Taken from PCredz, solely to get Kerb parsing working until I have time to analyze Kerb pkts and figure out a simpler way Maybe use k

Check if count_str shows up twice

Decode base64 mail creds

Create the arguments

Parse server challenge

Parse the 3rd msg in NTLM handshake Thanks to psychomario

Taken from Pcredz because I didn't want to spend the time doing this myself I should probably figure this out on my own but hey, time isn't f

Taken from Pcredz because I didn't want to spend the time doing this myself I should probably figure this out on my own but hey, time isn't f

Keep a store of previous fragments in an OrderedDict named pkt_frag_loads

Keep the FILO OrderedDict of frag loads from getting too large 3 points of limit: Number of ip_ports < 50 Number of acks per

Get the header with the http command

Find search terms from URLs. Prone to false positives but rather err on that side than false negatives search, query, ?s, &q, ?q, search?p, s

Get the HTTP method + URL from requests

Regex out logins and passwords from a string

Convert the list of header lines into a dictionary

Find IRC logins

Catch IMAP, POP, and SMTP logins

Pull out pertinent info from the parsed HTTP packet data

Parse basic authentication over HTTP

Parse out FTP creds

Parse the header with the HTTP method in it

Split the raw load into list of headers and body string

Parse NTLM hashes out

Parse the netntlm server challenge https://code.google.com/p/python-ntlm/source/browse/trunk/python26/ntlm/ntlm.py

Parse the client response to the challenge

Parse out the SNMP version and community string

Start parsing packets here

Catch telnet logins and passwords

Filter out the common but uninteresting URLs