Skip to content
1337skills 1337skills

BruteShark

Overview

BruteShark is a network forensic analysis tool designed to extract credentials, authentication hashes, and sensitive information from PCAP network capture files. It provides both a GUI interface for Windows and a command-line interface for Linux/macOS. The tool is essential for incident response, digital forensics, and security assessments involving network traffic analysis.

Installation

Windows (GUI Version)

# Download latest release
# https://github.com/odedshimon/BruteShark/releases

# Extract ZIP file
unzip BruteShark-x.x.x-win.zip -d C:\BruteShark

# No additional dependencies required (self-contained)

# Run GUI application
C:\BruteShark\BruteShark.exe

Linux (CLI Version)

# Install dependencies
sudo apt-get update
sudo apt-get install -y git dotnet-sdk-6.0 libpcap-dev

# Clone repository
git clone https://github.com/odedshimon/BruteShark.git
cd BruteShark

# Build the project
dotnet build -c Release

# Run CLI
dotnet run -c Release --project BruteShark.Cli/BruteShark.Cli.csproj

macOS Installation

# Install dependencies via Homebrew
brew install dotnet libpcap git

# Clone and build
git clone https://github.com/odedshimon/BruteShark.git
cd BruteShark
dotnet build -c Release

# Run CLI version
dotnet run -c Release --project BruteShark.Cli/BruteShark.Cli.csproj

Docker Installation

# Build Docker image
docker build -t bruteshark:latest .

# Run BruteShark in container
docker run -v /path/to/pcaps:/data bruteshark:latest \
  -f /data/capture.pcap -o /data/output.json

# Interactive container
docker run -it -v /path/to/pcaps:/data bruteshark:latest /bin/bash

Basic PCAP Analysis

Loading PCAP Files

# Analyze single PCAP file (CLI)
BruteShark.Cli -f capture.pcap

# Analyze with output file
BruteShark.Cli -f capture.pcap -o results.json

# Process multiple PCAP files
BruteShark.Cli -f *.pcap -o combined_results.json

# Process entire directory
BruteShark.Cli -f /path/to/pcaps/ -o results.json

GUI Analysis (Windows)

# Open BruteShark GUI
BruteShark.exe

# File menu options:
# - Open PCAP file
# - Merge PCAP files
# - Recent files
# - Export results

Merge Multiple PCAPs

# Merge PCAP files before analysis
mergecap -w merged.pcap capture1.pcap capture2.pcap capture3.pcap

# Analyze merged file
BruteShark.Cli -f merged.pcap -o results.json

# Time-sorted merge
mergecap -w merged.pcap -s capture1.pcap capture2.pcap

Credential Extraction

HTTP Credentials

ProtocolMethodData Extracted
HTTP Basic AuthBase64 decodedUsername, password
HTTP Form POSTForm data parsingUsername, password, tokens
HTTP CookiesCookie extractionSession tokens, auth cookies
HTTP HeadersHeader parsingAuthorization tokens, API keys

Extract HTTP Credentials

# Extract HTTP form data and authentication
BruteShark.Cli -f capture.pcap --extract-http-credentials

# Show all HTTP requests with credentials
BruteShark.Cli -f capture.pcap --http-basic-auth

# Extract cookies and sessions
BruteShark.Cli -f capture.pcap --extract-cookies

# GUI: Select "Credentials" tab to view HTTP credentials

FTP Credentials

# Extract FTP login credentials
BruteShark.Cli -f capture.pcap --extract-ftp

# FTP username extraction
BruteShark.Cli -f capture.pcap | grep -i "USER"

# FTP password extraction
BruteShark.Cli -f capture.pcap | grep -i "PASS"

# Combined FTP credential recovery
BruteShark.Cli -f capture.pcap --ftp-extract -o ftp_creds.txt

SMTP Credentials

# Extract SMTP authentication
BruteShark.Cli -f capture.pcap --extract-smtp

# SMTP plaintext credentials
BruteShark.Cli -f capture.pcap --smtp-auth

# Email sender/recipient extraction
BruteShark.Cli -f capture.pcap --smtp-extract -o emails.txt

IMAP/POP3 Credentials

# Extract email protocol credentials
BruteShark.Cli -f capture.pcap --extract-email-creds

# IMAP login extraction
BruteShark.Cli -f capture.pcap --imap-extract

# POP3 authentication extraction
BruteShark.Cli -f capture.pcap --pop3-extract

Other Protocol Credentials

# Generic credential extraction
BruteShark.Cli -f capture.pcap --extract-all-credentials

# Supported protocols:
# - Telnet
# - SSH
# - RDP
# - VNC
# - SMB
# - LDAP
# - Kerberos

Hash Extraction

Kerberos Hashes

# Extract Kerberos hashes
BruteShark.Cli -f capture.pcap --extract-kerberos

# Extract TGT (Ticket Granting Ticket) hashes
BruteShark.Cli -f capture.pcap --extract-krbtgt

# Extract service ticket hashes
BruteShark.Cli -f capture.pcap --extract-service-tickets

# Format for offline cracking
BruteShark.Cli -f capture.pcap --kerberos-format hashcat -o kerberos.hashes

NTLM Hashes

# Extract NTLM authentication hashes
BruteShark.Cli -f capture.pcap --extract-ntlm

# NTLM v1 hash extraction
BruteShark.Cli -f capture.pcap --ntlm-v1

# NTLM v2 hash extraction
BruteShark.Cli -f capture.pcap --ntlm-v2

# Output for John the Ripper
BruteShark.Cli -f capture.pcap --ntlm-extract -o ntlm.txt

MD5/SHA Hashes

# Extract any MD5 hashes found
BruteShark.Cli -f capture.pcap --extract-md5

# Extract SHA hashes
BruteShark.Cli -f capture.pcap --extract-sha

# Extract all hash types
BruteShark.Cli -f capture.pcap --extract-all-hashes

Hash Formatting

# Format hashes for hashcat
BruteShark.Cli -f capture.pcap --extract-hashes --format hashcat -o hashes.hashcat

# Format for John the Ripper
BruteShark.Cli -f capture.pcap --extract-hashes --format john -o hashes.john

# Format for online lookup
BruteShark.Cli -f capture.pcap --extract-hashes --format plain -o hashes.txt

Network Diagram Generation

Create Network Topology Diagrams

# Generate network diagram
BruteShark.Cli -f capture.pcap --generate-diagram

# Output diagram as image
BruteShark.Cli -f capture.pcap --diagram-output network.png

# Generate diagram in GraphML format (for Gephi)
BruteShark.Cli -f capture.pcap --diagram-format graphml -o network.graphml

# Generate diagram in DOT format (Graphviz)
BruteShark.Cli -f capture.pcap --diagram-format dot -o network.dot

Visualize Network Connections

ElementRepresentation
NodesIP addresses / Hostnames
EdgesNetwork connections
Edge WeightNumber of packets
Node SizeTraffic volume
ColorsTraffic type / Protocol

Convert Diagrams

# Convert DOT to PNG using Graphviz
dot -Tpng network.dot -o network.png

# Convert to SVG
dot -Tsvg network.dot -o network.svg

# Convert to PDF
dot -Tpdf network.dot -o network.pdf

# View in Gephi (import GraphML)
# File → Open → network.graphml

File Extraction

Extract Files from PCAP

# Extract all files found in traffic
BruteShark.Cli -f capture.pcap --extract-files

# Extract to specific directory
BruteShark.Cli -f capture.pcap --extract-files -o /path/to/extract/

# Extract specific file types
BruteShark.Cli -f capture.pcap --extract-file-types exe,pdf,docx

# List files before extracting
BruteShark.Cli -f capture.pcap --list-files

File Carving from HTTP

# Extract HTTP-transferred files
BruteShark.Cli -f capture.pcap --extract-http-files

# Extract images only
BruteShark.Cli -f capture.pcap --extract-images

# Extract documents
BruteShark.Cli -f capture.pcap --extract-documents

# Extract by MIME type
BruteShark.Cli -f capture.pcap --extract-mime-type application/pdf

Verify Extracted Files

# Calculate checksums of extracted files
sha256sum extracted_files/*

# Scan with VirusTotal
for file in extracted_files/*; do
  echo "Scanning: $file"
  # Integration with VirusTotal API (requires API key)
done

# File type validation
file extracted_files/*

Session Reconstruction

Reconstruct Network Streams

# Extract complete TCP sessions
BruteShark.Cli -f capture.pcap --reconstruct-sessions

# Reconstruct specific protocol
BruteShark.Cli -f capture.pcap --reconstruct-http

# Save reconstructed streams
BruteShark.Cli -f capture.pcap --reconstruct-sessions -o sessions/

# View session content
cat sessions/session_1.txt

HTTP Session Reconstruction

# Extract complete HTTP requests/responses
BruteShark.Cli -f capture.pcap --reconstruct-http -o http_sessions/

# Separate requests and responses
BruteShark.Cli -f capture.pcap --http-separate-req-resp

# Include HTTP headers and body
BruteShark.Cli -f capture.pcap --http-full-content

FTP Session Reconstruction

# Reconstruct FTP sessions with file transfers
BruteShark.Cli -f capture.pcap --reconstruct-ftp -o ftp_sessions/

# Show FTP commands and responses
BruteShark.Cli -f capture.pcap --ftp-transcript

# Extract transferred files from FTP
BruteShark.Cli -f capture.pcap --ftp-extract-files

TLS/SSL Session Reconstruction

# Extract TLS handshake information
BruteShark.Cli -f capture.pcap --extract-tls-info

# Extract SSL certificates
BruteShark.Cli -f capture.pcap --extract-certificates -o certs/

# Analyze certificate chain
openssl x509 -in certs/certificate.pem -text -noout

DNS Query Extraction

Extract DNS Queries and Responses

# Extract all DNS queries
BruteShark.Cli -f capture.pcap --extract-dns

# Export DNS data as JSON
BruteShark.Cli -f capture.pcap --extract-dns --format json -o dns.json

# Export as CSV for analysis
BruteShark.Cli -f capture.pcap --extract-dns --format csv -o dns.csv

# Filter by query type
BruteShark.Cli -f capture.pcap --dns-query-type A,AAAA,MX

DNS Analysis

Query TypeDescription
AIPv4 address resolution
AAAAIPv6 address resolution
MXMail exchange records
NSNameserver records
CNAMECanonical name records
TXTText records (SPF, DKIM)
SOAStart of authority
PTRReverse DNS lookup

DNS Forensics

# Extract DNS tunneling attempts
BruteShark.Cli -f capture.pcap --detect-dns-tunneling

# Identify suspicious domain lookups
BruteShark.Cli -f capture.pcap --dns-security-analysis

# Extract DNS server addresses
BruteShark.Cli -f capture.pcap --dns-servers -o dns_servers.txt

# Timeline of DNS activity
BruteShark.Cli -f capture.pcap --dns-timeline -o dns_timeline.csv

Advanced Features

Output Formats

# JSON output (most comprehensive)
BruteShark.Cli -f capture.pcap -o results.json

# CSV output
BruteShark.Cli -f capture.pcap --format csv -o results.csv

# XML output
BruteShark.Cli -f capture.pcap --format xml -o results.xml

# HTML report
BruteShark.Cli -f capture.pcap --format html -o report.html

Filtering and Queries

# Filter by source IP
BruteShark.Cli -f capture.pcap --filter "src_ip=192.168.1.100"

# Filter by destination IP
BruteShark.Cli -f capture.pcap --filter "dst_ip=10.0.0.1"

# Filter by protocol
BruteShark.Cli -f capture.pcap --filter "protocol=http"

# Combine multiple filters
BruteShark.Cli -f capture.pcap --filter "src_ip=192.168.1.* AND protocol=ftp"

# Complex filter expression
BruteShark.Cli -f capture.pcap --filter "(protocol=http OR protocol=https) AND dst_port=80"

Performance Optimization

# Multi-threaded processing
BruteShark.Cli -f capture.pcap --threads 8

# Process large files
BruteShark.Cli -f capture.pcap --chunk-size 100000

# Memory-efficient mode
BruteShark.Cli -f capture.pcap --low-memory

# Progress reporting
BruteShark.Cli -f capture.pcap --progress

GUI Features (Windows)

Main Interface Components

ComponentFunction
Credentials TabView extracted usernames/passwords
Hashes TabView extracted authentication hashes
Files TabBrowse extracted files
DNS TabView DNS queries
Network DiagramVisual topology of network
Sessions TabView reconstructed sessions
SearchSearch across all data

GUI Export Options

# Export credentials table
# Right-click credentials table → Export → CSV

# Copy selected credentials
# Select row → Ctrl+C → Paste to text file

# Export entire session
# File → Export Results → JSON

# Print network diagram
# View Diagram → Print

Integration with Other Tools

Export for Password Cracking

# Extract hashes for Hashcat
BruteShark.Cli -f capture.pcap --extract-hashes --format hashcat | \
  hashcat -m 1000 -a 0 -O dictionary.txt

# Extract for John the Ripper
BruteShark.Cli -f capture.pcap --extract-hashes --format john | \
  john --wordlist=dictionary.txt

# Extract for Hydra
BruteShark.Cli -f capture.pcap --extract-credentials -o creds.txt

Integration with SIEM

# Export to JSON for ELK Stack
BruteShark.Cli -f capture.pcap -o elasticsearchdata.json

# Export for Splunk
BruteShark.Cli -f capture.pcap --format splunk -o splunk_data.txt

# Syslog format export
BruteShark.Cli -f capture.pcap --format syslog | nc siem-server.com 514

Wireshark Integration

# Open PCAP in Wireshark for detailed analysis
wireshark capture.pcap

# Use Wireshark filters after BruteShark extraction
# Display filter: ip.src == 192.168.1.100

# Export Wireshark packet list
# File → Export Packet Dissections → As JSON

Batch Processing

Process Multiple Files

# Create batch script for Windows
@echo off
for %%F in (*.pcap) do (
  BruteShark.exe -f "%%F" -o "%%~nF_results.json"
)

# Create batch script for Linux
#!/bin/bash
for pcap in *.pcap; do
  dotnet run -c Release -f "$pcap" -o "${pcap%.pcap}_results.json"
done

Parallel Processing

# Use GNU Parallel for Linux
parallel BruteShark.Cli -f {} -o {.}_results.json ::: *.pcap

# PowerShell parallel processing for Windows
Get-ChildItem *.pcap | ForEach-Object -Parallel {
  BruteShark.exe -f $_.FullName -o "$($_.BaseName)_results.json"
}

Troubleshooting

Common Issues

IssueSolution
PCAP file not readableVerify PCAP format with file command; try repair with tcpdump
No credentials extractedVerify traffic contains supported protocols; check encryption
Memory exhaustionUse --low-memory mode; split PCAP file
Performance issuesIncrease thread count; reduce output verbosity
GUI won’t startVerify .NET Framework installed; check Windows permissions

Debug Commands

# Verify PCAP file integrity
pcapfix -o repaired.pcap corrupted.pcap

# Extract PCAP statistics
capinfos capture.pcap

# Show packet count by protocol
tshark -r capture.pcap -q -z io,phs

# List all unique IPs in capture
tshark -r capture.pcap -T fields -e ip.src -e ip.dst | sort -u

Security Considerations

Safe Analysis Practices

# Analyze in isolated environment
# Use virtual machine for untrusted PCAPs

# Validate extracted files before execution
sha256sum extracted_files/*

# Scan extracted files for malware
clamav extracted_files/

# Review credentials securely
# Use password manager for secure storage

Data Protection

# Encrypt analysis results
gpg --cipher-algo AES256 -c results.json

# Secure deletion of sensitive data
shred -vfz results.txt

# Temporary analysis directory
mkdir -p /tmp/bruteshark_analysis
cd /tmp/bruteshark_analysis

Resources