Advertisements

PA Toolkit – Wireshark Extensions for Penetration Testers

PA Toolkit is a collection of traffic analysis plugins to extend the functionality of Wireshark from a micro-analysis tool and protocol dissector to the macro analyzer and threat hunter. PA Toolkit contains plugins (both dissectors and taps) covering various scenarios for multiple protocols, including:

  • WiFi (WiFi network summary, Detecting beacon, deauth floods etc.)
  • HTTP (Listing all visited websites, downloaded files)
  • HTTPS (Listing all websites opened on HTTPS)
  • ARP (MAC-IP table, Detect MAC spoofing and ARP poisoning)
  • DNS (Listing DNS servers used and DNS resolution, Detecting DNS Tunnels)

The project is under active development and more plugins will be added in near future.

This material was created while working on “Traffic Analysis: TSHARK Unleashed” course. Those interested can check the course here: https://www.pentesteracademy.com/course?id=42

Terms of Use

  • This is licensed under GPL just as Wireshark.

Installation

Steps:

  1. Copy the “plugins” directory to Wireshark plugins directory.
  2. Start wireshark. 🙂

One can get the location of wireshark plugins directory by checking Help > About Wireshark > Folders

https://i2.wp.com/user-images.githubusercontent.com/743886/43845711-72426d36-9ae1-11e8-9945-0bbe8e078e2a.png?w=800&ssl=1

Tool featured at

Author

Under the guidance of Mr. Vivek Ramachandran, CEO, Pentester Academy

Documentation

For more details refer to the “PA-Toolkit.pdf” PDF file. This file contains the slide deck used for presentations.

Screenshots

PA Toolkit after installation

https://i1.wp.com/user-images.githubusercontent.com/743886/44320933-e4772d80-a3f9-11e8-86c6-82b614221700.png?w=800&ssl=1

List of websites visited over HTTP

https://i2.wp.com/user-images.githubusercontent.com/743886/44320940-e8a34b00-a3f9-11e8-98e9-ab003107d15c.png?w=800&ssl=1

Search functionality

https://i1.wp.com/user-images.githubusercontent.com/743886/44320950-f48f0d00-a3f9-11e8-897a-d84d5e20e2e0.png?w=800&ssl=1

Domain to IP mappings

https://i2.wp.com/user-images.githubusercontent.com/743886/44320953-f8bb2a80-a3f9-11e8-8530-70d36b0a1bff.png?w=800&ssl=1

Advertisements
Advertisements
Advertisements
Advertisements
Advertisements
%d bloggers like this: