Pkappa2 is a packet stream analysis tool intended for Attack & Defense CTF Competitions. It receives pcap files via a http upload, usually send by a tcpdump-complete script. The received pcaps are processed and using the webinterface, users can run queries over the streams. Streams matching the query are displayed and their content can be viewed in multiple formats.
The tool is under development and might not work! See docs/TODO.md for missing features.
Add pcaps using a POST to /upload/filename.pcap
:
curl --data-binary @some-file.pcap http://localhost:8080/upload/some-file.pcap
apt install libpcap-dev
)yarn install && yarn build
in /web
go run cmd/pkappa2/main.go
in /
pip install -r converters/pkappa2lib/requirements.txt
localhost:8080
in your web browserYou likely want to add some arguments to the go run
command, check -help
.env.example
to .env
and change the configurationdocker compose up -d
localhost:8080
in your web browseryarn dev
in /web
go run cmd/pkappa2/main.go -address :8081
in /
localhost:8080
in your web browserYou can import multiple .pcap files in the current folder using:
for f in *.pcap; do curl --data-binary "@$f" "http://localhost:8081/upload/$f"; done
In order to generate all the typeguards, go to web/
and call
npx ts-auto-guard
When getting api-responses about types mismatching, you can debug the typeguards via
npx ts-auto-guard --debug