[How-To]Xplico:Network Forensic Analysis Tool

Xplico, that is now on backtrack, è un tool, for a effettuareè Network Forensic Analysis Tool (NFAT).

It is not entirely understood, then, is a software that can reconstruct the packets through(pcap) captured through the use of sniffer come Wireshark, Tcpdump etc., or also with the same Xplico(“Live MODE”).

Xplico can reconstruct all the data carried by protocols such as HTTP, IMAP, POP, SMTP, SIP “voip”, FTP TELNET e, more able to detect known chat like facebook :D or emails exchanged ;)


Xplico, course is Open Source :D

Let's see how to install it on ubuntu ;)

The first thing to do, is to install these packages:

sudo apt-get install libice6 tshark libsm6 build-essential
sudo apt-get install sqlite tcpdump tshark libx11-dev libxt-dev libxi-dev apache2 php5 php5-sqlite build-essential perl zlib1g-dev libpcap-dev libsqlite0-dev libmysqlclient15-dev python-all

Now, we download and install Xplico => FILE *:DEB

DOWNLOAD XPLICO
We go to the folder where resides the deb Xplico:
Example:
cd $HOME/Downloads
And then install Xplico:
sudo dpkg -i xplico*
sudo apt-get install -f
Now, we place a small imperfection that php :D
There set the upload size to 2MB :(
Thirty seconds of wireshark with a user browses, capture at least 2.1 MB and if after uplodiamo the *. Cap Xplico we return an error :(

Then, ediamo the file /etc/php5/apache2/php.ini and set these two options:
post_max_size = 100M

upload_max_filesize = 100M
In place of 100 You can also make boh 100000, what you want ;)
Restart apache:

sudo /etc/init.d/apache2 restart

Bootstrap hours Xplico:
sudo /etc/init.d/xplico start
Now we access the web GUI :D
Then open your browser and go to:
http://localhost:9876
Logghiamoci with the default user:
Xplico

Now, create a new “cases” => “new session ” and godiamoci Xplico.

What we do with Xplico ?

Then, For example, we are at school ?
Or we wifi networks nearby :D ?

Well then we combine the power of ettercap with wireshark and this attack => GUIDE:Arp Poisoning by evilsocket :)
to Xplico…

We capture the remote packages, we filter the ip, and make their cocks :D

Chat di faceboo,email, sites, massively images…

Have fun :D

Related posts:

1. RATS: Rough Auditing Tool for Security
2. SoftPerfect Network Scanner:LAN NETWORK WITHOUT SECRETS
3. w3af:Web Application Attack and Audit Framework
4. AutoScan: EXCELLENT Network Scanner UBUNTU and windows :P
5. WireShark:Sniffs all WIFI Password / MSN data

This entry was posted on Friday, May 7th, 2010 at 9:31 am and is filed under GNU/Linux, Hacking, Software. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Tagged with: attack • hack • lan • network • scanner • web • wireshark