forked from LemmaLtd/Narith
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathTODO
More file actions
71 lines (56 loc) · 1.77 KB
/
TODO
File metadata and controls
71 lines (56 loc) · 1.77 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
Packet Capture File Analysis
----------------------------
1- Pcap building
Instead of Writing a full client/server to establish a pcap file. Narith can
build a pcap file.
To be considered:
A- Protocols used
B- Data used
C- Packet sequence can be multiplied from an expression or randomized
2- Pcap Inspection and Extraction
Inspect a pcap file to extract certain exchanged data.
A- Passwords
B- Files & Files categorizer (e.g. images/html/exe/elf..etc)
C- Domains -- DONE --
D- Exchanged Data
E- Sessions info -- DONE --
F- Messages
------------------
Components:
Basic:
1- Arguments, pcap files and external resources reader
2- Ethernet/IP/TCP/HTTP/FTP..etc Data extractor and analyzer
Detailed:
1- I/O Manager
2- Categorizer
3- Command Matching and Inspection
4- Sessions Info
5- Session Details
6- Encrypted Sessions
======================
Advanced functionalities:
- Detecting Transport layer security
- Exchanged Emails and possible malicious mails occurrences.
- Cryptographic Risks and IP Security and Possible intrusion.
- Honeypots profiling and Levels of interactions.
- The List goes on.....
--------------------
User interaction:
GUI:
Building GUI with tab for each module and tabular layout
interfaces similar to interpreter module interfaces can
be used
Statistics:
Statistics and infographics to be build out of obtained
information.
Visualization:
Automatically render media objects such as images,audio and video
--------------------
Security wise:
Spoofing:
Extract any anomalies and inspect malicious behaviour.
Files:
Inspect received files and identify any malicious file (malwares)
Botnet:
Inspect sent & received data and identify connection nature by
stored Botnet connection patterns