Description:
pcapioc 0.1.2
pcap-ioc
Python tool to extract potential IOCs from a pcap file using pyshark
List of IOCs extracted :
IP addresses from IP packets
Domains and IP addresses from DNS requests
Domains, url and user-agents from HTTP requests
Domains from HTTPs X509 certificates
To install it, you can just do pip install pcap_ioc or install it from this repository with pip install ..
Usage
As a library
from pcap_ioc import Pcap
p = Pcap('FILE.pcap')
for i in p.indicators:
print(i)
CLI tool
$ pcap_ioc
usage: pcap_ioc [-h] {ioc,misp,shell} ...
Process some pcaps.
positional arguments:
{ioc,misp,shell} Subcommand
ioc Extract IOCs
misp Extract IOCs and search in MISP
shell Open a shell with pyshark
optional arguments:
-h, --help show this help message and exit
To query MISP servers, you need to create a file ~/.misp with one entry for every MISP server for instance :
[server1]
url: https://misp1.example.org/
key: KEYHERE
default: true
[server2]
url: https://misp2.example.org/
key: KEYHERE
Then you can query one of these server with pcap_ioc misp -s misp2 file.pcap
License
This software is released under the MIT license.
License
For personal and professional use. You cannot resell or redistribute these repositories in their original state.
Customer Reviews
There are no reviews.
