NETRESEC Network Security Blog

One of the new features in NetworkMiner 2.9 is a TZSP streaming server. It is designed to read a real-time stream of sniffed packets from Mikrotik routers. This method for remote sniffing can be used to capture packets regardless if NetworkMiner is running in Windows or Linux. How to Sniff Packets w[...]

NetworkMiner 2.9 brings several new and improved features to help analysts make sense of network traffic from malware, criminals and industrial control systems. Highlights from this new version include: TZSP supportStealC extractorImproved Modbus parserJA4 supportGTP decapsulationMalware Traffic Art[...]

In this video I take a look at a cryptojacking attack against a Kubernetes honeypot. The attackers were surprisingly quick to discover this unsecured Kubernetes deployment and use it to mine Monero for them. The analyzed capture files can be downloaded fromhttps://share.netresec.com/s/S5ZG2cDKB9Abqw[...]

I am thrilled to announce the release of PolarProxy version 1.0 today! Several bugs that affected performance, stability and memory usage have now been resolved in our TLS inspection proxy. PolarProxy has also been updated with better logic for importing external root CA certificates and the HAProxy[...]

This training has been canceled. Our upcoming training events can be found here:https://www.netresec.com/?page=Training