DECrew -- GroinK

groink

what is groink

GroinK is an advanced sniffer that supports protocol decoding and MiTM attacks. Unlike other sniffers, Groink has integrated lua scripting language that allows you to extend it easily.

features

live capturing
data link type supported: Ethernet
IPv6 support
raw packet decoding
MiTM attacks
lua scripting engine
supported more than 10 protocols

script example

  
    local core = require("core")
    local printf = core.printf

    function proc_pkt(p)
      local h = p:get_header(Proto.IPV6)
    
      if h ~= nil then
        local ip = h:dissect()
    
        printf("\n** IPv6 packet dissector:\n")
        printf("  |_version: %d\n", ip.version)
        printf("  |_traffic class: %d\n", ip.trclass)
        printf("  |_flow label: %d\n", ip.flow_label)
        printf("  |_payload length: %d\n", ip.payload_length)
        printf("  |_next header: %d\n", ip.next_hdr)
        printf("  |_hop limit: %d\n", ip.hop_limit)
        printf("  |_source address: %s\n", ip.src_addr)
        printf("  |_destination address: %s\n", ip.dst_addr)
        printf("----------------------------------------------------\n")
      end
    end
    
    function init()
      printf("-----> test script initialized\n")
    end
		 
    function cleanup()
      printf("-----> test script cleaned up\n")
    end