A dynamic network analysis tool that intercepts and simulates network services for malware analysis and penetration testing.
FakeNet-NG is a dynamic network analysis tool that intercepts and redirects network traffic while simulating legitimate network services. It helps malware analysts quickly identify malware functionality and capture network signatures, and assists penetration testers in testing application behavior and prototyping proofs-of-concept.
Malware analysts and penetration testers who need to analyze network behavior in controlled, isolated environments such as virtual machines.
Developers choose FakeNet-NG for its configurable interception engine, modular listener framework, and ability to simulate multiple network protocols, making it highly adaptable for both malware analysis and security testing scenarios.
FakeNet-NG - Next Generation Dynamic Network Analysis Tool
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports custom listeners for various protocols, enabling extensibility and adaptation to diverse analysis scenarios, as highlighted in the Philosophy section.
The Proxy Listener automatically identifies and redirects traffic to appropriate handlers, useful for unknown services, as described in the Proxy Listener configuration.
Generates PCAP files and interactive HTML reports with network-based indicators, aiding in malware signature capture and analysis, detailed in the User Interface section.
Allows whitelisting and blacklisting of specific processes and hosts for targeted traffic interception, explained in the Listener Filtering section.
Installation requires multiple platform-specific steps, such as installing Visual C++ build tools on Windows or managing system services on Linux, as outlined in the Installation section.
Only supports Windows Vista+ for SingleHost mode and Linux for MultiHost, with issues like not intercepting local traffic on Windows, as noted in the Limitations.
Often flagged as malicious by security software due to its network manipulation capabilities, requiring use in isolated environments, as warned in the Installation notes.