mirror of https://github.com/dirtbags/fluffy.git
86 lines
2.8 KiB
Plaintext
86 lines
2.8 KiB
Plaintext
|
.\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
|
||
|
|
.\"
|
||
|
|
.\" This program is free software: you can redistribute it and/or modify
|
||
|
|
.\" it under the terms of the GNU General Public License as published by
|
||
|
|
.\" the Free Software Foundation, either version 3 of the License, or
|
||
|
|
.\" (at your option) any later version.
|
||
|
|
.\"
|
||
|
|
.\" This package is distributed in the hope that it will be useful,
|
||
|
|
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||
|
|
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||
|
|
.\" GNU General Public License for more details.
|
||
|
|
.\"
|
||
|
|
.\" You should have received a copy of the GNU General Public License
|
||
|
|
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||
|
|
.\"
|
||
|
|
.\" On Debian systems, the complete text of the GNU General
|
||
|
|
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
|
||
|
|
.
|
||
|
|
.Dd May 1, 2012
|
||
|
|
.Dt NETRE-TOOLS 7
|
||
|
|
.Os "Network Reverse Engineering Toolkit"
|
||
|
|
.Sh NAME
|
||
|
|
.Nm netre-tools
|
||
|
|
.Nd network reverse engineering toolkit
|
||
|
|
.
|
||
|
|
.Sh DESCRIPTION
|
||
|
|
Network reverse engineering describes an emerging specialty in the information
|
||
|
|
assurance industry. This specialty exists in the gray area between malware
|
||
|
|
reverse engineering and network forensics. Analysts in this specialty may process
|
||
|
|
a wide variety of data. This data may be encrypted, encoded, or embedded in
|
||
|
|
multiple layers of other data.
|
||
|
|
.Pp
|
||
|
|
This toolkit aims to provide simple utilities to aide the analyst in carving
|
||
|
|
through many potential layers in order to find information. This toolkit will
|
||
|
|
most likely never be a complete solution; however, the authors aim to fill in
|
||
|
|
the gaps left by more complex tools.
|
||
|
|
.
|
||
|
|
.Sh IMPLEMENTATION NOTES
|
||
|
|
The following tools are currently included in the toolkit:
|
||
|
|
.Ss Data Inspection and Manipulation
|
||
|
|
This subgroup aids in inspecting data and manipulating data.
|
||
|
|
.Pp
|
||
|
|
.Bl -tag -width caesar -compact
|
||
|
|
.It Nm hdng
|
||
|
|
Hex Dumper - Next Generation (also symbolically linked as
|
||
|
|
.Nm hd )
|
||
|
|
.It Nm unhex
|
||
|
|
converts hexits to binary data (i.e. "61 62" \(rA "AB")
|
||
|
|
.It Nm xor
|
||
|
|
applies bytes to the pipeline using XOR
|
||
|
|
.It Nm rot
|
||
|
|
applies bytes to the pipeline using ROT (bitwise rotation)
|
||
|
|
.It Nm rol
|
||
|
|
applies bytes to the pipeline using ROL (bytewise rotation)
|
||
|
|
.It Nm caesar
|
||
|
|
applies bytes to the pipeline using Caesar's Cipher (alphabetic rotation)
|
||
|
|
.El
|
||
|
|
.
|
||
|
|
.Ss PCAP Manipulation
|
||
|
|
This subgroup allows frames in PCAP (packet capture) files to be manipulated
|
||
|
|
from the command line.
|
||
|
|
.Pp
|
||
|
|
.Bl -tag -width p4split -compact
|
||
|
|
.It Nm p4split
|
||
|
|
split a large PCAP file into smaller files, using a CIDR-notation filter
|
||
|
|
.It Nm pmerge
|
||
|
|
join PCAP files into a larger file while preserving date/time order
|
||
|
|
.It Nm puniq
|
||
|
|
drop duplicated packets from a PCAP
|
||
|
|
.El
|
||
|
|
.
|
||
|
|
.Sh SEE ALSO
|
||
|
|
.Xr hdng 1 ,
|
||
|
|
.Xr unhex 1 ,
|
||
|
|
.Xr xor 1 ,
|
||
|
|
.Xr rot 1 ,
|
||
|
|
.Xr rol 1 ,
|
||
|
|
.Xr caesar 1 ,
|
||
|
|
.Xr p4split 1 ,
|
||
|
|
.Xr pmerge 1 ,
|
||
|
|
.Xr puniq 1
|
||
|
|
.
|
||
|
|
.Sh AUTHORS
|
||
|
|
.An Xephyr Aq Ad zephyr@dirtbags.net ,
|
||
|
|
.An pi-rho Aq Ad pi-rho@tyr.cx
|