I am happy to announce the release of NetworkMiner 2.5 today!
This new version includes new features like JA3 and parsers for the HTTP/2 and DoH protocols.
We have also added support for a few older protocols that are still widely used,
such as Kerberos and the CIFS browser protocol.
Additionally, NetworkMiner can now parse PCAP files up to twice as fast as before!
Improving Passive TLS Analysis with JA3
Almost all web traffic is TLS encrypted nowadays, which prevents incident responders,
analysts and investigators from inspecting otherwise unencrypted HTTP traffic
for clues about malicious behavior or criminal intent.
This requires analysts to use alternative approaches, such as looking at hostnames and X.509 certificates.
This type of analysis is supported by NetworkMiner, since it parses
Server Name Indication
fields in client TLS handshakes and extracts X.509 certificates automatically when PCAP files are loaded.
In this release we’ve also added support for another passive TLS analysis technique called
which is a method for fingerprinting TLS client implementations.
NetworkMiner leverages the
JA3 fingerprint database from Trisul Network Analytics
in order to match observed JA3 hashes to hashes of known malware and “normal” applications.
This is what it looks like when the capture file “snort.log.1428364808”,
from the FIRST 2015 “Hands-on Network Forensics” training
has been loaded into NetworkMiner 2.5:
Image: JA3 fingerprint of a Skype client in NetworkMiner 2.5
The JA3 hash is also available in the “Parameters” tab,
which is useful in order to find out what hosts that particular TLS implementation was reaching out to.
Image: Filtering on JA3 hash 06207a1730b5deeb207b0556e102ded2
HTTP/2 and DoH Support
Passive analysis of TLS traffic, such as HTTPS, often doesn’t give sufficient visibility.
Many organizations therefore use TLS proxies in order to decrypt the traffic going in and out
from their networks. However, more than half of all HTTPS traffic is actually http2
(RFC 7540) nowadays.
This has previously been an issue for users who wanted to analyze decrypted http2 traffic
from their TLS intercepting proxies with NetworkMiner.
We’re happy to announce that NetworkMiner now can parse http2 traffic,
that has been decrypted by a TLS proxy, and extract files from the http2 transfers.
NetworkMiner 2.5 also supports the DNS over HTTPS (DoH) protocol
which is a technique for sending DNS queries as http2 POST requests and parsing the returned data as DNS responses.
We’ve incorporated the DoH data into NetworkMiner’s DNS tab,
so that you can analyze it just like normal DNS traffic.
Image: DoH traffic to mozilla.cloudflare-dns.com in NetworkMiner’s DNS tab
Please note that NetworkMiner 2.5 does not perform TLS decryption.
This means that NetworkMiner can only parse the contents of a TLS stream
if it has been decrypted by a TLS proxy, such as PolarProxy.
Extracting Kerberos Hashes from PCAP
NetworkMiner’s support for the Kerberos protocol allows you to passively track
which user accounts that are authenticating to what services,
simply by monitoring network traffic.
This is a feature is essential in order to track
credential theft and
lateral movement by adversaries inside your networks.
After implementing kerberos username and hash extraction we realized
that this feature could also be valuable for penetration testers.
We therefore decided to present extracted Kerberos credentials in a format
that is compatible with tools like
hashcat and John the Ripper.
Image: Kerberos krb5pa, krb5asrep and krb5tgs credentials extracted from the Wireshark sample capture fileChris Raiter notified us
about an important piece of information that was missing in NetworkMiner:
NetBIOS Name Service (NBNS) lookups and responses!
A couple of months later
Dan Gunter sent us another great feature request
for another protocol that runs on top of NetBIOS: the CIFS Browser Protocol (aka MS-BRWS).
We’re happy to announce that NBNS queries and responses are now shown in NetworkMiner’s Parameters tab,
and details like hostnames, domain names, Windows versions and uptime us extracted from the MS-BRWS protocol.
See the screenshots below, which were created by loading the capture file “case09.pcap” from
TCP/IP Weapons School 2.0 Sample Lab
into NetworkMiner 2.5. Thanks for sharing Richard!
Image: Hostname, domain and Windows version extracted from MS-BRWS traffic
Image: NBNS queries and responses in NetworkMiner’s Parameters tab
Mono 5 Required for Linux and MacOS
Linux and MacOS users, who run NetworkMiner with help of
will need to ensure they have Mono 5 (or later) installed in order to run NetworkMiner 2.5.
We recommend using at least Mono 5.18.
Instructions for installing NetworkMiner on Linux can be found in our blog post
”HowTo install NetworkMiner in Ubuntu Fedora and Arch Linux”.
MacOS users can refer to our
“Running NetworkMiner on Mac OS X” blog post.
Users who are unable to install Mono 5 are recommended to use the old NetworkMiner 2.4 release,
which can be downloaded here:
Apart from the features mentioned so far, our commercial tool
now comes with a few additional new features.
One of these features is port independent identification
of RDP traffic, so that
can be extracted from RDP sessions even if the service doesn’t run on port 3389.
The OSINT lookup context menus in NetworkMiner Professional
have also been enriched with the following online services:
- ja3er.com JA3 lookup
- abuse.ch JA3 lookup
- urlscan.io URL, DNS and IP lookup
- IPAddress.com IP lookup
- OpenDNS DNS lookup
- circl.lu IP/BGP lookup (thank you Raphaël)
- GreyNoise Visualizer IP lookup
- RIPEstat IP lookup
Several new features have also been included in the command line tool
- Recursive loading of PCAP files with the “-R” switch.
- Configurable export types (hosts, files, DNS etc) with the “-x” switch.
- Relative paths in CSV, XML and JSON/CASE exports unless the
“– absolutePaths”switch is used.
Upgrading to Version 2.5
Users who have purchased a license for NetworkMiner Professional 2.x can download a free update
to version 2.5 from our customer portal,
or use the “Help > Check for Updates” feature.
Those who instead prefer to use the free and open source version can grab the latest version
of NetworkMiner from the official NetworkMiner page.
*** This is a Security Bloggers Network syndicated blog from NETRESEC Network Security Blog authored by Erik Hjelmvik. Read the original post at: http://www.netresec.com/?page=Blog&month=2019-11&post=NetworkMiner-2-5-Released