CapTipper

CapTipper provides a command-line interpreter with commands like 'hosts', 'hexdump', and 'iframes', enabling step-by-step exploration of malicious traffic, as shown in the Nuclear EK example analysis.

It sets up a local web server that mimics the original server in the PCAP, allowing researchers to replay HTTP requests and receive responses, facilitating dynamic behavioral analysis.

The tool supports dumping objects, decompressing gzip content with 'ungzip', extracting files from ZIP containers, and integrating VirusTotal checks for hash-based malware detection.

Using the 'hosts' command, CapTipper displays host-based traffic trees to visually identify compromised sites, infection hosts, and redirection chains.