Skill UI

Automates deep packet inspection using tshark and pyshark on PCAP files. This tool is designed for cybersecurity professionals to perform structured network forensics, compute protocol distribution, detect suspicious activity (like port scans, beaconing, and data exfiltration), extract critical IOCs (IPs, domains, URLs), and identify advanced threats such as DNS tunneling patterns. Ideal for incident response and security auditing.

A comprehensive, advanced playbook for conducting deep network traffic analysis and PCAP forensics. Covers essential skills like PCAP repair, advanced Wireshark filtering (HTTP, DNS, TLS), data extraction (file carving, credential harvesting), and detecting covert channels. It guides users through sophisticated techniques, including TLS decryption workflows and DNS tunneling identification.

This specialized skill automates advanced forensic network analysis on captured packet data (PCAP). It is designed for reconstructing complex network sessions (TCP/UDP), decoding obscure or custom protocols (e.g., C2, custom binary), and correlating packet sequences with host or malware behavior. Use when evidence is embedded in protocol framing, timing, or session state, requiring reassembly beyond simple packet inspection.

A comprehensive guide for authorized digital forensics investigation. It covers critical areas including memory dump analysis (using Volatility), disk timeline reconstruction, PCAP network traffic analysis, and system artifact triage (like Event Logs and Prefetch). Essential for incident response, evidence preservation, and threat hunting to maintain a robust chain of custody.

A comprehensive, multi-phase workflow guide for authorized reverse engineering of complex network protocols. Ideal for analyzing proprietary formats such as custom TCP/UDP binary protocols, Protobuf, gRPC, WebSocket frames, and reconstructing state machines from raw PCAP data. This guide covers data collection, field layout restoration, serialization recovery, and secure replaying.