net-creds
A Python tool that sniffs sensitive credentials and data from network interfaces or pcap files across multiple protocols.
What is net-creds?
Net-creds is a Python-based network security tool that sniffs sensitive data like passwords, hashes, and authentication credentials from live network interfaces or pcap files. It captures information across multiple protocols including HTTP, FTP, SMTP, and NTLMv1/v2, reassembling fragmented packets to ensure thorough extraction. The tool is designed for security professionals to identify credential exposures in network traffic.
Security researchers, penetration testers, and network administrators who need to audit network traffic for credential leaks or perform forensic analysis on packet captures.
Net-creds offers a comprehensive, protocol-aware approach to credential sniffing that doesn't rely on port numbers, making it more effective at detecting services in non-standard configurations. Its ability to handle fragmented packets and support for a wide range of authentication protocols sets it apart from basic sniffing tools.
Overview
Sniffs sensitive data from interface or pcap
Use Cases
Best For
- Penetration testing engagements to capture credentials from network traffic
- Forensic analysis of pcap files for incident response
- Security audits to detect plaintext password transmission
- Educational demonstrations of network sniffing risks
- Extracting authentication data from protocols like NTLM and Kerberos
- Monitoring internal networks for credential exposure
Not Ideal For
- High-speed network monitoring where performance is critical
- Projects requiring a graphical interface for interactive analysis
- Environments where most traffic is encrypted with modern protocols like TLS 1.3
- Users needing real-time alerting or automated response features
Pros & Cons
Pros
Sniffs credentials from HTTP, FTP, SMTP, and more, as listed in the README, ensuring comprehensive detection across diverse network services.
Reassembles fragmented packets to extract complete credentials, improving accuracy in network forensics and avoiding missed data.
Identifies services based on packet content, not ports, making it effective for non-standard or obfuscated traffic configurations.
Allows offline analysis of packet capture files using the -p flag, useful for post-incident investigations without live sniffing.
Captures authentication data from protocols like HTTP, SMB, and LDAP, as noted in the README, covering key enterprise systems.
Cons
Setting up on OS X requires multiple steps and manual configuration, as detailed in the README, which can be error-prone and time-consuming.
Instructions reference Python 2.7, which is no longer supported, posing compatibility issues with modern Python environments.
Focuses solely on credential extraction, lacking features for general packet analysis, decryption, or advanced network manipulation.
As a Python-based tool, it may struggle with high packet rates on busy networks compared to compiled alternatives like tcpdump.
Frequently Asked Questions
Related Projects
Linux KernelLinux kernel source tree
wifiphisherThe Rogue Access Point Framework
pwnagotchi(⌐■_■) - Deep Reinforcement Learning instrumenting bettercap for WiFi pwning.
ResponderResponder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.