- Home
- Network Packet Analyzer Software
- BruteShark
BruteShark
What it is
BruteShark is a network forensic analysis tool for examining traffic in PCAP and PCAPNG files or capturing it from a network interface. It can extract usernames and passwords from HTTP, FTP, Telnet, IMAP, and SMTP traffic, as well as authentication hashes such as Kerberos, NTLM, CRAM-MD5, and HTTP-Digest. Supported hashes can be converted to Hashcat input format. The tool can build a visual map of network nodes, open ports, and domain users, then export connection and endpoint data as JSON for further analysis. Other functions include DNS query extraction, TCP and UDP session reconstruction, file carving, and SIP/RTP call extraction. File carving relies on known headers and footers, with the project citing formats such as JPG, PNG, and PDF. BruteShark provides a Windows GUI and a command-line interface for Windows and Linux; the CLI is described as having the desktop version’s features. It is free under GPL-3.0. Windows use requires Npcap and the appropriate .NET Core runtime, while Linux requires libpcap.
For and against
For
- Free under the GPL-3.0 license.
- Supports live capture and PCAP and PCAPNG files.
- Extracts credentials and several authentication hash types.
- Exports network connection and endpoint data as JSON.
- Offers a Windows GUI and Windows/Linux CLI.
Against
- Windows capture requires Npcap and a .NET Core runtime.
- Linux capture requires libpcap.
- Large traffic files can consume time and resources.
- File carving is suited to files with known headers and footers.
The verdict
BruteShark combines packet inspection, credential and hash extraction, and network mapping in a free tool for Windows and Linux. Consider its capture prerequisites and file-carving limits when deciding whether it fits your analysis workflow.
Who it suits
BruteShark suits security researchers and network administrators investigating traffic for network weaknesses. It is available to users who can work with its Windows GUI or command-line interface on Windows or Linux.
Plans and prices
BruteShark
GPL-3.0 licensed · Windows GUI and Windows/Linux CLI · requires packet capture drivers
Read 2 Oct 2026 · github.com
On the record
- Authentication hashes
- It extracts authentication hashes including Kerberos, NTLM, CRAM-MD5, and HTTP-Digest hashes, and can convert supported hashes to Hashcat input format.github.com · read 2 Oct 2026
- Capture prerequisites
- The download instructions list Npcap and the appropriate .NET Core runtime for Windows, and libpcap for Linux.github.com · read 2 Oct 2026
- Credentials
- It extracts and encodes usernames and passwords from protocols including HTTP, FTP, Telnet, IMAP, and SMTP.github.com · read 2 Oct 2026
- File carving limit
- File extraction uses a header-footer carving method and the README describes it as effective for files with known headers and footers, such as JPG, PNG, and PDF.github.com · read 2 Oct 2026
- Integrations
- The README identifies Hashcat for preparing extracted hashes and Neo4j as an example external tool for analyzing exported network-map JSON.github.com · read 2 Oct 2026
- Intended users
- The project describes its intended users as security researchers and network administrators analyzing traffic for network weaknesses.github.com · read 2 Oct 2026
- Interfaces
- The project offers a Windows GUI and a command-line interface for Windows and Linux; the CLI is described as having the desktop version's features.github.com · read 2 Oct 2026
- Large-file guidance
- The usage instructions say traffic analysis consumes time and resources and recommend selecting only required modules for large files.github.com · read 2 Oct 2026
- License
- The GitHub repository identifies the project as GPL-3.0 licensed.github.com · read 2 Oct 2026
- Network mapping
- It builds a visual network diagram with nodes, open ports, and domain users, and can export network connections and endpoint data as JSON for analysis with tools such as Neo4j.github.com · read 2 Oct 2026
- Other analysis
- Its listed capabilities include DNS query extraction, TCP and UDP session reconstruction, file carving, and extracting SIP/RTP VoIP calls.github.com · read 2 Oct 2026
- Purpose
- BruteShark is a network forensic analysis tool for inspecting network traffic, mainly PCAP files, and capturing traffic from a network interface.github.com · read 2 Oct 2026
- Support
- The maintainer invites feedback by email at [email protected] or through a GitHub issue.github.com · read 2 Oct 2026
