Add PCredz-Like Static PCAP Credential, Hash, Token, and Authentication Artifact Extraction Operations

[solcoteh]

Hello CyberChef team,

I hope you are doing well.

I would like to respectfully suggest a new CyberChef feature for static PCAP analysis: a PCredz-like credential, hash, token, and authentication artifact extraction module or recipe group.

CyberChef is already an excellent tool for decoding, transforming, and analyzing data. It is very useful for DFIR, SOC work, malware analysis, CTF challenges, security training, and general forensic workflows. However, when working with small packet captures, analysts often still need to leave CyberChef and use external tools to extract authentication material, hashes, tokens, plaintext credentials, and protocol-specific artifacts from PCAP files.

While working on CTF/lab-style traffic analysis, including a TryHackMe room called “Block”, I noticed this exact gap. CyberChef is very helpful for many decoding and transformation tasks, but when the input is a small PCAP/PCAPNG file containing NTLMv2, SMB, Kerberos, HTTP, FTP, SMTP, LDAP, or other credential-related protocol data, there is currently no simple built-in workflow to quickly answer:

“What credentials, hashes, tokens, or authentication artifacts are present in this capture?”

A very useful addition would be a static PCAP credential and hash extraction operation, or a group of operations, inspired by tools such as PCredz.

The goal is not to add live capture, network sniffing, password cracking, exploitation, credential reuse, or offensive automation into CyberChef. Instead, the feature would focus only on safely parsing a user-provided PCAP/PCAPNG file locally in the browser and extracting useful authentication artifacts for authorized forensic, educational, defensive, and CTF/lab analysis.

In simple terms, the workflow would be:

Upload a small PCAP into CyberChef → run PCAP credential extraction operations → get structured hashes, credentials, tokens, and protocol artifacts → copy the needed output to the next authorized analysis tool if required.

A good inspiration for this feature is PCredz:

https://github.com/lgandx/PCredz

PCredz can extract many useful credential and authentication artifacts from network traffic. A CyberChef implementation could start with the most practical static PCAP use cases and grow over time.

Possible operation names could include:

• Extract Credentials from PCAP
• Extract Hashes from PCAP
• Extract NTLM from PCAP
• Extract NTLMv2 from PCAP
• Extract Kerberos from PCAP
• Extract SMB/NTLMSSP Authentication Fields
• Extract HTTP Credentials from PCAP
• Extract Plaintext Protocol Credentials from PCAP
• Extract Authentication Tokens from PCAP
• Extract PCAP Credential Timeline
• Extract PCAP Credential Summary

The feature could support PCAP and PCAPNG files, especially small captures commonly used in CTFs, labs, SOC investigations, malware traffic analysis, and DFIR workflows.

Suggested protocol and artifact coverage

1. NTLM / NTLMSSP

CyberChef could extract NTLMv1 and NTLMv2 authentication material from protocols such as:

• SMB / SMB2
• HTTP
• LDAP
• MSSQL
• DCE/RPC
• Other NTLMSSP-carrying protocols where possible

Useful extracted fields could include:

• Username
• Domain
• Workstation
• Source IP
• Destination IP
• Source port
• Destination port
• Protocol
• Timestamp
• NTLM version
• NTLM server challenge
• NTProofStr
• NTLM response
• NTLMv2 blob
• NTLMv2 response
• Encrypted session key, if present
• SMB Session ID, if available
• Hashcat-compatible NTLMv1 output
• Hashcat-compatible NTLMv2 output
• John-compatible output where possible

Example Hashcat-style output:

NTLMv1:

username::domain:LM_response:NT_response:challenge

NTLMv2:

username::domain:server_challenge:NTProofStr:blob

For NTLMv2 specifically, it would be very helpful if CyberChef could display fields such as:

• Username
• Domain
• Workstation
• Server challenge
• NTProofStr
• NTLMv2 blob
• Encrypted session key, if present
• SMB Session ID, if available
• Hashcat mode 5600 compatible line

This would be useful in situations where the analyst only has a small capture and wants to quickly understand what Windows authentication material exists in it.

2. Kerberos

CyberChef could extract Kerberos authentication artifacts from PCAP files, especially AS-REQ pre-authentication data where applicable.

Useful output could include:

• Username / principal
• Realm
• Client IP
• Server IP
• Encryption type
• Timestamp
• Kerberos AS-REQ pre-auth hash material
• Hashcat-compatible Kerberos output where possible

This would be useful for:

• Active Directory labs
• Kerberos training
• Blue team investigations
• CTF challenges
• Detecting exposed Kerberos authentication material in captures
• Understanding Kerberos traffic in small forensic packet captures

3. SMB / SMB2 metadata

In addition to extracting NTLMSSP values, CyberChef could also extract SMB-related authentication metadata where available, such as:

• SMB Session ID
• Tree/session information where relevant
• Authentication mechanism
• Client and server addresses
• NTLMSSP negotiation/challenge/authenticate message metadata
• Encrypted session key, if present

This would also help future workflows that generate SMB session keys for Wireshark decryption.

4. HTTP authentication and web credentials

CyberChef could extract credentials and tokens from HTTP traffic, such as:

• HTTP Basic authentication
• HTTP form username/password fields
• Common password field names
• API keys
• Bearer tokens
• Session tokens
• Cookies
• Authorization headers
• Login POST parameters
• Interesting web parameters such as user, username, login, email, password, pass, token, api_key, access_token, sessionid, etc.

Useful output could include:

• URL
• Host header
• Method
• Path
• Source IP
• Destination IP
• Timestamp
• Extracted username
• Extracted password
• Extracted token
• Extracted cookie
• Full matching parameter
• Redacted or safe display mode for sensitive values

This would make CyberChef much more useful when reviewing small web traffic captures.

5. FTP

CyberChef could extract FTP authentication commands such as:

• USER
• PASS

Useful output:

• Username
• Password
• Server IP
• Client IP
• Timestamp
• Full FTP command context

6. SMTP

CyberChef could extract SMTP authentication data such as:

• AUTH PLAIN
• AUTH LOGIN
• Base64-decoded username/password where applicable

Useful output:

• SMTP server
• Client IP
• Username
• Password
• Authentication mechanism
• Decoded value
• Timestamp

7. IMAP

CyberChef could extract IMAP login data such as:

• LOGIN username password

Useful output:

• IMAP server
• Client IP
• Username
• Password
• Timestamp

8. POP3

CyberChef could extract POP3 credentials such as:

• USER
• PASS

Useful output:

• POP3 server
• Client IP
• Username
• Password
• Timestamp

9. LDAP

CyberChef could extract LDAP Simple Bind information where available.

Useful output:

• Bind DN
• Username
• Domain
• Password, if present in plaintext traffic
• Server IP
• Client IP
• Timestamp

10. SNMP

CyberChef could extract SNMP v1/v2c community strings.

Useful output:

• Community string
• SNMP version
• Source IP
• Destination IP
• Timestamp

11. MSSQL / TDS

CyberChef could attempt to extract MSSQL/TDS authentication-related data where possible.

Useful output could include:

• Username
• Server
• Client IP
• Authentication type
• Captured authentication artifact, if supported
• Timestamp

12. IRC

CyberChef could extract IRC authentication fields such as:

• NICK
• USER
• PASS

Useful output:

• Nickname
• Username
• Password
• Server IP
• Client IP
• Timestamp

13. General token and secret extraction

Beyond protocol-specific credentials, CyberChef could also provide a generic “Extract Authentication Tokens from PCAP” operation.

It could search reconstructed plaintext protocol data for patterns such as:

• API keys
• Bearer tokens
• JWTs
• Basic Authorization headers
• Session cookies
• CSRF tokens
• Access tokens
• Refresh tokens
• Private-looking keys or secret parameters
• Password fields
• Authorization headers

Useful output:

• Token type
• Matched value
• Redacted value
• Protocol
• Host
• URL/path where available
• Source IP
• Destination IP
• Timestamp

14. Optional credit card number detection

PCredz also includes optional credit card number extraction. If the CyberChef maintainers consider this appropriate, CyberChef could include it as an optional disabled-by-default operation.

Because this can be sensitive, it should be clearly separated and controlled by an explicit option such as:

• Enable credit card pattern scanning

It should probably be disabled by default to reduce accidental exposure of sensitive data.

If implemented, it could include:

• Candidate card number
• Source protocol
• Source IP
• Destination IP
• Timestamp
• Luhn validation result
• Redacted display option, for example:
  411111******1111

Output formats

A strong part of this feature would be flexible output formatting.

CyberChef could provide multiple output modes:

• Human-readable report
• Table
• JSON
• CSV
• Hashcat format
• John the Ripper format
• Per-protocol grouped output
• Timeline output
• Deduplicated output
• Verbose output with duplicates
• Redacted output
• Raw extracted values only

Example summary view:

Protocol: NTLMv2
Username: alice
Domain: EXAMPLE
Source: 10.10.10.5:49158
Destination: 10.10.10.20:445
Hashcat mode: 5600
Hash: alice::EXAMPLE:1122334455667788:...

Example JSON view:

{
"type": "NTLMv2",
"username": "alice",
"domain": "EXAMPLE",
"sourceIp": "10.10.10.5",
"destinationIp": "10.10.10.20",
"destinationPort": 445,
"timestamp": "...",
"hashcatMode": 5600,
"hash": "alice::EXAMPLE:..."
}

Example timeline view:

[2026-05-30 12:01:02] FTP credential found from 10.10.10.5 to 10.10.10.20
[2026-05-30 12:01:15] NTLMv2 hash found from 10.10.10.5 to 10.10.10.30
[2026-05-30 12:01:45] HTTP Basic credential found from 10.10.10.5 to 10.10.10.40

Deduplication

The operation should deduplicate identical credentials or hashes by default.

Suggested options:

• Deduplicate results: enabled by default
• Show duplicates / verbose mode: optional
• Group by protocol
• Group by source host
• Group by destination host
• Group by username
• Group by timestamp

This would make the output much cleaner when the same authentication attempt appears multiple times in the capture.

Protocol filtering

Similar to PCredz, CyberChef could allow users to enable or disable protocol parsers.

Example options:

• Enable NTLM
• Enable Kerberos
• Enable SMB metadata extraction
• Enable HTTP
• Enable FTP
• Enable SMTP
• Enable IMAP
• Enable POP3
• Enable LDAP
• Enable SNMP
• Enable MSSQL
• Enable IRC
• Enable generic token extraction
• Enable credit card scanning

This would help analysts reduce noise and focus only on the data they need.

Host and port filtering

CyberChef could optionally support host-based and port-based filters:

• Include only source IP
• Include only destination IP
• Exclude source IP
• Exclude destination IP
• Include only ports
• Exclude ports

This would be useful when a capture contains a lot of unrelated traffic.

Link layer and file support

PCAP files can have different link-layer formats. It would be useful if CyberChef could support common ones such as:

• Ethernet
• Linux cooked capture
• Raw IP

If full support is too large for a first implementation, CyberChef could start with Ethernet PCAP support and expand later to PCAPNG and additional link-layer formats.

Suggested CyberChef workflow

A typical workflow could look like this:

1. Drag and drop a small PCAP/PCAPNG file into CyberChef
2. Add operation: “Extract Credentials from PCAP”
3. Choose enabled protocol parsers
4. Choose output mode: Table / JSON / Hashcat / Timeline
5. CyberChef parses the file locally in the browser
6. CyberChef displays discovered credentials, hashes, tokens, and authentication artifacts
7. The analyst copies only the needed output for further authorized analysis

Example:

Input:

capture.pcap

Operation:

Extract Credentials from PCAP

Options:

• NTLM: enabled
• Kerberos: enabled
• HTTP: enabled
• FTP: enabled
• SMTP: enabled
• Deduplicate: enabled
• Output format: Table + Hashcat

Output:

• NTLMv2 hash in Hashcat mode 5600 format
• HTTP Basic credential
• FTP USER/PASS credential
• SMTP AUTH LOGIN credential
• Timeline of discovered artifacts

Possible initial implementation scope

I understand that implementing a full PCredz-like feature inside CyberChef may be a large task, especially because PCAP parsing, stream reconstruction, and protocol parsing can become complex.

This feature could start small and grow step by step.

A realistic first version could support:

• PCAP file input
• Ethernet link-layer parsing
• NTLMv1/NTLMv2 extraction
• SMB/NTLMSSP authentication metadata extraction
• HTTP Basic extraction
• FTP USER/PASS extraction
• SMTP AUTH LOGIN / AUTH PLAIN extraction
• POP3 USER/PASS extraction
• IMAP LOGIN extraction
• SNMP community string extraction
• Deduplication
• Table output
• JSON output
• Hashcat output for NTLMv1/NTLMv2

A later version could add:

• PCAPNG support
• Kerberos AS-REQ extraction
• LDAP Simple Bind extraction
• MSSQL/TDS parsing
• IRC parsing
• Generic token extraction
• Credit card scanning as an optional disabled-by-default mode
• Host filters
• Protocol filters
• Timeline mode
• John the Ripper output formats
• Better stream reconstruction
• Additional link-layer formats
• SMB session metadata extraction

Even an initial implementation that only supports NTLMSSP over SMB/HTTP and outputs NTLMv2 Hashcat-compatible lines would already be very useful.

Why this fits CyberChef

I think this feature fits CyberChef very well because CyberChef is already widely used for:

• Static analysis
• Decoding
• Data transformation
• Hash formatting
• Base64 decoding
• Hex decoding
• Extracting indicators
• Working with suspicious text safely
• CTF and DFIR workflows

A PCAP credential extraction module would extend this same idea to small packet captures.

Instead of forcing analysts to install extra tools for every small capture, CyberChef could provide a quick, safe, local, browser-based way to answer:

“What credentials, hashes, tokens, or authentication artifacts are present in this PCAP?”

Important safety boundaries

To keep this safe and appropriate for CyberChef, I suggest the feature should be static-first and defensive by design.

Suggested safety boundaries:

• No live packet capture
• No network sniffing
• No packet injection
• No password cracking inside CyberChef
• No authentication attempts
• No credential reuse
• No automatic login
• No exploitation
• No external network calls
• Local parsing only
• User-provided PCAP/PCAPNG files only
• Clear warning that the user must have authorization to analyze the capture
• Optional redaction mode for sensitive values
• Optional “safe mode” that only extracts hashes and protocol metadata, not plaintext credentials
• Optional file-size limit for browser performance
• Optional warning when plaintext credentials are found

A warning could say:

“This operation extracts authentication material from a packet capture. Only use it on captures you are authorized to analyze. CyberChef does not crack passwords, authenticate to services, or transmit extracted data.”

References

PCredz:
https://github.com/lgandx/PCredz

TryHackMe Block room:
https://tryhackme.com/room/blockroom

NTLMv1 vs NTLMv2 background:
https://www.praetorian.com/blog/ntlmv1-vs-ntlmv2/

Wireshark NTLMSSP notes:
https://wiki.wireshark.org/NTLMSSP

Wireshark Kerberos notes:
https://wiki.wireshark.org/Kerberos

Hashcat example hashes:
https://hashcat.net/wiki/doku.php?id=example_hashes

Thank you very much for maintaining CyberChef and for considering this feature request.

I think this would be a very practical feature for safe, static, browser-based network forensic analysis. Even a small first version would help SOC analysts, DFIR investigators, students, CTF players, malware analysts, and defenders quickly understand what authentication artifacts exist in a packet capture.

[mansiverma897993]

@GCHQDeveloper581 I can try to solve this can you assign me this too....