shellcode33/credslayer

Extract credentials and other useful info from network captures

CredSLayer

CredSLayer goal is to look for credentials and other useful stuff in network captures. Two modes are available, pcap scanning and active processing. The latest listens for packets on a chosen interface and dynamically extracts everything it can.

This tool has been heavily inspired by Pcredz and net-creds but is built with extensibility in mind. Pcredz and net-creds are great, but they are really hard to maintain and improve. Unlike these tools which are using regex and raw bytes parsing, CredSLayer takes advantage of Wireshark dissectors which have proven over time to be pretty accurate and reliable. It makes it really easy to add support for new protocols.

This tool can be really helpful if you're doing IT security or if you want to scan your own network to see if anything critical is transmitted.

Features

CredSLayer doesn't waste your time with invalid credentials, it makes sure credentials are valid. Yet if it's not able to tell whether they're valid or not, what has been found will be printed out anyway.

Right now, CredSLayer supports the following protocols:

• FTP
• SMTP / IMAP / POP3
• Telnet
• HTTP
• LDAP
• SNMP
• MySQL / PostgreSQL
• NTLMSSP
• Kerberos coming soon...

It is also able to look for email addresses and credit card numbers.

Note: To prevent false positives and performance issues, tshark (the Wireshark underlying engine) identifies protocols based on port numbers to know which dissector to use on which packets. A few protocols however have heuristic analysis to guess the protocol on different ports than the usual ones (such as HTTP). See the limitation chapter in the documentation. To address this issue, CredSLayer has a --map parameter, it enables you to map a (range of) port(s) to a specific protocol. This way you will be able to sniff credentials going to a specific service on a specific port you are aware of.

Install

You need tshark installed and Python >= 3.5. On some distribution tshark in shipped within the wireshark package.

Then simply install using :

$ pip install credslayer

I recommend you use a virtualenv to prevent conflicts.

Usage

$ credslayer -h
usage: credslayer [-h] [-l INTERFACE] [-s {enable,disable}] [-f IP]
                     [-m PORT:PROTOCOL] [--debug]
                     [pcapfiles [pcapfiles ...]]

Helps you find credentials and other interesting stuff in network captures

positional arguments:
  pcapfiles             pcap files you want to analyse.

optional arguments:
  -h, --help            show this help message and exit
  -l INTERFACE, --listen INTERFACE
                        start active processing on specified interface
  -s {enable,disable}, --string-inspection {enable,disable}
                        let you specify if you want to look for interesting
                        strings (email addresses, credit cards, ...) in
                        network captures. Pretty heavy on the CPU. Enabled by
                        default on pcap files, disabled on live captures.
  -f IP, --filter IP    only show packets involving the specified IP.
  -m PORT:PROTOCOL, --map PORT:PROTOCOL
                        map a port to a protocol
  --debug               put CredSLayer and pyshark in debug mode.

Get involved

Thanks to Wireshark dissectors, it's really easy to write new protocols support, you're welcome to contribute !

Contributing doesn't necessarily mean writing code. You can simply contribute by opening new issues on Github if you spot any bug or if you would like to see something added to the tool.

To learn how to create support for a new protocol, head over to the documentation.

Credits

• CredSLayer is based on pyshark, a tshark Python wrapper

• Wireshark for their pcaps

• moloch for their pcaps

• asecuritysite for their pcaps

credslayer's Issues

Write WireShark plugin

We could interface NCM with Wireshark so that people can easily extract credentials and keep using their favorite network capture software

[HTTP] Look for search queries

https://github.com/DanMcInerney/net-creds/blob/master/net-creds.py#L58

Create a --remove-duplicates switch

At the logger level ?

--no-validation or --validation switch

Hey there!

Major fan of the project and what you've done here, but I prefer raw data some of the time. With the validation of credentials, it still misses some data that could be useful to a security engineer or other pentester. What I'm asking for here, I'm perfectly willing to write and hand on over to you if you're willing.

TL;DR
--no-validation would disable validation and show all data
--validation would enable validation

Thanks!
Jack

Just General Help / Questions

Hey,

I have installed CredSlayer fine - the documentation is really easy to follow, thanks for that.

I can get CredSlayer to listen on Wlan0 - but how can I test if it is working properly? I go to http sites on other clients, like my routers login page - but it does not capture that input? Should it?

Likewise, if I check Outlook on other clients, should it capture the hashes if using POP / IMAP?

I have used Responder before, which works to capture NTLM hashes on my Windows based machine - so wondering if it should be working similar?

Should I use CredSlayer with a wireless device in monitor mode, will that give a greater degree of success? Thanks

Does not work with recent pyshark

Since version 0.5 from pyshark, the layer attribute has been refactored (corresponding PR). This breaks CredSLayer :

>     from credslayer.core import manager
>   File "/nix/store/69wa5yn50jr3wsw8072zrbqpksxsl0x5-credslayer-0.1.2/lib/python3.10/site-packages/credslayer/core/manager.py", line 14, in <module>
>     from credslayer.parsers import parsers, ntlmssp
>   File "/nix/store/69wa5yn50jr3wsw8072zrbqpksxsl0x5-credslayer-0.1.2/lib/python3.10/site-packages/credslayer/parsers/__init__.py", line 17, in <module>
>     module = import_module("credslayer.parsers." + module_name)
>   File "/nix/store/fkcl1wzq3106qqgl84bhgk1lp56q6bzg-python3-3.10.7/lib/python3.10/importlib/__init__.py", line 126, in import_module
>     return _bootstrap._gcd_import(name[level:], package, level)
>   File "/nix/store/69wa5yn50jr3wsw8072zrbqpksxsl0x5-credslayer-0.1.2/lib/python3.10/site-packages/credslayer/parsers/ldap.py", line 2, in <module>
>     from pyshark.packet.layer import Layer
> ModuleNotFoundError: No module named 'pyshark.packet.layer'

[HTTP] Support authorization header auth and POST/GET auth at the same time

Right now, if the Authorization header si sent coupled with an auth through POST/GET parameters, only the Authorization header will be logged