A-Packets

View HTTP headers and HTTP communication

Deep packet inspection allows you to dive into HTTP communications. Explore HTTP requests and responses. Web servers information and payloads, collect forms data and analyze transferred content.

Wonder to view established HTTP sessions and users credentials? Find transferred files including office documents? Use A-Packets network traffic analysis and integrated pcap file viewer.

Analyze pcap file to investigate HTTP data in details. View network traffic, rebuild client-server communications step by step.

Find devices on network

You can effortlessly build pcap visualisation for network communications. Explore network devices map and all communications between nodes. Classify network nodes by their type through pcap analysis. Visualize TCP/UDP communications from pcap file with network graph.

Quick read pcap files to detect DNS, DHCP and LDAP servers and sniff captured DNS requests in pcap file. A-Packets uses passive fingerprinting to detect running network services and open ports.

Devices map displays network traffic for popular protocols. It allows explore communication links between network nodes using various filters.

Gather WiFi Information

View wireless networks information extracted from pcap file. You can find Access Points and their SSIDs (network names). Reveal previously-associated networks for client devices using probe requests.

You can also recognize multicast traffic to find used network protocols and services.

Detected WPA/WPA2 handshakes in analyzed pcap file will be converted to .hccapx. This file you will use to recover password with Hashcat.

Extract files from pcap

Pcap reader allows detect and extract pictures. View office documents and other file formats found during analyzing of uploaded pcap file. You can quick preview found files in network traffic and download them.

Comprehensive pcap file analysis is able to find most popular document formats in HTTP flow.

SMB Sniffer

SMB and NetBIOS broadcast packets provide a lot of information about LAN structure. You can extract from pcap file usefull information like OS, roles and admin comments.

Another one interesting thing could be found in SMB communicsations is users credentials. Like NTLMv2-SSP authentication between nodes. Upload pcap file and you can try to crack found hashes with appropriate tools.

DNS queries investigation

You can explore protocols DNS, mDNS (Multicast DNS) and NBNS (NetBIOS Name Service). Gather information about network structure and activities of running services.

Use filters to separate DNS traffic by type. Analyze queries and responses from target servers. Find Multicast/broadcast addresses (in case of mDNS and NBNS).

Analyze ARP packets

ARP (Address Resolution Protocol) messages contains valuable information about devices topology. It uses MAC addresses on Layer 2 (OSI). You can elicit device-IP accordance directly from ARP requests and responses. Investigate gratuitous ARP messages during devices boot.

Basic automatic analyze enables to detect various anomalies in ARP communications. Detect routers and smart switches and WiFi access points integrated into LAN. It is possible to detect malicious activities like ARP spoofing nodes.

Find passwords in pcap file

A-Packets scans uploaded pcap file for various protocols to find user credentials. You can find plain text passwords in authorization headers or detect cryptographic hashes. The service is also looking for complex challenge-base auth protocols.

You can extract passwords/hashes from protocols:

• HTTP Basic/Digest/Negotiate
• SIP Digest
• NTLMv1/v2 (SMB)
• Kerberos
• LDAP
• SNMP, IMAP, SMTP
• Postgres, MSSQL (TDS 7.0+)
• Telnet and FTP sessions

You can restore original passwords from obtained hashes with any hash-cracking tool.