Skip to content

Commit b1c76be

Browse files
mammo0mammo0
committed
added NetworkMiner 2.7.1 source code
1 parent e597024 commit b1c76be

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+105089
-86180
lines changed

‎ChangeLog

Lines changed: 59 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,65 @@
1+
NetworkMiner 2.7.1
2+
* PacketHandler.cs: Fixed bug related to live sniffing. Thanks to Jeff Rivett for
3+
reporting the issue!
4+
5+
NetworkMiner 2.7
6+
* WinPCapWrapper.cs: Changed int pointers to 64 bit values in order to handle WinPcap
7+
and npcap drivers correctly.
8+
Thanks to Jeff Rivett for reporting the issue!
9+
10+
* Smb2PacketHandler.cs: Added requested SMB2 filename info from SMB2 Create Requests
11+
and error messages from negative SMB2 responses to Parameters tab.
12+
13+
* Smb2Packet.cs: Better extraction of SMB2 file transfers by extracting End-of-File
14+
values from Smb2CreateResponse.
15+
16+
* LpdPacket.cs: Added support for Line Printer Daemon Protocol (RFC1179).
17+
Thanks to Hayo Brouwer (of Ricoh) for helping out with capture files!
18+
19+
* NetworkTcpSession.cs: Modified TCP Keepalive handling to support protocols
20+
that transmit 1 byte TCP payloads containing a 0x00 byte (like LPD).
21+
22+
* TcpPacket.cs: Changed GetSubPackets function to allow application layer packets
23+
with only one byte of L7 data to be returned.
24+
25+
* SatoriTcpOsFingerprinter.cs: Improved performance by indexing fingerprints based
26+
on TCP flags.
27+
28+
* HttpPacketHandler.cs: Generic extraction of files sent with HTTP POST, including
29+
WAP.MMS messages. More files are now extracted from HTTP POST uploads.
30+
31+
* DnsPacket.cs: Added extraction of TXT records to DNS tab
32+
33+
* DnsPacket.cs: Added extraction of SRV records to DNS tab
34+
35+
* NetworkMinerForm.cs: Double-clicking on a file now opens up the file details window
36+
37+
* ExtractedFileDetailsForm.cs: Added hex viewer to file details window
38+
39+
* FileStreamAssembler.cs: The file extension is now identified based on the contents
40+
of the file's header (fewer "octet-stream" files, more ".exe" and ".zip" etc.)
41+
42+
* NetworkMinerForm.cs: Added warning message when trying to open/run an executable
43+
file with right-click -> "Open file"
44+
45+
* TlsRecordPacket.cs: Extraction of JA3S hashes from TLS Server Hello packets to
46+
Parameters tab and Host Details
47+
48+
* PcapParser.cs: Added support for nanosecond PCAP files
49+
150

251
NetworkMiner 2.6
352

4-
* KerberosPacketHandler.cs: Better extraction of Salt from Kerberos ERROR packets.
53+
* KerberosPacketHandler.cs: Better extraction of Salt from Kerberos ERROR packets.
554

6-
* NtlmSspPacketHandler.cs: Added John-the-Ripper formated extraction of LanMan, NTLMv1
7-
and NTLMv2 challenge/response hashes
8-
LanMan example: $LM$A9C604D244C4E99D
9-
NTLMv1 example: $NETNTLM$1122334455667788$B2B2220790F40C88BCFF347C652F67A7C4A70D3BEBD70233
10-
NTLMv2 example: $NETNTLMv2$NTLMV2TESTWORKGROUP$1122334455667788$07659A550D5E9D02996DFD95C87EC1D5$0101000000000000006CF6385B74CA01B3610B02D99732DD000000000200120057004F0052004B00470052004F00550050000100200044004100540041002E00420049004E0043002D0053004500430055005200490000000000
11-
- LM (hashcat "-m 3000")
12-
- NETNTLM (hashcat "-m 5500")
13-
- NETNTLMv2 (hashcat "-m 5600")
55+
* NtlmSspPacketHandler.cs: Added John-the-Ripper formated extraction of LanMan, NTLMv1
56+
and NTLMv2 challenge/response hashes
57+
LanMan example: $LM$A9C604D244C4E99D
58+
NTLMv1 example: $NETNTLM$1122334455667788$B2B2220790F40C88BCFF347C652F67A7C4A70D3BEBD70233
59+
NTLMv2 example: $NETNTLMv2$NTLMV2TESTWORKGROUP$1122334455667788$07659A550D5E9D02996DFD95C87EC1D5$0101000000000000006CF6385B74CA01B3610B02D99732DD000000000200120057004F0052004B00470052004F00550050000100200044004100540041002E00420049004E0043002D0053004500430055005200490000000000
60+
- LM (hashcat "-m 3000")
61+
- NETNTLM (hashcat "-m 5500")
62+
- NETNTLMv2 (hashcat "-m 5600")
1463

1564
* HttpPakcetHandler.cs: Improved extraction of json data sent in HTTP(2) POST requests.
1665
Now with support for Content-Encoding: gzip
@@ -47,7 +96,7 @@ NetworkMiner 2.6
4796
attachment filenames.
4897

4998
* SipPacketHandler.cs: SIP chat messages [RFC3428] are extracted to the "Messages" tab.
50-
Audio extraction of VoIP calls is still a feature that is exlusively available only
99+
Audio extraction of VoIP calls is still a feature that is exclusively available only
51100
in NetworkMiner Professional though.
52101

53102
* HttpPacketHandler.cs and Http2PacketHandler.cs: The HTTP header "Accept-Language" and

‎PacketParser/CleartextTools/BloomFilter.cs

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -27,19 +27,22 @@ public BloomFilter(ICollection<string> wordList) {
2727
this.indexMask=indexSize-1;
2828

2929
this.bitArray=new BitArray(indexSize, false);//2^24 bits = 16MByte
30-
this.nHashFunctions=(int)(0.7*indexSize/wordList.Count);
30+
if (wordList.Count == 0)
31+
this.nHashFunctions = 1;
32+
else
33+
this.nHashFunctions=(int)(0.7*indexSize/(wordList.Count));
3134

3235
foreach(string s in wordList)
33-
AddWord(s);
36+
this.AddWord(s);
3437
for(int i=0; i<bitArray.Length; i++)
35-
if(bitArray[i])
36-
tmpStatFilledValues++;
38+
if(this.bitArray[i])
39+
this.tmpStatFilledValues++;
3740
}
3841

3942
public bool HasWord(string word) {
40-
int[] indexes=GetIndexes(word);
43+
int[] indexes= this.GetIndexes(word);
4144
foreach(int index in indexes)
42-
if(!bitArray[index])
45+
if(!this.bitArray[index])
4346
return false;
4447
return true;
4548
}
@@ -50,19 +53,16 @@ private int[] GetIndexes(string word) {
5053
//simple hash method
5154
for(int i=0; i<indexes.Length; i++) {
5255
int hash=(word+i.ToString()).GetHashCode();
53-
//indexes[i]=(hash^(hash>>16))&indexMask;
54-
indexes[i] = (hash * i * 7) & indexMask;
56+
indexes[i] = (hash * i * 7) & this.indexMask;
5557
}
56-
//System.Cry
57-
5858
return indexes;
5959
}
6060

6161
private void AddWord(string word) {
6262
word=word.ToLower();
63-
int[] indexes=GetIndexes(word);
63+
int[] indexes= this.GetIndexes(word);
6464
foreach(int index in indexes)
65-
bitArray[index]=true;
65+
this.bitArray[index]=true;
6666
this.wordCount++;
6767

6868

‎PacketParser/Events/ParametersEventArgs.cs

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -17,20 +17,6 @@ public class ParametersEventArgs : EventArgs, System.Xml.Serialization.IXmlSeria
1717
private ParametersEventArgs() { }//for serialization purposes
1818

1919

20-
[Obsolete]
21-
public ParametersEventArgs(long frameNumber, NetworkHost sourceHost, NetworkHost destinationHost, string sourcePort, string destinationPort, IEnumerable<KeyValuePair<string,string>> parameters, DateTime timestamp, string details) {
22-
this.FrameNumber = frameNumber;
23-
this.SourceHost = sourceHost;
24-
this.DestinationHost = destinationHost;
25-
this.SourcePort = sourcePort;
26-
this.DestinationPort = destinationPort;
27-
this.Parameters = new System.Collections.Specialized.NameValueCollection();
28-
foreach (KeyValuePair<string, string> kvp in parameters)
29-
this.Parameters.Add(kvp.Key, kvp.Value);
30-
this.Timestamp = timestamp;
31-
this.Details = details;
32-
}
33-
3420
public ParametersEventArgs(long frameNumber, NetworkHost sourceHost, NetworkHost destinationHost, FiveTuple.TransportProtocol transport, ushort sourcePort, ushort destinationPort, System.Collections.Specialized.NameValueCollection parameters, DateTime timestamp, string details) : this(frameNumber, sourceHost, destinationHost, transport.ToString() + " " + sourcePort, transport.ToString() + " " + destinationPort, parameters, timestamp, details) {
3521
//nothing more to add
3622
}
@@ -46,6 +32,20 @@ private ParametersEventArgs(long frameNumber, NetworkHost sourceHost, NetworkHos
4632
this.Details=details;
4733
}
4834

35+
[Obsolete]
36+
public ParametersEventArgs(long frameNumber, NetworkHost sourceHost, NetworkHost destinationHost, string sourcePort, string destinationPort, IEnumerable<KeyValuePair<string, string>> parameters, DateTime timestamp, string details) {
37+
this.FrameNumber = frameNumber;
38+
this.SourceHost = sourceHost;
39+
this.DestinationHost = destinationHost;
40+
this.SourcePort = sourcePort;
41+
this.DestinationPort = destinationPort;
42+
this.Parameters = new System.Collections.Specialized.NameValueCollection();
43+
foreach (KeyValuePair<string, string> kvp in parameters)
44+
this.Parameters.Add(kvp.Key, kvp.Value);
45+
this.Timestamp = timestamp;
46+
this.Details = details;
47+
}
48+
4949
[Obsolete]
5050
public ParametersEventArgs(long frameNumber, FiveTuple fiveTuple, bool transferIsClientToServer, System.Collections.Specialized.NameValueCollection parameters, DateTime timestamp, string details) {
5151
this.FrameNumber = frameNumber;

‎PacketParser/FileTransfer/FileSegmentAssembler.cs

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -79,40 +79,12 @@ internal FileSegmentAssembler(string fileOutputDirectory, NetworkTcpSession netw
7979
this.fiveTuple = networkTcpSession.Flow.FiveTuple;
8080
this.transferIsClientToServer = transferIsClientToServer;
8181

82-
/*
83-
if (this.fileTransferIsServerToClient) {
84-
this.sourceHost = networkTcpSession.ServerHost;
85-
this.destinationHost = networkTcpSession.ClientHost;
86-
this.sourcePort = networkTcpSession.ServerTcpPort;
87-
this.destinationPort = networkTcpSession.ClientTcpPort;
88-
}
89-
else {
90-
this.sourceHost = networkTcpSession.ClientHost;
91-
this.destinationHost = networkTcpSession.ServerHost;
92-
this.sourcePort = networkTcpSession.ClientTcpPort;
93-
this.destinationPort = networkTcpSession.ServerTcpPort;
94-
}*/
95-
96-
/*
97-
this.filePath = filePath;
98-
this.uniqueFileId = uniqueFileId;
99-
this.parentAssemblerList = parentAssemblerList;
100-
this.fileStreamAssemblerList = fileStreamAssemblerList;
101-
this.fileStreamType = fileStreamType;
102-
this.details = details;
103-
*/
10482
}
10583

10684
internal FileSegmentAssembler(string fileOutputDirectory, bool transferIsClientToServer, string filePath, string uniqueFileId, FileTransfer.FileStreamAssemblerList fileStreamAssemblerList, PopularityList<string, PacketParser.FileTransfer.FileSegmentAssembler> parentAssemblerList, FileStreamTypes fileStreamType, string details, FiveTuple fiveTuple, string serverHostname)
10785
: this(fileOutputDirectory, filePath, uniqueFileId, fileStreamAssemblerList, parentAssemblerList, fileStreamType, details, serverHostname) {
10886
this.fiveTuple = fiveTuple;
10987
this.transferIsClientToServer = transferIsClientToServer;
110-
/*
111-
this.sourceHost = sourceHost;
112-
this.destinationHost = destinationHost;
113-
this.sourcePort = sourcePort;
114-
this.destinationPort = destinationPort;
115-
*/
11688
}
11789

11890
private FileSegmentAssembler(string fileOutputDirectory, string filePath, string uniqueFileId, FileTransfer.FileStreamAssemblerList fileStreamAssemblerList, PopularityList<string, PacketParser.FileTransfer.FileSegmentAssembler> parentAssemblerList, FileStreamTypes fileStreamType, string details, string serverHostname) {

0 commit comments

Comments
 (0)