USArmyResearchLab / Dshell

Dshell is a network forensic analysis framework.
Other
5.44k stars 1.14k forks source link

Plugin to extract useful information from TLS Handshakes (resubmitted) #125

Closed amm3 closed 3 years ago

amm3 commented 3 years ago

Support for:

Most of the details are included in the kwargs and most useful using jsonout.

dev195 commented 3 years ago

We have tested this plugin and it seems to be running as expected.

In general, we aim to limit Dshell's reliance on third-party libraries, but are okay with including pyOpenSSL, as we see its general usefulness. In regards to pyja3, since it is a more specific use case, could you please look into making pyja3 optional for the plugin (i.e. if it's installed on the system, it will be used, but the plugin would run fine without it, albeit with less functionality)?

With that said, I believe you need to create a new branch and pull request anyway, since this one steps on your previous pull request #122 for the SSH plugin.