{"id":13826448,"url":"https://github.com/madpowah/forensicpcap","last_synced_at":"2025-07-09T00:33:31.760Z","repository":{"id":23925336,"uuid":"27306042","full_name":"madpowah/ForensicPCAP","owner":"madpowah","description":null,"archived":false,"fork":false,"pushed_at":"2022-07-03T23:51:00.000Z","size":7,"stargazers_count":42,"open_issues_count":0,"forks_count":20,"subscribers_count":4,"default_branch":"master","last_synced_at":"2024-08-05T09:15:17.426Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/madpowah.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-11-29T15:23:47.000Z","updated_at":"2024-01-21T07:39:09.000Z","dependencies_parsed_at":"2022-07-10T10:20:55.719Z","dependency_job_id":null,"html_url":"https://github.com/madpowah/ForensicPCAP","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/madpowah%2FForensicPCAP","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/madpowah%2FForensicPCAP/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/madpowah%2FForensicPCAP/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/madpowah%2FForensicPCAP/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/madpowah","download_url":"https://codeload.github.com/madpowah/ForensicPCAP/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225476383,"owners_count":17480215,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T09:01:37.893Z","updated_at":"2024-11-20T05:30:45.576Z","avatar_url":"https://github.com/madpowah.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"7bf0f5839fb2827fdc1b93ae6ac7f53d\"\u003e\u003c/a\u003e工具","\u003ca id=\"ecb63dfb62722feb6d43a9506515b4e3\"\u003e\u003c/a\u003e新添加"],"sub_categories":["\u003ca id=\"b3811e8d4be5755957b0ec0e336715a2\"\u003e\u003c/a\u003e取证"],"readme":"ForensicPCAP\n============\nABOUT\n============\nForensicPCAP is a Python Network Forensic tool to analyze a PCAP file.\n\nDEPENDENCIES\n============\nForensicPCAP uses Scapy and Cmd2. So first you have to install them typing :\n```sh\napt-get install python-scapy\npip install cmd2\n```\nHOW TO USE IT\n============\nForensicPCAP uses Cmd2 so you can juste type \"help\" or \"help \u0026lt;command\u0026gt;\" to get informations.  \u0026gt; can be used to write to a file. \"shell\" permits to exec shell commands.\n##### Launch\n```sh\npython forensicPCAP file.pcap\n```\n##### Help\n```sh\nForPCAP \u003e\u003e\u003e help\n\nDocumented commands (type help \u003ctopic\u003e):\n========================================\n_load           dstports  history  list   py    search     show   \n_relative_load  ed        ipsrc    load   r     set        stat   \ncmdenvironment  edit      l        mail   run   shell      version\ndns             hi        li       pause  save  shortcuts  web    \n\nUndocumented commands:\n======================\nEOF  eof  exit  help  q  quit\n```\n##### Stats\nPrints stats about PCAP\n```sh\nForPCAP \u003e\u003e\u003e stat\n## Calculating statistics about the PCAP ... OK.\n## Statistics :\nTCP : 142 packet(s)\nUDP : 81 packet(s)\nICMP : 0 packet(s)\nOther : 24 packet(s)\nTotal : 247 packet(s)\n## End of statistics\n```\n##### Show\nPrints information about packet or last command result.\u003cbr /\u003eUsage : \n- show : print result of the last command\n- show \u0026lt;packet id\u0026gt; : show information about a specific packet\n- show raw : show the raw data if last command was followtcpstream\n- show pcap : show all a summary of all packets\n\n##### Dns\nPrints all DNS requests from the PCAP file. The id before the DNS is the packet's id which can be use with the \"show\" command.\n```sh\nForPCAP \u003e\u003e\u003e dns\n## Listing all DNS requests ...OK.\n## Result : 34 DNS request(s)\nForPCAP \u003e\u003e\u003e show\n1 | www.url.com\n2 | www.url2.com\n```\n### Dstports\nPrints all destination ports from the PCAP file. The id before the DNS is the packet's id which can be use with the \"show\" command.\n```sh\nForPCAP \u003e\u003e\u003e dstports\n## Listing all destination port in the PCAP ... OK.\nResult : 20 ports##\nForPCAP \u003e\u003e\u003e show\n43 | 443\n44 | 80\n```\n##### Ipsrc\nPrints the number of ip source and store them.\n```sh\nForPCAP \u003e\u003e\u003e ipsrc\n## Searching IP source ... .OK.\nResult : 1 ips##\nForPCAP \u003e\u003e\u003e show\n10.0.0.1\n```\n##### Web\nPrints the number of web's requests and store them\n```sh\nForPCAP \u003e\u003e\u003e web\n## Searching web's request ... .................OK.\n\nWeb's request : 17\nForPCAP \u003e\u003e\u003e show\nGET / HTTP/1.1\nCache-Control: max-age = 1800\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: \nHost: www.url.com\n```\n\n##### Mail\nPrints the number of mail's requests and store them\n```sh\nForPCAP \u003e\u003e\u003e mail\n## Searching mail's request ... OK.\nMail's request : 4\nForPCAP \u003e\u003e\u003e show\n+OK Dovecot ready.\nCAPA\n+OK\n....\n```\n##### FollowTCPStream\nPermits to follow a TCP sequence\nUsage :\n- followtcptream \u003cpacket ID\u003e\n\n##### Search\nPermits to search specific packets\u003cbr /\u003e\nUsage :\n```sh\n- search \u003coptions\u003e\n        -p | --protocol \u003cport number\u003e (TCP by default) : this option must be the first option if changed\n        --ip \u003cip\u003e\n        --dport | --destination-port \u003cport number\u003e\n        --sport | --source_port \u003cport number\u003e\n        --ipsrc | --ip-source \u003cip\u003e\n        --ipdst | --ip-destination \u003cip\u003e\n        -s | --string \u003cstring\u003e : will search the string in all packets\n        ```\n Example :\n```sh\nForPCAP \u003e\u003e\u003e search --dport 80\n## Searching request ... ..............................................................................................................\nSearch's result : 1\nForPCAP \u003e\u003e\u003e show\n1 | Ether / IP / TCP 10.0.0.1:49173 \u003e 192.168.0.1:http S\n```\nContact\n============\nYou can contact me at cloud(at)madpowah(dot)org\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmadpowah%2Fforensicpcap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmadpowah%2Fforensicpcap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmadpowah%2Fforensicpcap/lists"}