search

SpyGuard / SpyGuard

SpyGuard is a forked and enhanced version of TinyCheck. SpyGuard's main objective is to detect signs of compromise by monitoring network flows transmitted by a device.
Apache License 2.0
389 stars 37 forks source link

Analyze a captured pcap #42

Open ldina opened 2 months ago

ldina commented 2 months ago

Hi, I have a pcap file captured from a friend in a classic way out of spyguard and I will like to analyze it using spyguard and generate the report. My understanding is that /usr/share/spyguard/analysis/analysis.py /path/to/pcap is the part that can do that but it expects some kind of pre processing of the pcap and some existing files on /assets. Can anyone help me? Thanks a lot

ldina commented 2 months ago

after tweaking and testing I was not able to complete an analysis calling the analysis.py but I found a creative approach. I used https://github.com/appneta/tcpreplay/tree/v4.5.1 to replay the captured traffic to the wifi interface. I start the capture on Spyguard with a phone, I shut down the wifi on the phone and then i start the captured traffic replay injecting on the wifi interface. It seems working.