Fri. Jan 22nd, 2021

NetworkMiner 2.5 Released

NetworkMiner 2.5

NetworkMiner 2.5

I am happy to announce the release of NetworkMiner 2.5 today!
This new version includes new features like JA3 and parsers for the HTTP/2 and DoH protocols.
We have also added support for a few older protocols that are still widely used,
such as Kerberos and the CIFS browser protocol.
Additionally, NetworkMiner can now parse PCAP files up to twice as fast as before!

Improving Passive TLS Analysis with JA3

Almost all web traffic is TLS encrypted nowadays, which prevents incident responders,
analysts and investigators from inspecting otherwise unencrypted HTTP traffic
for clues about malicious behavior or criminal intent.
This requires analysts to use alternative approaches, such as looking at hostnames and X.509 certificates.
This type of analysis is supported by NetworkMiner, since it parses
Server Name Indication
fields in client TLS handshakes and extracts X.509 certificates automatically when PCAP files are loaded.

In this release we’ve also added support for another passive TLS analysis technique called
JA3,
which is a method for fingerprinting TLS client implementations.

NetworkMiner leverages the
JA3 fingerprint database from Trisul Network Analytics
in order to match observed JA3 hashes to hashes of known malware and “normal” applications.
This is what it looks like when the capture file “snort.log.1428364808”,
from the FIRST 2015 “Hands-on Network Forensics” training
(available here),
has been loaded into NetworkMiner 2.5:

JA3 fingerprint of a Skype client

Image: JA3 fingerprint of a Skype client in NetworkMiner 2.5

The JA3 hash is also available in the “Parameters” tab,
which is useful in order to find out what hosts that particular TLS implementation was reaching out to.

Filtering on JA3 hash 06207a1730b5deeb207b0556e102ded2 in NetworkMiner 2.5

Image: Filtering on JA3 hash 06207a1730b5deeb207b0556e102ded2

HTTP/2 and DoH Support

Passive analysis of TLS traffic, such as HTTPS, often doesn’t give sufficient visibility.
Many organizations therefore use TLS proxies in order to decrypt the traffic going in and out
from their networks. However, more than half of all HTTPS traffic is actually http2
(RFC 7540) nowadays.
This has previously been an issue for users who wanted to analyze decrypted http2 traffic
from their TLS intercepting proxies with NetworkMiner.
We’re happy to announce that NetworkMiner now can parse http2 traffic,
that has been decrypted by a TLS proxy, and extract files from the http2 transfers.

NetworkMiner 2.5 also supports the DNS over HTTPS (DoH) protocol
(RFC 8484),
which is a technique for sending DNS queries as http2 POST requests and parsing the returned data as DNS responses.
We’ve incorporated the DoH data into NetworkMiner’s DNS tab,
so that you can analyze it just like normal DNS traffic.

DoH traffic to mozilla.cloudflare-dns.com in NetworkMiner’s DNS tab

Image: DoH traffic to mozilla.cloudflare-dns.com in NetworkMiner’s DNS tab

Please note that NetworkMiner 2.5 does not perform TLS decryption.
This means that NetworkMiner can only parse the contents of a TLS stream
if it has been decrypted by a TLS proxy, such as PolarProxy.

Extracting Kerberos Hashes from PCAP

NetworkMiner’s support for the Kerberos protocol allows you to passively track
which user accounts that are authenticating to what services,
simply by monitoring network traffic.
This is a feature is essential in order to track
credential theft and
lateral movement by adversaries inside your networks.
After implementing kerberos username and hash extraction we realized
that this feature could also be valuable for penetration testers.
We therefore decided to present extracted Kerberos credentials in a format
that is compatible with tools like
hashcat and John the Ripper.

Kerberos krb5pa, krb5asrep and krb5tgs credentials extracted from the Wireshark sample capture file

Image: Kerberos krb5pa, krb5asrep and krb5tgs credentials extracted from the Wireshark sample capture fileKrb-contrained-delegation.cap

For more information about Kerberos hashes, please see our
Extracting Kerberos Credentials from PCAP blog post.

Even more NetBIOS and CIFS Artifacts!

NetworkMiner is a popular tool for extracting files transferred over SMB and SMB2 from capture files.
It can also extract a great deal of information about the communicating hosts from protocols
like NetBIOS and SMB/CIFS, but earlier this year
Chris Raiter notified us
about an important piece of information that was missing in NetworkMiner:
NetBIOS Name Service (NBNS) lookups and responses!

Detection and export of NBNS packets request on twitter<!–

Image: @CRaiterCBus requests a “Detection and export of NBNS packets” feature in NetworkMiner

–>

A couple of months later
Dan Gunter sent us another great feature request
for another protocol that runs on top of NetBIOS: the CIFS Browser Protocol (aka MS-BRWS).

We’re happy to announce that NBNS queries and responses are now shown in NetworkMiner’s Parameters tab,
and details like hostnames, domain names, Windows versions and uptime us extracted from the MS-BRWS protocol.
See the screenshots below, which were created by loading the capture file “case09.pcap” from
Richard Bejtlich’s
TCP/IP Weapons School 2.0 Sample Lab
into NetworkMiner 2.5. Thanks for sharing Richard!

Hostname, domain and Windows version extracted from MS-BRWS traffic

Image: Hostname, domain and Windows version extracted from MS-BRWS traffic

NBNS queries and responses in NetworkMiner’s Parameters tab

Image: NBNS queries and responses in NetworkMiner’s Parameters tab

Mono 5 Required for Linux and MacOS

Linux and MacOS users, who run NetworkMiner with help of
Mono,
will need to ensure they have Mono 5 (or later) installed in order to run NetworkMiner 2.5.
We recommend using at least Mono 5.18.

Instructions for installing NetworkMiner on Linux can be found in our blog post
”HowTo install NetworkMiner in Ubuntu Fedora and Arch Linux”.

MacOS users can refer to our
“Running NetworkMiner on Mac OS X” blog post.

Users who are unable to install Mono 5 are recommended to use the old NetworkMiner 2.4 release,
which can be downloaded here:
https://www.netresec.com/?download=NetworkMiner_2-4

NetworkMiner Professional

Apart from the features mentioned so far, our commercial tool
NetworkMiner Professional
now comes with a few additional new features.
One of these features is port independent identification
of RDP traffic, so that
mstshash credentials
can be extracted from RDP sessions even if the service doesn’t run on port 3389.
The OSINT lookup context menus in NetworkMiner Professional
have also been enriched with the following online services:

  • ja3er.com JA3 lookup
  • abuse.ch JA3 lookup
  • urlscan.io URL, DNS and IP lookup
  • IPAddress.com IP lookup
  • OpenDNS DNS lookup
  • circl.lu IP/BGP lookup (thank you Raphaël)
  • GreyNoise Visualizer IP lookup
  • RIPEstat IP lookup

Several new features have also been included in the command line tool
NetworkMinerCLI, including:

  • Recursive loading of PCAP files with the “-R” switch.
  • Configurable export types (hosts, files, DNS etc) with the “-x” switch.
  • Relative paths in CSV, XML and JSON/CASE exports unless the “– absolutePaths” switch is used.

Credits

I’d like to thank
Dan Gunter,
Chris Raiter,
Chris Sistrunk and a few more
(who I cannot mention here) for contributing with feature requests and bug reports
that have helped improve NetworkMiner.

Upgrading to Version 2.5

Users who have purchased a license for NetworkMiner Professional 2.x can download a free update
to version 2.5 from our customer portal,
or use the “Help > Check for Updates” feature.
Those who instead prefer to use the free and open source version can grab the latest version
of NetworkMiner from the official NetworkMiner page.

Facebook Share on Facebook  Twitter Tweet  Reddit Submit to reddit.com