Preferred-Network-List-Sniffer
Malcolm
Preferred-Network-List-Sniffer | Malcolm | |
---|---|---|
1 | 4 | |
131 | 1,760 | |
- | 2.4% | |
9.7 | 9.9 | |
about 2 months ago | 11 days ago | |
Python | Python | |
MIT License | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Preferred-Network-List-Sniffer
Malcolm
-
Kali Linux 2023.1 introduces 'Purple' distro for defensive security
The heavy lifting of this is CISA's Malcom [1]. Unfortunately the blog posts only provides a non-linked bullet to it [2]. Seth Grover, the main driver behind Malcom, put a lot of effort over the years into creating a turnkey soc-in-a-box distro that works especially well for an network-first approach. Endpoint isn't neglected, but the focus on Zeek, Suricata, Arkime shows the primary visibility drivers. This is not surprising, because CISA also developed a bunch of custom ICS protocol dissectors that provide visibility (DNP3, Modbus, etc.). The list is impressive [3]. All of this is turnkey available by running Malcom. Especially for OT, where we have a lot more unmanaged black boxes and networks that you don't wanna actively scan (factories have been brought down this way), passively watching is a safe and powerful approach.
It's a bit unfortunate that Kali didn't give the props to Seth's project (not even an outbound link). Perhaps this was just an oversight, or a spotlight blog post is coming later, but I hope that the history of this gets properly acknowledged, because it's darn clear where this comes from.
[1]: https://github.com/cisagov/Malcolm
[2]: https://www.kali.org/blog/kali-linux-2023-1-release/
[3]: https://cisagov.github.io/Malcolm/docs/protocols.html
-
Tool recommendation needed: Network analyzer
Now on the higher end level, I have a laptop I used for packet capture and sniffing. Using a small network tap device, I can hook this inline anywhere one suspects a potential issue. Then use software of your choice to capture and analyze data over a few days. Two I use for this purpose, along with cyber threat analysis are NTOPNG and Malcolm, a very poweful free opensource platform made by a brilliant guy at CISA. Link to git repo here. https://github.com/cisagov/Malcolm
- Malcolm A network traffic analysis tool suite for full packet capture artifacts
What are some alternatives?
scapy - Scapy: the Python-based interactive packet manipulation program & library.
kali-purple
AutoPWN-Suite - AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically.
DetectXDiscord - This Discord bot is designed to provide file scanning functionality using the VirusTotal API to check for viruses and other malware in attachments uploaded to a Discord channel.
WiFi-password-stealer - Simple Windows and Linux keystroke injection tool that exfiltrates stored WiFi data (SSID and password).
Lockdoor-Framework - 🔐 Lockdoor Framework : A Penetration Testing framework with Cyber Security Resources
Dimorf - Dimorf is a ransomware using 256-bit AES with a self-destructing, randomly generated key for Linux OS´s
DumpsterFire - "Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
recon - Enumerate a target Based off of Nmap Results