
ndff
A flow-based network monitor with Deep Packet Inspection

A flow-based network monitor with Deep Packet Inspection

A pcap capture analysis helper

A Zeek IPSec protocol analyzer based on Spicy.

A Zeek Wireguard protocol analyzer based on Spicy.

A Zeek OSPF packet analyzer based on Spicy.

A Zeek STUN protocol analyzer based on Spicy.

Shell Companies Inside Apple's Privacy Relay

A Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.

Network forensics writeup + tooling for a TryHackMe DFIR challenge: reverses a hex→Base64→XOR exfiltration chain from PCAP traffic, then recovers a…

CVE-2017-0199 XLS --> HTA --> VBS --> STEGANOGRAPHY --> DBATLOADER/GULOADER STYLE MALWARE

Reports on post-exploitation on honeypot exploiting vulnerable wu-ftpd (CVE-2001-0550)

⭐ ⭐ Distributed tcpdump for cloud native environments ⭐ ⭐