ezaspy / bruce

Python script for outputting PCAPs as JSON as well as extracting attachments within the traffic stream

                        _______________________________     _________         .    .
                       /                               \   (..       \_    ,  |\  /|
                       |  Fish are friends, not food.   \   \       O  \  /|  \ \/ /
                       \_______________________________  \   \______    \/ |   \  /
                                                       \__\     vvvv\    \ |   /  |
                                                                \^^^^  ==   \_/   |
                                                                 `\_   ===    \.  |
                                                                 / /\_   \ /      |
                                                                 |/   \_  \|      /
                                                                        \________/

bruce

Accelerating the parsing PCAPS into JSON format as well as ability to extract files from those PCAPS

Table of Contents

• About the Project
• Prerequisites
• Usage
• Roadmap
• Contributing
• License
• Contact
• Acknowledgements

About The Project

bruce has been created to help fellow digitial forensicators with reading and interpreting PCAP files without the need to trawl though Wireshark. bruce utilises tshark to convert the PCAPS and outputs them into JSON to then be indexed into log management or SIEM platforms alongside other data sources.

Prerequisites

• tshark
  
  

Usage

python3 bruce.py [-h] [-e] <directory_of_PCAPS>

Example

python3 bruce.py -e /pcaps/

Support

See the support for a list of commands and additional third-party tools to help with preparing images or data for bruce.

Roadmap

• String searching

See the open issues for a list of proposed features (and known issues).

See the changes for a list of previous changes to bruce.

Contributing

Contributions are what make the open source community such an amazing place to be learn, inspire, and create. Any contributions you make are greatly appreciated.

1. Fork the Project
2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
3. Commit your Changes (git commit -m 'Add some AmazingFeature')
4. Push to the Branch (git push origin feature/AmazingFeature)
5. Open a Pull Request
   
   

License

Distributed under the MIT License. See LICENSE for more information.

Contact

ezaspy - [email protected]

Project Link: https://github.com/ezaspy/bruce

Acknowledgements

• Wireshark (tshark)
• Best-README-Template
• Img Shields
• Choose an Open Source License
• GitHub Pages