Run any Skill in Manus with one click

network-forensics

Stars3

Forks1

UpdatedJune 25, 2026 at 18:14

Network traffic capture, packet analysis, protocol dissection, and digital evidence preservation for security engagements. Use this skill whenever the user mentions packet capture, pcap analysis, Wireshark, tshark, tcpdump, network forensics, traffic analysis, protocol analysis, packet inspection, network evidence, DNS analysis from captures, HTTP traffic extraction, credential sniffing from pcap, malware traffic analysis, C2 detection, network timeline reconstruction, or any task involving captured network data. Also trigger for: "capture traffic", "analyze this pcap", "what's in this capture", "extract files from pcap", "find credentials in traffic", "reconstruct network session", or any network evidence analysis task. Expert tools: tshark (CLI analysis), tcpdump (capture), Wireshark (GUI), NetworkMiner (artifact extraction), zeek (protocol logging).

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

az0307

az0307/Aurora-AI-Agency

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	network-forensics
description	Network traffic capture, packet analysis, protocol dissection, and digital evidence preservation for security engagements. Use this skill whenever the user mentions packet capture, pcap analysis, Wireshark, tshark, tcpdump, network forensics, traffic analysis, protocol analysis, packet inspection, network evidence, DNS analysis from captures, HTTP traffic extraction, credential sniffing from pcap, malware traffic analysis, C2 detection, network timeline reconstruction, or any task involving captured network data. Also trigger for: "capture traffic", "analyze this pcap", "what's in this capture", "extract files from pcap", "find credentials in traffic", "reconstruct network session", or any network evidence analysis task. Expert tools: tshark (CLI analysis), tcpdump (capture), Wireshark (GUI), NetworkMiner (artifact extraction), zeek (protocol logging).
compatibility	{"tools":["bash","python"],"mcps":["desktop-commander"],"skills":["recon-osint","post-exploit","audit-logger"]}

Network Forensics Skill

Overview

Captures and analyzes network traffic for security engagements. Covers live packet capture, PCAP file analysis, protocol dissection, credential extraction, file carving from streams, and network timeline reconstruction.

Expert Tool Selection

Task	Best Tool	Why
Live capture (CLI)	tcpdump	Lightweight, no GUI needed
Live capture (detailed)	tshark	Wireshark engine, rich filters
PCAP analysis	tshark	Scriptable, field extraction
GUI analysis	Wireshark	Visual, follow streams
Artifact extraction	NetworkMiner	Auto-extract files, images, creds
Protocol logging	zeek	Structured logs, conn.log
HTTP extraction	tshark + filters	Extract URLs, headers, bodies

Core Instructions

Live Capture

# Basic capture
sudo tcpdump -i {interface} -w /tmp/pentest/{target}/capture.pcap

# Filter by target
sudo tcpdump -i {interface} host {target_ip} -w /tmp/pentest/{target}/capture.pcap

# Capture with ring buffer (long-running)
sudo tcpdump -i {interface} -w /tmp/capture_%Y%m%d_%H%M%S.pcap -G 3600 -W 24

PCAP Analysis with tshark

# Summary statistics
tshark -r capture.pcap -q -z io,stat,1
tshark -r capture.pcap -q -z conv,ip
tshark -r capture.pcap -q -z endpoints,ip

# Extract HTTP requests
tshark -r capture.pcap -Y "http.request" -T fields \
  -e frame.time -e ip.src -e http.host -e http.request.uri

# Extract DNS queries
tshark -r capture.pcap -Y "dns.qry.name" -T fields \
  -e frame.time -e ip.src -e dns.qry.name -e dns.a

# Find credentials in cleartext protocols
tshark -r capture.pcap -Y "http.authbasic || ftp.request.command==PASS || smtp.auth.password"

# Extract files from HTTP streams
tshark -r capture.pcap --export-objects http,/tmp/pentest/{target}/extracted_files/

Output Format

{
  "capture_file": "/tmp/pentest/example.com/capture.pcap",
  "duration": "1h 23m",
  "packets": 45230,
  "protocols": ["TCP", "UDP", "HTTP", "DNS", "TLS", "SMB"],
  "top_talkers": [
    {"ip": "10.0.0.5", "packets": 12000, "bytes": "45MB"},
    {"ip": "10.0.0.1", "packets": 8500, "bytes": "22MB"}
  ],
  "findings": [
    {"type": "cleartext_credential", "protocol": "HTTP Basic Auth", "target": "10.0.0.5"},
    {"type": "unencrypted_traffic", "protocol": "FTP", "ports": [21]}
  ],
  "extracted_files": 12
}

Output Checklist

Capture authorized and within engagement scope
PCAP files preserved with integrity hashes
Protocol distribution analyzed
Credentials and sensitive data identified
Files extracted from streams where relevant
Findings documented for red-team-report

More from this repository

same repository

active-directory

az0307/Aurora-AI-Agency

Active Directory and Windows domain attack techniques including domain enumeration, Kerberos attacks, credential relay, lateral movement, and domain privilege escalation for internal penetration testing engagements. Use this skill whenever the user mentions Active Directory, AD attacks, domain enumeration, BloodHound, Kerberoasting, AS-REP roasting, pass the hash, pass the ticket, overpass the hash, golden ticket, silver ticket, DCSync, DCShadow, NTDS.dit extraction, LDAP enumeration, domain controller, Group Policy abuse, ACL abuse, delegation abuse, constrained delegation, unconstrained delegation, resource-based constrained delegation, ADCS attacks, certificate abuse, LAPS, gMSA, domain trust attacks, forest trust, or any Windows domain-focused penetration testing activity. Also trigger for: impacket, crackmapexec, evil-winrm, bloodhound-python, kerbrute, responder, ntlmrelayx, petitpotam, certipy, rubeus, mimikatz, powerview, sharphound, enum4linux, smbclient, rpcclient, "enumerate the domain", "dump doma

2026-06-253

audit-logger

az0307/Aurora-AI-Agency

Security engagement audit logging, evidence chain management, and compliance trail for penetration testing. Use this skill whenever the user mentions audit log, audit trail, engagement logging, evidence collection, chain of custody, compliance logging, pentest logging, tool execution logging, JSONL log, activity log, forensic evidence, engagement timeline, or any request to log, track, or document security testing activities. Also trigger for: "log this action", "create audit trail", "evidence chain", "what did we do", "engagement timeline", "export activity log", or when any other security skill needs to record its actions for compliance. This skill is called BY other skills — it is the universal logging layer.

2026-06-253

credential-attack

az0307/Aurora-AI-Agency

Password cracking, credential brute force, hash analysis, and authentication testing for penetration testing engagements. Use this skill whenever the user mentions password cracking, hash cracking, brute force attack, credential spraying, password spray, dictionary attack, hashcat, john the ripper, hydra, medusa, credential stuffing, NTLM hash, NTHash, NetNTLMv2, Kerberos ticket cracking, AS-REP roasting, Kerberoasting, hash identification, rainbow tables, wordlist generation, custom wordlists, CeWL, crunch, cupp, password policy analysis, or any request to crack, guess, or test credentials. Also trigger for: "crack these hashes", "brute force this login", "test default credentials", "generate a wordlist", "what hash type is this", "password audit", or any credential-related testing activity. Expert tools: hashcat (GPU), john (CPU), hydra (online brute force), crackmapexec (network cred testing), medusa (parallel brute force).

2026-06-253

ctf-walkthrough

az0307/Aurora-AI-Agency

Generate structured CTF walkthrough writeups from engagement data, findings, and attack paths. Use this skill whenever the user mentions CTF writeup, walkthrough, write-up, CTF solution, box writeup, challenge writeup, HackTheBox writeup, TryHackMe writeup, "write up this box", "document how I solved", "create a walkthrough for", or any request to document a CTF/lab solution in educational format. Also trigger for: "writeup for HTB", "THM walkthrough", "document the attack path", "how did we solve this", or when red-team-report is called with engagement type CTF. Produces clean Markdown writeups with technique explanations, command output, and learning notes — suitable for blog posts or portfolio.

2026-06-253

exploit-dev

az0307/Aurora-AI-Agency

Exploit research, proof-of-concept development, controlled exploitation, and initial access verification for penetration testing engagements. Use this skill whenever the user mentions exploit development, PoC creation, Metasploit module execution, searchsploit, payload generation, msfvenom, exploit testing, vulnerability exploitation, initial access, shell access, reverse shell, bind shell, exploit chain, privilege escalation exploits, buffer overflow, web shell upload, or "can we exploit this finding". Also trigger for: ExploitDB search, Metasploit framework usage, custom exploit writing, payload encoding, exploit adaptation, weaponization, or any request to move from identified vulnerability to confirmed access. This is phase three of a pentest — trigger after vuln-analysis confirms exploitable findings, or standalone when the operator has a specific CVE. CRITICAL: All exploitation requires human approval before execution. The AI prepares commands and payloads but the operator confirms each run.

2026-06-253

payload-craft

az0307/Aurora-AI-Agency

Custom payload generation, encoding, obfuscation, and delivery mechanism design for authorized penetration testing. Use this skill when the user mentions payload generation, msfvenom, reverse shell, bind shell, web shell, shellcode, payload encoding, AV evasion, payload obfuscation, custom exploit payload, stager, stageless, meterpreter payload, shell payload, PowerShell payload, Python payload, macro payload, HTA payload, or any request to generate code that establishes remote access on an authorized target. Also trigger for: "generate a reverse shell", "create a payload for", "encode this payload", "bypass AV", "craft a dropper", "listener setup", or any payload engineering task during an authorized engagement. Expert tools: msfvenom (Metasploit payloads), custom Python/Bash generators. CRITICAL: All payloads are for authorized testing only. Operator confirms target and scope before any payload is deployed.

2026-06-253

name	network-forensics
description	Network traffic capture, packet analysis, protocol dissection, and digital evidence preservation for security engagements. Use this skill whenever the user mentions packet capture, pcap analysis, Wireshark, tshark, tcpdump, network forensics, traffic analysis, protocol analysis, packet inspection, network evidence, DNS analysis from captures, HTTP traffic extraction, credential sniffing from pcap, malware traffic analysis, C2 detection, network timeline reconstruction, or any task involving captured network data. Also trigger for: "capture traffic", "analyze this pcap", "what's in this capture", "extract files from pcap", "find credentials in traffic", "reconstruct network session", or any network evidence analysis task. Expert tools: tshark (CLI analysis), tcpdump (capture), Wireshark (GUI), NetworkMiner (artifact extraction), zeek (protocol logging).
compatibility	{"tools":["bash","python"],"mcps":["desktop-commander"],"skills":["recon-osint","post-exploit","audit-logger"]}

Network Forensics Skill

Overview

Expert Tool Selection

Task	Best Tool	Why
Live capture (CLI)	tcpdump	Lightweight, no GUI needed
Live capture (detailed)	tshark	Wireshark engine, rich filters
PCAP analysis	tshark	Scriptable, field extraction
GUI analysis	Wireshark	Visual, follow streams
Artifact extraction	NetworkMiner	Auto-extract files, images, creds
Protocol logging	zeek	Structured logs, conn.log
HTTP extraction	tshark + filters	Extract URLs, headers, bodies

Core Instructions

Live Capture

# Basic capture
sudo tcpdump -i {interface} -w /tmp/pentest/{target}/capture.pcap

# Filter by target
sudo tcpdump -i {interface} host {target_ip} -w /tmp/pentest/{target}/capture.pcap

# Capture with ring buffer (long-running)
sudo tcpdump -i {interface} -w /tmp/capture_%Y%m%d_%H%M%S.pcap -G 3600 -W 24

PCAP Analysis with tshark

# Summary statistics
tshark -r capture.pcap -q -z io,stat,1
tshark -r capture.pcap -q -z conv,ip
tshark -r capture.pcap -q -z endpoints,ip

# Extract HTTP requests
tshark -r capture.pcap -Y "http.request" -T fields \
  -e frame.time -e ip.src -e http.host -e http.request.uri

# Extract DNS queries
tshark -r capture.pcap -Y "dns.qry.name" -T fields \
  -e frame.time -e ip.src -e dns.qry.name -e dns.a

# Find credentials in cleartext protocols
tshark -r capture.pcap -Y "http.authbasic || ftp.request.command==PASS || smtp.auth.password"

# Extract files from HTTP streams
tshark -r capture.pcap --export-objects http,/tmp/pentest/{target}/extracted_files/

Output Format

{
  "capture_file": "/tmp/pentest/example.com/capture.pcap",
  "duration": "1h 23m",
  "packets": 45230,
  "protocols": ["TCP", "UDP", "HTTP", "DNS", "TLS", "SMB"],
  "top_talkers": [
    {"ip": "10.0.0.5", "packets": 12000, "bytes": "45MB"},
    {"ip": "10.0.0.1", "packets": 8500, "bytes": "22MB"}
  ],
  "findings": [
    {"type": "cleartext_credential", "protocol": "HTTP Basic Auth", "target": "10.0.0.5"},
    {"type": "unencrypted_traffic", "protocol": "FTP", "ports": [21]}
  ],
  "extracted_files": 12
}

Output Checklist

Capture authorized and within engagement scope
PCAP files preserved with integrity hashes
Protocol distribution analyzed
Credentials and sensitive data identified
Files extracted from streams where relevant
Findings documented for red-team-report