#1Tools for capturing, inspecting, and analyzing network traffic in real-time or from capture files.
Kitploit recommended
jp/hermes-proxyHermes Proxy - HTTP Traffic Analyzer
mike01/pypacker:package: The fastest and simplest packet manipulation lib for Python
m0vi0/pacmapGraph-first network traffic visualizer for live capture and PCAP replay with checkpoint diffing, path tracing, and Wireshark-style display filters…
pavel-odintsov/fastnetmonVery fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
offensive-hub/black-widowGUI based offensive penetration testing tool (Open Source)
confused-binary/waf-fuTerminal UI for browsing and replaying AWS WAF v2 logs from CloudWatch, S3, and the sampling API, with YAML filtering, auth detection, and…
yeet-src/airtophtop for the airwaves — a live 802.11 (Wi-Fi) RF dashboard in your terminal
gvcoder09/nodpi4androidAndroid proxy app that circumvents Deep Packet Inspection censorship by fragmenting TLS ClientHello packets and rewriting the TLS version to restore…
gvcoder09/nodpiLocal proxy that bypasses Deep Packet Inspection by fragmenting TLS ClientHello packets, enabling access to blocked websites without requiring…
jalvarezz13/krb5roastparserKrbRoastParser is a tool for parsing Kerberos packets from pcap files to extract AS-REQ, AS-REP and TGS-REP hashes
nu11secur1ty/pastokrapacefleciksAnalyzes .pcapng files to generate HTML reports for network traffic inspection and forensic review.
haruu77g/phantomprintPassive hybrid fingerprinting engine — identify hosts without sending a single packet
appneta/tcpreplayEdit and replay captured network traffic at arbitrary speeds — a suite of pcap tools for *NIX and Windows.
oisf/libhtpSecurity-aware HTTP protocol parser library used by IDS/IPS engines to inspect and normalize HTTP traffic for threat detection.
pugazhendii22/keepass-exfil-forensicsNetwork forensics writeup + tooling for a TryHackMe DFIR challenge: reverses a hex→Base64→XOR exfiltration chain from PCAP traffic, then recovers a…
bettercap/bettercapThe Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
yeet-src/usbsnoopLive, system-wide USB transfer sniffer in eBPF — decodes USB traffic inline (control SETUP, SCSI, HID) from two universal URB hooks. No usbmon, no…
boredhackerblog/teamcity-cve-2026-63077-pcapteamcity teamcity-CVE-2026-63077 exploitation pcap
