Skip to content
SPECIFICTION
Get listed

BruteShark

github.com

Free plan WindowsLinux
Visit github.com
Spec score 7.9 #16 of 32 in Network Packet Analyzer Software

What it is

BruteShark is a network forensic analysis tool for examining PCAP and PCAPNG traffic files or capturing traffic from a network interface. It is aimed at security researchers and network administrators investigating weaknesses. The software extracts usernames and passwords from HTTP, FTP, Telnet, IMAP, and SMTP, and extracts Kerberos, NTLM, CRAM-MD5, and HTTP-Digest authentication hashes. Supported hashes can be converted for Hashcat. BruteShark builds visual network diagrams showing nodes, open ports, and domain users, and exports connection and endpoint information as JSON for tools such as Neo4j. Other functions include DNS query extraction, TCP and UDP session reconstruction, file carving, and SIP/RTP VoIP call extraction. It provides a Windows GUI and command-line tools for Windows and Linux. Windows capture requires Npcap and .NET Core; Linux capture requires libpcap. Large-file analysis uses time and resources, so the instructions recommend selecting needed modules.

Spec sheet

Purpose
BruteShark is a network forensic analysis tool for inspecting network traffic, mainly PCAP files, and capturing traffic from a network interface.Read 2 Oct 2026 · github.com
Intended users
The project describes its intended users as security researchers and network administrators analyzing traffic for network weaknesses.Read 2 Oct 2026 · github.com
Integrations
The README identifies Hashcat for preparing extracted hashes and Neo4j as an example external tool for analyzing exported network-map JSON.Read 2 Oct 2026 · github.com
Support
The maintainer invites feedback by email at [email protected] or through a GitHub issue.Read 2 Oct 2026 · github.com
License
The GitHub repository identifies the project as GPL-3.0 licensed.Read 2 Oct 2026 · github.com
Authentication hashes
It extracts authentication hashes including Kerberos, NTLM, CRAM-MD5, and HTTP-Digest hashes, and can convert supported hashes to Hashcat input format.Read 2 Oct 2026 · github.com
Capture prerequisites
The download instructions list Npcap and the appropriate .NET Core runtime for Windows, and libpcap for Linux.Read 2 Oct 2026 · github.com
Credentials
It extracts and encodes usernames and passwords from protocols including HTTP, FTP, Telnet, IMAP, and SMTP.Read 2 Oct 2026 · github.com
File carving limit
File extraction uses a header-footer carving method and the README describes it as effective for files with known headers and footers, such as JPG, PNG, and PDF.Read 2 Oct 2026 · github.com
Interfaces
The project offers a Windows GUI and a command-line interface for Windows and Linux; the CLI is described as having the desktop version's features.Read 2 Oct 2026 · github.com
Large-file guidance
The usage instructions say traffic analysis consumes time and resources and recommend selecting only required modules for large files.Read 2 Oct 2026 · github.com
Network mapping
It builds a visual network diagram with nodes, open ports, and domain users, and can export network connections and endpoint data as JSON for analysis with tools such as Neo4j.Read 2 Oct 2026 · github.com
Other analysis
Its listed capabilities include DNS query extraction, TCP and UDP session reconstruction, file carving, and extracting SIP/RTP VoIP calls.Read 2 Oct 2026 · github.com

Plans and prices

BruteShark Free GPL-3.0 licensed · Windows GUI and Windows/Linux CLI · requires packet capture drivers Read 2 Oct 2026 · github.com

Every BruteShark plan and price →

Strong points and limits

Strong points

  • Free GPL-3.0 licensed plan
  • Extracts credentials and authentication hashes
  • Visual network mapping with JSON export
  • Supports live capture and PCAP/PCAPNG
  • Windows GUI plus cross-platform CLI

Limits

  • Windows capture requires Npcap and .NET Core
  • Linux capture requires libpcap
  • File carving favors known headers and footers
  • Large analyses consume time and resources

Who it suits

It suits security researchers and network administrators analyzing captured or live traffic. It also fits users who need Windows GUI access or command-line operation on Windows and Linux.

Verdict

BruteShark combines packet inspection, credential and hash extraction, network mapping, and session reconstruction in a free GPL-3.0 package. Its interface choices and capture prerequisites are clear, while large files and limited file-carving patterns need planning.

Where Specifiction places it

Alternatives to BruteSharkAll alternatives →