BruteShark

What BruteShark is

BruteShark is a free network forensic analysis tool for inspecting traffic, mainly PCAP files, or capturing it from a network interface. It is intended for security researchers and network administrators looking for network weaknesses. It extracts usernames and passwords from protocols such as HTTP, FTP, Telnet, IMAP, and SMTP, as well as authentication hashes including Kerberos, NTLM, CRAM-MD5, and HTTP-Digest. Supported hashes can be converted to Hashcat input format. The tool can build a visual map of nodes, open ports, and domain users, and export network connections and endpoint details as JSON for analysis with tools such as Neo4j. Other capabilities include DNS query extraction, TCP and UDP session reconstruction, file carving, and SIP/RTP call extraction. File carving relies on known headers and footers, with JPG, PNG, and PDF given as examples. BruteShark provides a Windows GUI and a command-line interface for Windows and Linux; the CLI is described as having the desktop version's features. Capture requires Npcap and the appropriate .NET Core runtime on Windows, or libpcap on Linux. Analysis can consume time and resources, so its guidance recommends selecting only needed modules for large files.