Trawler — pr0t31n

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

🛡️ Sensitive Data Handling

This tool collects, processes, or stores data that may include sensitive, personally identifiable, or client-proprietary information — even when sourced from public repositories or non-client-controlled systems. Handle all collected data in accordance with your engagement’s data handling agreement, applicable privacy regulations (GDPR, CCPA, HIPAA), and your organization’s data classification policy. Store findings in encrypted, access-controlled locations and destroy data per the agreed retention schedule.

Trawler performs passive analysis of network packet captures (PCAPs) and emits security findings in the universal pr0t31n schema. It operates in two modes: targeted mode (default when a target IP is specified) focuses analysis on a specific host, applying external-facing rules by default and optionally including internal protocol checks; hunt mode (activated with --hunt or when no target is given) auto-discovers every unique IP in the capture and runs all rules against each, performing comprehensive threat hunting across the entire capture.

On startup, Trawler normalises the input capture to .pcapng format using Wireshark's editcap, ensuring consistent parsing regardless of the original format. It supports .pcap, .pcapng, .cap, .ntar, .erf, .snoop, and gzip-compressed variants. Analysis is performed via tshark display filters and field extraction, applying a library of detection rules that identify cleartext protocols, deprecated authentication, broadcast poisoning, and known-bad traffic patterns.

Trawler integrates with the pr0t31n_threat_intel module to perform IP and URL reputation checks against curated blocklists. When run under Crucible (CRUCIBLE_MANAGED=1), it emits structured protocol tokens (__CRUCIBLE_LOG__, __CRUCIBLE_STATUS__, __CRUCIBLE_TARGET__, __CRUCIBLE_PORT__) for real-time progress tracking. Trawler is also automatically invoked by other pr0t31n tools (such as Gearbox) after any network capture is produced, merging its findings into the originating tool's output directory.

Phase Pipeline

Phase 1 — PCAP Loading & Validation
Phase 2 — Protocol Dissection
Phase 3 — Traffic Pattern Analysis
Phase 4 — Credential Extraction
Phase 5 — Findings Generation

Security

CLI tool. Processes pcap files locally with no outbound network access. Uses tshark and editcap for packet parsing.

Features

Analysis Modes

Targeted Analysis

Per-target IP analysis with external rules (always) and optional internal protocol rules for SMBv1, LLMNR/NBT-NS, SSDP, mDNS, LLDP, ARP, cleartext FTP/Telnet/SNMP, HTTP Basic, and LDAP.

Hunt Mode

Threat-hunting mode that auto-discovers every unique IP in the capture and runs ALL rules (external + internal) against each, requiring no specific target IP.

Capture Support

Multi-Format Input

Accepts .pcap, .pcapng, .cap, .ntar, .erf, .snoop, and gzip-compressed variants. Auto-normalises to .pcapng via editcap before analysis.

Detection

Cleartext Protocol Detection

Identifies unencrypted FTP, Telnet, SNMP, HTTP Basic authentication, and LDAP traffic that could expose credentials.

Broadcast Poisoning Detection

Detects LLMNR, NBT-NS, mDNS, and SSDP broadcast traffic vulnerable to responder-style poisoning attacks.

Deprecated Protocol Detection

Flags SMBv1, ARP anomalies, LLDP information disclosure, and other deprecated or risky protocol usage.

Integration

Auto-Invocation by PCAP Producers

Other pr0t31n tools (Gearbox, Quiver) automatically invoke Trawler after producing a network capture, merging findings into the parent run directory.

Intelligence

Threat Intelligence Integration

Checks extracted IPs and URLs against curated threat intelligence blocklists for known-malicious indicators.

Output

Universal Schema Output

Produces findings.json, meta.json, and traffic.json in the pr0t31n universal output schema for cross-tool correlation.

Use Cases

Post-Capture Traffic Analysis

After a network capture is collected during a penetration test (via Gearbox TrafficCollector, tcpdump, or Wireshark), Trawler analyses the PCAP for security findings without requiring replay or active probing.

Cleartext Credential Exposure Assessment

Determines whether sensitive protocols (FTP, Telnet, SNMP, HTTP Basic, LDAP) are transmitting credentials in cleartext across the network.

Internal Network Poisoning Risk

Detects LLMNR/NBT-NS/mDNS/SSDP broadcast traffic that indicates vulnerability to responder-style credential harvesting attacks on internal networks.

Threat Hunting in Captured Traffic

Hunt mode analyses an entire capture for malicious, suspicious, and plaintext activity across all observed IPs without requiring a specific target, ideal for incident response or broad network assessment.

Automated Evidence from Hardware Assessments

When Gearbox captures Ethernet traffic during hardware security testing, Trawler is automatically invoked to produce network-layer findings from the captured traffic.

CLI Reference

Command Examples

Analyze Pcap

python3 trawler.py --pcap capture.pcapng --target 10.0.0.5 --output-dir /path/to/output

Analyze traffic for a specific target host.

Hunt Mode

python3 trawler.py --pcap capture.pcapng --hunt --output-dir /path/to/output

Auto-discover and analyze all hosts in the capture.

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

editcap

Format normalisation — converts pcap variants to pcapng

editcap -F pcapng <input> <output>

tshark

Single-pass packet field extraction with 50+ fields per frame

tshark -r <pcap> -T fields -E separator=| -E occurrence=a -E aggregator=; -e frame.time -e ip.src -e ip.dst -e tcp.port ...

capinfos

Capture file statistics (packet count, duration, timestamps)

capinfos -c -u -a -e <pcap>

Finding Nomenclature

Trawler uses a dual-prefix nomenclature system:

PT-0xx — External network rules (PT-001 Hardcoded DNS Resolvers, PT-002 Cleartext DNS Exposure, PT-003 TLS Client Cert CN Leak, PT-004 Legacy CBC Cipher Suites, PT-005 DHCP Hostname Disclosure, PT-006 DNS Search-Suffix Appending Bug, PT-010 Outbound Protocol Catalogue)
PT-1xx — Internal network rules (PT-101 SMBv1, PT-102 LLMNR/NBT-NS, PT-103 SSDP, PT-104 mDNS, PT-105 LLDP, PT-106 ARP Anomalies, PT-107 Cleartext FTP, PT-108 Cleartext Telnet, PT-109 SNMP Community Strings, PT-110 HTTP Basic Auth, PT-111 LDAP Cleartext Bind)
TRW-* — Advanced threat-hunting rules (TRW-KRB-001 Kerberos Artifact Extraction, TRW-NTLM-001 NTLM Relay Surface, TRW-JA3-001 JA3/JA3S Fingerprint Capture, TRW-IPP/MQTT/AMQP-001 Cleartext IoT Protocols)

Action Items

Trawler generates action items for credentials discovered in traffic — e.g., "Test captured FTP credentials against other services", "Investigate cleartext SNMP community string", "Verify HTTP basic auth credentials found in traffic".

Output Files

File	Format	Description
`meta.json`	JSON	Tool identity and engagement metadata
`findings.json`	JSON	Universal findings array v1.1
`findings.csv`	CSV	CSV mirror of findings
`summary.json`	JSON	Aggregated statistics
`scan.log`	TXT	Human-readable timestamped log
`scan.log.json`	JSONL	Machine-readable JSON log events
`errors.log`	TXT	ERROR-level entries only

Invocation Methods

Method	Usage
CLI — Direct	`cd /opt/pr0t31n/Trawler && python3 trawler.py [OPTIONS]` Run directly with command-line arguments.
Crucible-Managed	Launched and managed by Crucible (port 5100). Crucible handles start/stop/pause, log streaming, findings aggregation, and status tracking.

Integration

Used By

Gearbox (auto-invoked on pcap)
Scattershot3 (auto-invoked on pcap)
Crucible (manages)

Third-Party Dependencies & Credits

Tool / Library	Developer	Type	Link
tshark / Wireshark	Gerald Combs / Wireshark Foundation	system	https://github.com/wireshark/wireshark
editcap (Wireshark suite)	Wireshark Foundation	system	https://github.com/wireshark/wireshark
capinfos (Wireshark suite)	Wireshark Foundation	system	https://github.com/wireshark/wireshark

Metadata

Name	Trawler
Category	Analysis
Version	1.7.2
Install Path	`/opt/pr0t31n/Trawler`
Main File	`trawler.py`
GitHub	https://github.com/pr0t31n/Trawler.git