PacketSnitch

Overview

A network analysis platform that transforms packet captures into searchable, protocol-aware intelligence, helping security professionals, developers, and researchers rapidly uncover hosts, credentials, certificates, files, locations, protocols, anomalies, threat intelligence, and other actionable insights.

Documentation

Documentation — Backend, Frontend, Plugins, Filters, and Context Menu reference.

Demo

If you would like to follow along with the video here are the necessary links to set up your own environment

The pcap with the captured exploitation.
Also here is the source code to the exploit.
Here is the vulnerable software

Quick Start

Download – grab the latest prod release:

The latest release can be found on the releases page.

OR…

Build – build it from source code:

Clone the repository, this can be done via: git clone https://github.com/oxasploits/PacketSnitch.git.
Move into the PacketSnitch direcotry: cd PacketSnitch.
Use NPM to install build dependancies: npm install.
If on Linux (specifically Fedora) run: npm run patch-rpm-build.
Build the project, this compiles the backend and frontend: npm run make.
You can now launch the dev version using: npm start!
Note: The installer is also packaged at: ./out/make/*

Install – install the package:

Linux:

sudo dnf install ./out/make/*/packetsnitch-*.rpm  # redhat/centos/fedora
sudo apt install ./out/make/*/packetsnitch-*.deb  # debian/kali/ubuntu

Windows:

Click: PacketSnitchInstaller.exe

Launch — launch the desktop app:

packetsnitch                      # Linux
packetsnitch.exe (or click)       # Windows

Samples

Load a capture and start analyzing!

In the samples folder there are some sample captures for you to play with. PacketSnitch is compatible with both pcap and pcapng style captures.

Note: Some of the samples folder captures are for internal testing purposes, and their protocols have varying coverage as far as compatibility goes inside PacketSnitch. Some may even crash PacketSnitch or any number of other things! You have been warned!

Some captures you can test the code with:

If you want to test anything else, a great resource is the Wireshark Sample Captures Page, I would get started there.

Have fun!

License

EULA

Contact Resources

Project Head: Marshall Whittaker marshall@oxasploits.com

Thanks / Contibutions

Marshall Whittaker (project design, primary frontend/backend dev)
Vesteria (backend tor node detection code)
Venkat Jashwanth Putta / blissfulboy (frontend design suggestions, and PS 2.0+ vuln assessments and quality assurance)
kusanagi (frontend feedback and some sponsorship stuff)
Martin Ollivere (Rat on wheel spinning gif)
tiamo64 (Performance optimizations)
aestetix (inspiration on how this documentation page should be formatted)
Anupam Mediratta (path traversal bugfix)
Gopher (Ideas related to integration into Paddle for payment processor)
2600net staff (hosting the irc server where our dev channel resides
Everyone else who has tested or contributed in some way, big or small, thank you!