Protocols.

Automagically reverse-engineer REST APIs via capturing traffic

All-in-one protocol analysis toolkit: built-in browser capture, MITM proxy, JS hooks, fingerprint spoofing, AI analysis, and an MCP server for seamless AI agent and IDE integration.

Resources about network security, including: Proxy/GFW/ReverseProxy/Tunnel/VPN/Tor/I2P, and MiTM/PortKnocking/NetworkSniff/NetworkAnalysis/etc。More than 1700 open source tools for now. Post incoming.

Cryptographic protocol analysis for real-world protocols.

Browse any app normally. Spectral captures the traffic, understands what each API call does, and generates MCP tools that AI agents can call directly.

Selected JavaScript reverse-engineering examples from various websites, with detailed explanations, concept summaries, cryptographic algorithms, difficulty comparisons, and links. Covers challenges including environment reconstruction, extracting JavaScript, webpack, and Ruishu.

MAPS cloud scanner and response parser for Microsoft Defender research.

ICMPWatch: ICMP Packet Sniffer

Self-hosted PCAP analysis platform with LLM-powered incident triage, signature-based threat detection, and AI-generated incident narratives. Features network change monitoring across captures, deep packet inspection via nDPI, and automated Wireshark filter generation. Runs fully offline with local LLMs (Ollama, LM Studio).

A high-performance, lightweight SDK for the GB/T 27930-2023 (Yunkuaichong 1.6) protocol. Its framework-free design targets charging-station/platform integration, simplifying protocol parsing, command generation, and validation.

Analysis and basic wrapper library for the Lego Dimensions "Gateway" peripheral

Cross-language packet capture normalizer and collector-inference engine: parse recorded Redis traces into a stable intermediate format (Go) and infer communication patterns from it (Rust).

Wiredigg is a comprehensive network analysis tool with advanced security features designed for network administrators, security professionals, and IT enthusiasts. It provides real-time packet capture, protocol analysis, anomaly detection, and threat identification capabilities in a modern, user-friendly interface.

Online engine for reasoning about the Noise Protocol Framework.

Sonar anti-bot verification bypass for Minecraft. Working 2.1.x sonar bypass script, packet logger, debug proxy. cubixmc poormc tested.

Does This Look Like An Honeypot? (DTLLAH) Multi-protocol CLI that fingerprints whether a target IP behaves like an honeypot — using Honeyscore, active auth/state probes, and a weighted score.

Security research on the WhatsApp protocol, cryptographic handshake analysis, reverse engineering, and controlled local MITM experimentation.

Kendo - Powerful Network Packet Capture & Protocol Analysis Software 🚀 Real-time & offline analysis with MFC & WinPcap. Comprehensive protocol parsers & display filters. Efficient packet management. Shortcut keys for seamless user interaction. Explore network traffic effortlessly!

Modbus Attack Tool for Remote Industrial eXploitation (M.A.T.R.I.X) is a comprehensive security testing tool for Modbus TCP protocol implementations.

Full reverse engineering of the UBox/UBIA smart-camera P4P protocol: custom block cipher, KCP+RDT video, ICE-style NAT traversal, and a standalone Python client. TUTK IOTC rebadge, documented end-to-end.

open-source AI-assisted USB protocol analysis tool and MCP server

High-throughput network stream inspection for live traffic and PCAPs. Built in Rust with flow reassembly, protocol parsing, transforms, pattern matching, and a real-time Web UI.

Ever want to control Razer Synapse profiles externally? Well now you can

Reverse-engineer iPhone↔device protocols (BLE/WiFi) without a hardware sniffer. Captures decrypted HCI + WiFi via libimobiledevice and rvictl, decodes PTP-IP and Sony private opcodes.

Flow-based PCAP analyzer with protocol-aware inspection, analysis, statistics, reusable indexes, and CLI.

Rust CLI tool for analyzing IoT protocol traffic (CoAP, MQTT, RPL) and assessing post-quantum cryptographic readiness against NIST FIPS 203/204

Bidirectional forwarding between two serial ports for protocol analysis.

Security and reverse-engineering study of DEÜ DEYSİS attendance trust boundaries, with a sanitized Rust mock implementation.

Open, vendor-neutral EMV® 3-D Secure protocol lab for researchers, payment engineers, and educators to visualize browser and app flows, compare spec versions, and inspect trust boundaries.

Reverse engineering of the Bluetooth protocol used by MOONDROP Space Travel TWS earbuds, based on GAIA V3 Protocol. Covers the full protocol stack, including BLE GATT services, ANC control, EQ settings, and firmware updates.

[Network Forensics Series] A browser-based STP/RSTP/Rapid PVST+ analyzer for network engineers. Drop a PCAP file — get a structured event timeline, full FSM reconstruction, root cause analysis with causal chains, topology graph, and zero data leaving your machine.

Profile aMule's External Connect (EC) protocol - a pass-through proxy with a live dashboard, per-caller attribution and session reports.

Reverse engineering the Xiaomi Mi weight scale: BLE advertisement protocol, byte-level frame layouts, an offline decoder and each computed metric traced to its source.

S1 Signal Event Engine - Real-time S1AP protocol analysis and event processing for LTE networks

No description supplied by the upstream repository.

An advanced, security-focused network traffic analysis tool designed for system administrators, cybersecurity professionals, and network engineers. The xsukax PCAP Analyzer provides comprehensive insights into network behavior while maintaining strong privacy protections and offering advanced threat detection capabilities.

Minimalist ICS/OT security research laboratory featuring programmable logic controllers (PLCs), ModbusTCP industrial protocol environments, and network simulation.

Python-based packet sniffer with basic threat detection

Browserless reCAPTCHA v2 solver research — protocol analysis, node-vm BotGuard harness, ONNX tile classifier

Network packet analyzer with protocol dissection and credential extraction using Clojure

ZeroHack is a TypeScript-powered tool that uses AI for advanced network packet analysis, protocol anomaly detection, and cybersecurity threat assessment.

Hannes Software — local-first desktop tools for protocol diagnostics, music workflows, and clinic operations.

An alternative configurator for the J16 GPS tracker: reverse engineering a USB port protocol with no public documentation.

Reverse engineering and runtime analysis of the PackClient modular RAT framework: Launcher and Core internals, protocol reconstruction, tooling, and detection engineering.

CryptoAudit ML analyzes network traffic (PCAP files or live capture) to identify weak, broken, or missing encryption — then attempts to crack it. It combines a 5-model ML ensemble for traffic classification with 15+ decryption methods, persistent key/credential harvesting, and optional Ollama AI integration for traffic analysis.

SIP Protocol Analyzer & Security Auditor - Deep packet inspection for VoIP/SIP traffic with RFC 3261 compliance checking, security vulnerability detection, and call flow analysis

Wireshark dissector plugin for analyzing and decoding network protocols, useful for cybersecurity, packet inspection, and reverse engineering.

Small Audio Post-Processor

ML classifier that predicts security flaws in cryptographic protocol designs using structural features like nonce usage, mutual authentication, and key freshness checks, trained and tested on real protocols including Needham-Schroeder, WPA2, TLS, and Kerberos

A Rust framework for headless Minecraft Java Edition clients — bots, testing, automation, and protocol analysis

Modular OT/ICS protocol fuzzer with plugin support, PCAP replay, and anomaly detection

Reverse engineering of the L&S Emotion Control 2.4 GHz lighting protocol from a KZQ-8YKC-K remote (PIC16F1503 + TI CC2500). Full RF and packet spec recovered by SPI bus sniffing, verified over the air with a HackRF

AI-driven DisplayPort/eDP Protocol Analyzer using MCP (Model Context Protocol)

Systematically extracts and integrates the core designs of external systems through the ORRI methodology, with genuine continuous reinforcement capabilities.

scopeBridge

ProtoAudit is a research-grade toolkit for protocol behavior analysis, cryptographic metadata inspection, and randomness anomaly detection. It helps to identify protocol misuse patterns such as challenge reuse, retry loops, deterministic randomness, and handshake inconsistencies. Designed for protocol research, security analysis, and CTF tasks.

Practical Wireshark network protocol analysis project demonstrating HTTP, DNS, TCP, ARP, and HTTP credential capture with real packet captures, security analysis, and professional documentation.

Complete reverse-engineering analysis of AtomCode CLI (v4.25.3), based on static analysis of the Rust binary and runtime behavior verification. Covers 65+ subsystems including authentication, risk controls, AI communication, and the agent engine.

AI-powered serial port detective: sniff, decode, and annotate UART traffic.

Packet capture and network traffic analysis using Wireshark in an isolated cybersecurity lab.

Hands on packet analysis skills and protocol awareness.

Reverse-engineer unknown TCP/UDP protocols: record traffic, infer framing/fields/checksums, verify against the live target, then fuzz deterministically with stateful prefixes. Evidence in SQLite, portable exports.

Automated B2C account registration and verification bot for CFS Brands using Python, temporary email integration, and proxy support.

Technical writeups

Security foundations lab covering governance frameworks, forensic investigation, infrastructure auditing, and protocol analysis.

A lightweight Python network traffic monitoring application designed for the CodeAlpha Cybersecurity Internship. The script interfaces with network adapters to capture real-time data packets, decodes Layer 3 and Layer 4 protocol headers (IP, TCP, UDP, ICMP), and extracts raw data payloads for traffic analysis.

Open-source Go library and CLI for lossless Modbus capture files, time-series recording, conversion and replay-ready data.

A beginner-friendly Python Packet Sniffer built using Scapy. Captures and analyzes live TCP, UDP, DNS, ICMP, and ARP packets with protocol parsing, statistics, and packet logging.

Browser-based bit slicing and alignment tool for hex data, with bit visualization, pattern matching, and re-sliced output.

Self-hosted BitTorrent tracker-protocol simulator and research toolkit with a modern web UI.

Reconnaissance for unknown Modbus RTU devices: slave discovery, register mapping, evidence-based probing.

Master your network traffic. A powerful Windows desktop tool for crafting, transmitting and monitoring custom Ethernet packets