arkime
pyWhat
Our great sponsors
arkime | pyWhat | |
---|---|---|
13 | 16 | |
6,114 | 6,352 | |
1.3% | - | |
9.6 | 0.0 | |
3 days ago | 6 months ago | |
JavaScript | Python | |
Apache License 2.0 | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
arkime
-
Where can I get hands on practice for cybersecurity as a beginner over internet for free?
Arkime: https://arkime.com/ Packet capture and search
- NSA CSI IPv6 Security Guidance (2023) [pdf]
-
how did i do? Just a quick Mock up, and i know i need new switches, how im pretty happy with my very first homelab
Also consider running full PCAP collection with https://arkime.com/ so you can monitor your past network traffic. That has come in handy many times for security and troubleshooting, and doesn't require as much horsepower as you might think.
-
Most Valuable Tools
Anyone using Arkime? https://arkime.com/
- how is packet sniffing working ?
-
How would you add multiple filters on wireshark?
dns && ip.src==x.y.z.w Note that this display filter will not display the DNS replies for the requests sent by x.y.z.w if you want those as well then it will be dns && ip.addr==x.y.z.w Although DNS will be displayed in upper case in Wireshark, it has to be in lower case in the display filter, that said, like others said based on your exact needs and the size of your resulting pcap / pcapng file you may want to look at capture filters, finally if you are dealing with multiple gegabytes file(s) you may want to take a look at another tool like Arkime (formerly moloch) https://arkime.com/
-
I'm currently studying to transition from a SIEM administrator to a network forensics analyst. What's are good workflows/resources for analyzing PCAPs?
Full PCAP's? Look at https://arkime.com/ or network miner. Arkime is probably more what you're looking for. But I love network miner
-
Wireshark pcap in elastic search
I used moloch which is now https://arkime.com/. It used to be free and was a great tool for pcaps. Uses elastic underneath.
-
IT Pro Tuesday #155 - Carrier Lookup, Network Podcast, Identification Tool & More
Arkime is secure, scaleable, indexed packet capture and search tool that can improve your network security by providing greater visibility. This open-source tool stores and indexes network traffic in standard PCAP format. Our thanks for the suggestion goes to Security_Chief_Odo.
-
Cisco Network Traffic to Graylog
I would suggest instead of graylog look into something like this https://arkime.com/
pyWhat
-
Go Library like PyWhat?
Is there a library written in Go similar to PyWhat? I want to use a subset of the functionality for a simple go program I'm writing. I could just call PyWhat, link to lemmeknow, or even write a simple go implementation myself, but I wanted to ask if there was a pure go implementation. Thanks!
-
lemmeknow v0.7.0 is here with support for identifying bytes with help of regex crate!
Lemmeknow is basically used for identifying text as mentioned in README and video. It is Rust implementation of PyWhat. You can see various usecases there too.
-
lemmeknow - The fastest way to identify anything!
For rarity, we have got the database from pyWhat and the wiki says:
-
lemmeknow - the fastest way to identify anything!
This project was inspired by u/beesec 's pyWhat
- Tips for Making a Popular Open-Source Project in 2021 [Ultimate Guide]
- PyWhat - Identify Anything
- PyWhat - Identify Anything. Easily identify API keys, secrets, cryptocurrency wallets and more.
-
Is there an application or way to find hashes?
Do you mean something like this: https://github.com/bee-san/pyWhat
- Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is
-
IT Pro Tuesday #155 - Carrier Lookup, Network Podcast, Identification Tool & More
pyWhat enables you to easily identify emails, IP addresses and more. Feed it a .pcap file or some mysterious text or hex of a file, and it will tell you what it is. The tool is recursive, so it can identify everything in text, files and more. A shout out to the tool's author for sharing his creation.
What are some alternatives?
securityonion - Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, and case management. It also includes other tools such as Playbook, osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
BruteShark - Network Analysis Tool
Suricata - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
chepy - Chepy is a python lib/cli equivalent of the awesome CyberChef tool.
luci-wrtbwmon - Bandwidth tracker for OpenWRT that uses wrtbwmon
TryHackMe - This is a repository containing TryHackMe Writeups in Somali language on various of rooms & challenges, including notes, files and solutions.
nsp
usaddress - :us: a python library for parsing unstructured United States address strings into address components
node_pcap - libpcap bindings for node
dumpulator - An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).
grafolean - Easy to use monitoring system
maltrail - Malicious traffic detection system