gh0stkey/HaE
HaE
HaE is a network traffic analysis tool designed to extract, classify, and highlight specific data fragments within network messages and HTTP traffic. It functions as an HTTP data extractor and traffic content filter, utilizing a network metadata aggregator to centralize highlighted data fragments and annotations for analysis.
The tool identifies high-value network packets by mapping classification results to visual color markers and employs a modular classification system to isolate data fragments from binary or text streams. It distinguishes the severity of matched data by piping extracted content to external command line tools for independent validation.
The project provides capabilities for HTTP protocol inspection via multi-engine regular expression matching and aggregates security metadata into a centralized view for querying. It further supports packet data classification and vulnerability research workflows by filtering network traffic based on severity levels.
Features
- Network Traffic Analysis - Analyzes network traffic to identify and isolate high-value data fragments for communication pattern analysis.
- Regex Pattern Matching - Utilizes multiple regular expression engines simultaneously to extract structured information from HTTP headers and bodies.
- Metadata Aggregators - Centralizes fragmented highlights and annotations into a unified metadata structure for querying and analysis.
- HTTP Data Extractors - Provides a modular system using regular expressions to retrieve specific information from HTTP requests and responses.
- HTTP Traffic Inspection - Inspects HTTP requests and responses to extract metadata and identify interesting API calls or parameters.
- Network Data Fragment Extraction - Identifies and retrieves specific data fragments from network messages and files using a modular classification system.
- Metadata Aggregation Panels - Offers a centralized panel for querying and analyzing highlighted data fragments and annotations from network traffic.
- Traffic Classification Engines - Categorizes network traffic using modular classification systems and custom matching rules for visual highlighting.
- Data Classification Modules - Implements a modular system of pluggable logic blocks to isolate specific data fragments from binary or text streams.
- Request Data Extraction - Retrieves specific information and metadata from HTTP requests and responses using multi-engine regex matching.
- Metadata Extraction - Aggregates highlighted fragments and annotations into a single panel for rapid querying and analysis.
- External Command Piping - Pipes extracted network content to external standalone command line tools for independent severity verification.
- Visual Highlighting - Provides a visual color-mapping system to distinguish high-value network packets from background noise.
- Content-Based Severity Filters - Assigns severity levels to network data by running external validator commands against extracted content.
- Vulnerability Research - Supports vulnerability research by filtering network traffic based on severity levels determined by external validators.
- External Content Validation - Assigns severity levels to matched network data by running external validator commands against the extracted content.
- Distributed Security Event Aggregation - Aggregates extracted fragments and security annotations into a centralized view for rapid auditing.
- Traffic Visual Highlighting - Marks matching network messages with colors to visually distinguish high-value data from irrelevant traffic.
- Burp Suite Extensions - Plugin for highlighting requests and extracting sensitive information.
- Data Extraction and Analysis - Information highlighting and extraction based on custom rules.
- Penetration Testing Tools - Burp Suite extension for highlighting and extracting sensitive data.
- Workflow Enhancements - Highlights requests and extracts information from responses.
