https://github.com/projectdiscovery/network-fingerprint
A fingerprint generation helper for nuclei network templates
https://github.com/projectdiscovery/network-fingerprint
Last synced: 11 months ago
JSON representation
A fingerprint generation helper for nuclei network templates
- Host: GitHub
- URL: https://github.com/projectdiscovery/network-fingerprint
- Owner: projectdiscovery
- License: mit
- Created: 2021-04-08T17:41:12.000Z (over 5 years ago)
- Default Branch: master
- Last Pushed: 2022-11-20T16:51:36.000Z (over 3 years ago)
- Last Synced: 2025-08-17T21:33:12.810Z (11 months ago)
- Language: Go
- Size: 24.4 KB
- Stars: 75
- Watchers: 11
- Forks: 11
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
README
# network-fingerprint
[](https://opensource.org/licenses/MIT)
[](https://goreportcard.com/report/github.com/projectdiscovery/network-fingerprint)
[](https://github.com/projectdiscovery/network-fingerprint/issues)
[](https://twitter.com/pdnuclei)
[](https://discord.gg/projectdiscovery)
Capture packet request/response pairs for a port and/or IP to aid in Network protocol based Nuclei Templates creation.
# Resources
- [Installation Instructions](#installation-instructions)
- [Usage](#usage)
- [Running network-fingerprint](#running-network-fingerprint)
- [Output Format](#output-format)
# Usage
```sh
▶ network-fingerprint -h
```
This will display help for the tool. You can find all the supported switches below:
| Flag | Description | Example |
|-------|-------------------------------------------------|-------------------------------------|
| iface | Interface to perform capture on (default `lo0`) | `network-fingerprint -iface eth0` |
| ip | IP to filter packets for | `network-fingerprint -ip 127.0.0.1` |
| port | Port to capture packets on | `network-fingerprint -port 27017` |
# Installation Instructions
`network-fingerprint` requires **go1.17+** to install successfully and have `libpcap-dev` installed on the system.
To install `libpcap-dev`:
```sh
▶ apt install -y libpcap-dev
```
```sh
▶ go install -v github.com/projectdiscovery/network-fingerprint@latest
```
# Running network-fingerprint
To run the tool on a target to capture traffic on a port, just use the following command.
```sh
▶ network-fingerprint -port
```
where `` is the port you want to capture traffic for.
To also filter by IP while running on more common ports like 80, where there is a lot of noise, you can use the ip flag.
```sh
▶ network-fingerprint -port -ip
```
Here is a detailed blog showcasing the uses of network-fingerprint - https://blog.projectdiscovery.io/writing-network-templates-with-nuclei/
### Output Format
```bash
testing@local# network-fingerprint -port 27017 -ip 127.0.0.1
2021/04/08 23:15:07 network-fingerprint: nuclei-helper by @pdiscoveryio
2021/04/08 23:15:07 [device] en0 IP: 192.168.1.9
2021/04/08 23:15:07 [device] bridge100 IP: 192.168.64.1
2021/04/08 23:15:07 [device] lo0 IP: 127.0.0.1
```
```json
{
"data": "\ufffd",
"hex": "dd",
"request": true
}
{
"data": "?\u0001",
"hex": "3f01",
"response": true
}
```
Requests (Client to Destination) messages have `request: true` while responses (Destination To Client) have `response: true` set to help in easily identifying correct fingerprints.