CommonUi
Assembly Version: 1.0.0.0
Win32 Version: 1.0.0.0
CodeBase: file:///C:/Program%20Files%20(x86)/BruteSharkDesktop/CommonUi.dll

System.Resources.Extensions
Assembly Version: 4.0.1.0
Win32 Version: 4.700.20.21406
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.WindowsDesktop.App/3.1.18/System.Resources.Extensions.dll

SharpPcap
Assembly Version: 5.4.0.0
Win32 Version: 5.4.0.0
CodeBase: file:///C:/Program%20Files%20(x86)/BruteSharkDesktop/SharpPcap.dll

System.Net.Primitives
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Net.Primitives.dll

System.Net.NetworkInformation
Assembly Version: 4.2.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Net.NetworkInformation.dll

System.Runtime.InteropServices.RuntimeInformation
Assembly Version: 4.0.4.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Runtime.InteropServices.RuntimeInformation.dll

System.Threading.ThreadPool
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Threading.ThreadPool.dll

System.Diagnostics.StackTrace
Assembly Version: 4.1.2.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Diagnostics.StackTrace.dll

System.Reflection.Metadata
Assembly Version: 1.4.5.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Reflection.Metadata.dll

System.Collections.Immutable
Assembly Version: 1.2.5.0
Win32 Version: 4.700.21.36305
CodeBase: file:///C:/Program%20Files/dotnet/shared/Microsoft.NETCore.App/3.1.18/System.Collections.Immutable.dll

************** JIT Debugging **************

I installed the x64 .Net core via the link! Win32 Version: 4.700.21.36305???????

Input "start",there was nothing happened with BruteSharkCli.

After inputing add-file some examples *pcap files in ubuntu1604 console and Windows WSLv2 console. it seems as if dead:) I'm curious about nothing happened. I dont know how to solve this trouble.

Improve Files Extraction Module: Extract Files From FTP Traffic

There is a problem with the analysis packet

If there is a problem with this data packet, please take a look at it.
test.zip

New Module: WiFi Data (bssid, ssid etc)

Windows exe file not work

Hello,

i have install BruteShark on windows OS , but it not start after installation.

on Windows event i have found error message

Description: A .NET Core application failed.
Application: BruteSharkDesktop.exe
Path: C:\Program Files (x86)\BruteSharkDesktop\BruteSharkDesktop.exe
Message: A fatal error occurred. The required library hostfxr.dll could not be found.
If this is a self-contained application, that library should exist in [C:\Program Files (x86)\BruteSharkDesktop].
If this is a framework-dependent application, install the runtime in the global location [C:\Program Files\dotnet] or use the DOTNET_ROOT environment variable to specify the runtime location or register the runtime location in [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x64\InstallLocation].

just install .NET Core SDK and it work

i have found installer on this link
https://dotnet.microsoft.com/download/dotnet-core/thank-you/sdk-3.1.401-windows-x64-installer

best regards

.exe Dont work

Npcap and .NET SDK installed

CLI Linux/Windows - Option to generate network map

The CLI interface seems not to have an option to generate a network map.
You can show the module but not run it as it seems. Would be nice to have that option so there is no need to fiddle around with the GUI.

Create internal logger

Create internal logger.
Use it mainly to log exceptions at empty catch statements.

Failure when export-hashes directory is not present

The app fails when export-hashes CLI option is called and no export-hashes directory is present in binary directory. After spending few hours on processing pcaps this may be quite frustrating - app should create the directory or at least ask the user. Probably writing to OS default temp directory and then moving to per OS default location like current directory or $HOME/BruteShark/${date}/export-hashes-would be an option as in any permission problem case th user has then a way to recover the hashes

Migrate BruteSharkCli to .NET Core

Migrate BruteSharkCli to .NET Core

New Module: VOIP Calls Extraction

Kerberos hash didn't extracted in some cases

The attached file contains Kerberos hashes, but for some reason it is not extracted.
From an initial inspection, it seems that the Kerberos payload is not a valid ASN1 serialized data.

hideandseek.zip

Support MacOS?

Question

Hey @odedshimon i Wanna ask a simple Question what different between your project BruteShark and Wireshark ?
And thank you !

who can give an example of PcapAnalyzer Modules which using Packet.Net to analyse pcap files?

谁有PcapAnalyzer的Modules例子，使用Packet.Net进行pcap 文件分析？

Since you add a sniffer , can we get ssl strip added too ?

Implement a single-command mode in BruteSharkCLI

Use https://github.com/commandlineparser/commandline
to enable BruteSharkCli to get a single command from user instead of in app shell mode

Additional Fields for show-networkmap / export-networkmap

Would it be possible to add additional packet flow fields for the show-networkmap / export-networkmap commands?

Specifically I'm looking for a way to add timestamp information (first packet, last packet), total number of packets and sum of data sent per flow.

Extremely slow processing of pcap files

I used to process ~15GB pcap files with https://github.com/lgandx/PCredz and I believed it's slow and not optimal tool. But BruteShark comparing to it is extremely slow. Filtering 15GB pcap with wireshark for NTLMSSP packets takes less than a minute on my 16core, 32GB hardware, it results in 3MB file which is processed by BruteShark almost the same ammount of time - something is not optimal here. I've found it utilizes only 1 CPU core and use limited amount of RAM for processing, is there any prefered way to implement threads and caching here ? I can contribute

Carving files by file max size

Improve file extracting module by changing the algorithm a bit:
if file footer wasn't found - carve the file by max size configuration

[Question] Mac installation procedure

is there anyway this can be run on a mac ?

Thank you

can't recognize " Tcp out-of-order"

gov.cn_SSL过滤.zip
in the pcap file,No.338 ,wireshark shows " Tcp out-of-order" and bruteshark can't recognize it.

needs to Reassembled TCP Segments

there s something wrong when Reassembled TCP Segments

Implement Live-Capture Option

Use SharpPcap live capture option

Github Actions Workflow: Implement Auto-Release step

pcapng support

Support .pcapng file type.
Note: its better to start with checking if https://github.com/chmorgan/sharppcap is supporting pcapng.
If not, at least pop up a proper warning message (e.g. "Please convert file to pcap file type").

Improve Installer: Enable Auto-Update

Today a user needs to uninstall BruteShark using the control panel before installing a new version.
Using the WiX installer enable to upgrade the installation if the version is higher than the current version.

Can't capture the packet

The problem I encountered is that Wireshark shows that my WLAN has data fluctuations, but when I use the software to select WLAN, I can’t grab anything.

The network topology diagram is getting darker and darker with repeated clicks

When the network topology map is painted repeatedly, it will become darker and darker. For example, when he finishes painting 1 session, I click 1 session, and then when 2 session is finished, I click again. The last selected state of 1 session does not disappear but continues to select this Analogy leads to getting darker and darker

.

New Module: Emails Extracting (MIME Parser)

Implement a new module, end to end that will be responsible for extracting E-Mails data (aka MIME data - SMTP, POP3, IMAP).
That's include:

• Implement the module.
• Adjust BruteSharkDesktop GUI.
• Adjust BruteSharkCli.
• Write tests, upload example files etc.
• Update readme file

Not starting

installed the exe, cant even open the program, no errors, just nothing on the screen.
EDIT: got it working
However it do not show the hashes of kerberos.

Support with IPv6

When I pick a pcap with ipv6 tcp seesions, the program don't extract the password from the pcap.

Unable to run GUI in Windows 10

Hi, For some reason, I'm not able to run the GUI in windows 10, But CLI works, Kindly let me know it supports Windows 10 and how to resolve as it doesn't start.

Export of NetworkMap Failes

I get the following message when i try to export the networkmap

Error: Access to the path '/home/xxx/dump/NetworkMap/networkmap.json' is denied.

Command run is ./BruteSharkCli -m NetworkMap -i /home/xxx/dump/server.tcpdump -o /home/vbandaru/dump/
Result
[+] Started analyzing 1 files
File : server.tcpdump Processing Started
File : server.tcpdump Processing Finished
Error: Access to the path '/home/xxx/dump/NetworkMap/networkmap.json' is denied.