xplico
Network Forensic Analysis Tool (NFAT)
Site oficial:
https://www.xplico.org
Empacotamento:
https://gitlab.com/kalilinux/packages/xplico
Versão no Kali: 1.2.2-0kali7 · Arquiteturas: amd64 i386 · Comandos: 9
Metapacotes:
kali-linux-everything
kali-tools-forensics
kali-tools-respond
Documentação do Kali:
https://www.kali.org/tools/xplico/
The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP, MGCP, H323), FTP, TFTP, and so on. Xplico is not a network protocol analyzer.
sudo apt install xplico (10.08 MB)
Dependências: apache2, binfmt-support, kali-defaults, lame, libapache2-mod-php, libc6, libjson-c5, libmariadb3, libmaxminddb0, libndpi4.2t64, libpcap0.8t64, libpq5, libsqlite3-0, libssl3t64, openssl, php-cli, php-common, php-json, php-sqlite3, python3, python3-httplib2, python3-psycopg2, recode, sox, sqlite3, tshark, zlib1g
Escolha um comando ao lado para ver a descrição e a ajuda completa.
mfbc
root@kali:~# mfbc -h mfbc v1.2.2 Internet Traffic Decoder (NFAT). See http://www.xplico.org for more information. Copyright 2007-2019 Gianluca Costa & Andrea de Franceschi and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com/. usage: mfbc [-h] [-s] [-l] [-i] [-c <config_file>] -p <port> -c config file -s silent -p connection port -i info (PEI generated by this manipulator) -l print all log in the screen -h this help NOTE: parameters MUST respect this order!
mfile
root@kali:~# mfile -h mfile v1.2.2 Internet Traffic Decoder (NFAT). See http://www.xplico.org for more information. Copyright 2007-2019 Gianluca Costa & Andrea de Franceschi and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com/. usage: mfile [-h] [-s] [-l] [-i] [-c <config_file>] -p <port> -c config file -s silent -p connection port -i info (PEI generated by this manipulator) -l print all log in the screen -h this help NOTE: parameters MUST respect this order!
mpaltalk
root@kali:~# mpaltalk -h mpaltalk v1.2.2 Internet Traffic Decoder (NFAT). See http://www.xplico.org for more information. Copyright 2007-2019 Gianluca Costa & Andrea de Franceschi and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com/. usage: mpaltalk [-h] [-s] [-l] [-i] [-c <config_file>] -p <port> -c config file -s silent -p connection port -i info (PEI generated by this manipulator) -l print all log in the screen -h this help NOTE: parameters MUST respect this order!
mwmail
root@kali:~# mwmail -h mwmail v1.2.2 Internet Traffic Decoder (NFAT). See http://www.xplico.org for more information. Copyright 2007-2019 Gianluca Costa & Andrea de Franceschi and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com/. usage: mwmail [-h] [-s] [-l] [-i] [-c <config_file>] -p <port> -c config file -s silent -p connection port -i info (PEI generated by this manipulator) -l print all log in the screen -h this help NOTE: parameters MUST respect this order!
trigcap
root@kali:~# trigcap -h usage: trigcap [-v] -f <input_file> -t <pkt num> -b <pkt numbers before> -a <pkt numbers after> -o <output_file> [-h] -v version -f input pcap file -t trigger packet number -b packet numbers before trigger packet -a packet numbers after trigger packet -o output pcap file -h this help
xplico
root@kali:~# xplico -h xplico v1.2.2 Internet Traffic Decoder (NFAT). See http://www.xplico.org for more information. Copyright 2007-2019 Gianluca Costa & Andrea de Franceschi and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com/. usage: xplico [-v] [-c <config_file>] [-h] [-s] [-g] [-l] [-i <prot>] -m <capute_module> -v version -c config file -h this help -i info of protocol 'prot' -g display graph-tree of protocols -l print all log in the screen -s print every second the deconding status -m capture type module NOTE: parameters MUST respect this order!
xplico-webui
root@kali:~# xplico-webui -h ┏━(Message from Kali developers) ┃ ┃ The command xplico-webui is deprecated. Please use xplico-webui-start instead. ┃ ┗━
xplico-webui-start
root@kali:~# xplico-webui-start -h ┏━(Message from Kali developers) ┃ ┃ Please wait for the xplico service to start ┃ .. ┃ [*] Web UI: http://127.0.0.1:9876 ┃ [i] You might need to refresh your browser once it opens ┃ ┗━
xplico-webui-stop
root@kali:~# xplico-webui-stop -h ┏━(Message from Kali developers) ┃ ┃ Service status: ┃ * xplico.service - Xplico ┃ Loaded: loaded (/usr/lib/systemd/system/xplico.service; 5:185mdisabled; preset: 5:185mdisabled) ┃ Active: inactive (dead) ┃ Docs: https://www.xplico.org/docs ┃ ┃ Jun 17 12:04:39 kali systemd[1]: xplico.service: Can't open PID file '/run/dema.pid' (yet?) after start: No such file or directory ┃ Jun 17 12:04:39 kali systemd[1]: Started xplico.service - Xplico. ┃ Jun 17 12:04:40 kali systemd[1]: xplico.service: Deactivated successfully. ┃ Jun 17 12:04:40 kali systemd[1]: xplico.service: Scheduled restart job immediately on client request, restart counter is at 1. ┃ Jun 17 12:04:40 kali systemd[1]: Stopped xplico.service - Xplico. ┃ Jun 17 12:04:40 kali systemd[1]: Starting xplico.service - Xplico... ┃ Jun 17 12:04:40 kali systemd[1]: xplico.service: Can't open PID file '/run/dema.pid' (yet?) after start: No such file or directory ┃ Jun 17 12:04:40 kali systemd[1]: Started xplico.service - Xplico. ┃ Jun 17 12:04:41 kali systemd[1]: xplico.service: Deactivated successfully. ┃ Jun 17 12:04:41 kali systemd[1]: Stopped xplico.service - Xplico. ┃ ┗━
xplico Usage Examples
Use the rltm module (`-m rltm`) and analyze traffic on interface eth0 (`-i eth0`):
root@kali:~# xplico -m rltm -i eth0 xplico v1.0.1 Internet Traffic Decoder (NFAT). See http://www.xplico.org for more information. Copyright 2007-2012 Gianluca Costa & Andrea de Franceschi and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com/. Configuration file (/opt/xplico/cfg/xplico_cli.cfg) found! GeoLiteCity.dat found! pcapf: running: 0/0, subflow:0/0, tot pkt:1 pol: running: 0/0, subflow:0/0, tot pkt:0 eth: running: 0/0, subflow:0/0, tot pkt:1 pppoe: running: 0/0, subflow:0/0, tot pkt:0 ppp: running: 0/0, subflow:0/0, tot pkt:0 ip: running: 0/0, subflow:0/0, tot pkt:0
