Open source framework for network traffic analysis with advanced features.
This is a simple program to log login attempts on Telnet (port 23). It's designed to track the Mirai botnet. Right now (Oct 23, 2016) infected Mirai machines from around the world are trying to connect to Telnet on every IP address about once per minute. This program logs both which IP addresses are doing the attempts, and which passwords they are using. I wrote it primarily because installing telnetd on a Raspberry Pi wasn't sufficient. For some reason, the Mirai botnet doesn't like the output from Telnet, and won't try to login. So I needed something that produced the type of Telnet is was expecting. While I was at it, I also wrote some code to parse things and extract the usernames/passwords. Usage: Just run the program in order to see passwords and IP addresses appear on stdout. telnetlogger To log the information to files, use the -p and -i options. telnetlogger -p passwds.txt -i ips.txt To listen on another port (for testing and whatnot), use -l. telnetlogger -l 2323 Note that on many systems, you'll get an "access denied" error message, because programs that open ports below 1024 need extra priveleges. So you may need to sudo the program. Compiling Type make or:
Open source framework for network traffic analysis with advanced features.
replayproxy allows you to 're-live' a HTTP session captured in a .pcap file, parsing HTTP streams, caching them, and starting a HTTP proxy to reply to requests with matching responses.
A smart SSRF scanner using different methods like parameter brute forcing in post and get requests.
Passively maps and visually displays ICS/SCADA network topology for network security
Hale is a botnet command & control monitor/spy with a modular design and various monitoring capabilities, including IRC and HTTP, to aid in botnet hunting and research.
A WebSocket Manipulation Proxy with a user interface to capture, intercept, and send custom messages for WebSocket and Socket.IO communications.