2.8.1 minor

Author: caster0x00

README.md

@@ -5,13 +5,18 @@ Network security sniffer for finding vulnerabilities in the network. Designed fo
 ![](/banner/banner.png)
 
 ```
-Above: Invisible network protocol sniffer
-Designed for pentesters and security engineers
-
-Author: Mahama Bazarov, <mahamabazarov@mailbox.org>
-Pseudonym: Caster
-Version: 2.8
-Codename: Rubens Barrichello
+        ___    __                  
+       /   |  / /_  ____ _   _____ 
+      / /| | / __ \/ __ \ | / / _ \
+     / ___ |/ /_/ / /_/ / |/ /  __/
+    /_/  |_/_.___/\____/|___/\___/ 
+
+    Above: Network Security Sniffer
+    Developer: Mahama Bazarov (Caster)
+    Contact: mahamabazarov@mailbox.org
+    Version: 2.8.1
+    Codename: Rubens Barrichello
+    Documentation & Usage: https://github.com/caster0x00/Above
 ```
 
 # Disclaimer
@@ -164,49 +169,29 @@ Example:
 
 ```bash
 caster@kali:~$ sudo above --interface eth0 --timer 120
-                                             
-      ___  _                    
-     / _ \| |                   
-    / /_\ \ |__   _____   _____ 
-    |  _  | '_ \ / _ \ \ / / _ \
-    | | | | |_) | (_) \ V /  __/
-    \_| |_/_.__/ \___/ \_/ \___|
-    
-    Invisible network protocol sniffer. Designed for security engineers
-
-    Author: Mahama Bazarov, <mahamabazarov@mailbox.org>
-    Alias: Caster
-    Version: 2.8
+        ___    __                  
+       /   |  / /_  ____ _   _____ 
+      / /| | / __ \/ __ \ | / / _ \
+     / ___ |/ /_/ / /_/ / |/ /  __/
+    /_/  |_/_.___/\____/|___/\___/ 
+
+    Above: Network Security Sniffer
+    Developer: Mahama Bazarov (Caster)
+    Contact: mahamabazarov@mailbox.org
+    Version: 2.8.1
     Codename: Rubens Barrichello
+    Documentation & Usage: https://github.com/caster0x00/Above
 
-    [!] Above does NOT perform MITM or credential capture. Passive analysis only
-    [!] Unauthorized use in third-party networks may violate local laws
-    [!] The developer assumes NO liability for improper or illegal use
-
-    [*] OUI Database Loaded. Entries: 36858
------------------------------------------------------------------------------------------
-[+] Start sniffing...
+[*] Start Sniffing
 
-[*] After the protocol is detected - all necessary information about it will be displayed
-==============================
 [+] Detected STP Frame
 [*] Attack Impact: Partial MITM
 [*] Tools: Yersinia, Scapy
-[*] STP Root Switch MAC: 78:9a:18:4d:55:63
+[*] STP Root Switch MAC: 00:11:22:33:44:55
 [*] STP Root ID: 32768
 [*] STP Root Path Cost: 0
-[*] Mitigation: Enable BPDU Guard
+[*] Mitigation: Enable BPDU Guard or Portfast
 [*] Vendor: Routerboard.com
-==============================
-[+] Detected MDNS Packet
-[*] Attack Impact: MDNS Spoofing, Credentials Interception
-[*] Tools: Responder
-[*] MDNS Spoofing works specifically against Windows machines
-[*] You cannot get NetNTLMv2-SSP from Apple devices
-[*] MDNS Speaker IP: 10.10.100.252
-[*] MDNS Speaker MAC: 02:10:de:64:f2:34
-[*] Mitigation: Monitor mDNS traffic, this protocol can't just be turned off
-[*] Vendor: Unknown Vendor
 ```
 
 If you need to record the sniffed traffic, use the `--output` argument
@@ -221,33 +206,38 @@ caster@kali:~$ sudo above --interface eth0 --timer 120 --output above.pcap
 If you already have some recorded traffic, you can use the `--input` argument to look for potential security issues
 
 ```bash
-caster@kali:~$ above --input ospf-md5.cap
+caster@kali:~$ above --input hsrp.cap
 ```
 
 Example:
 
 ```bash
-caster@kali:~$ sudo above --input dopamine.cap
-
-[*] OUI Database Loaded. Entries: 36858
-[+] Analyzing pcap file...
-
-==============================
-[+] Detected DHCP Discovery
-[*] DHCP Discovery can lead to unauthorized network configuration
-[*] DHCP Client IP: 0.0.0.0 (Broadcast)
-[*] DHCP Speaker MAC: 00:11:5a:c6:1f:ea
-[*] Mitigation: Use DHCP Snooping
-[*] Vendor: Ivoclar Vivadent AG
-==============================
-[+] Detected HSRPv2 Packet
-[*] Attack Impact: MITM
-[*] Tools: Loki
-[!] HSRPv2 has not yet been implemented in Scapy
-[!] Check priority and state manually using Wireshark
-[!] If the Active Router priority is less than 255 and you were able to break MD5 authentication, you can do a MITM
-[*] HSRPv2 Speaker MAC: 00:00:0c:9f:f0:01
-[*] HSRPv2 Speaker IP: 10.0.0.10
+caster@kali:~$ sudo above --input hsrp.cap
+        ___    __                  
+       /   |  / /_  ____ _   _____ 
+      / /| | / __ \/ __ \ | / / _ \
+     / ___ |/ /_/ / /_/ / |/ /  __/
+    /_/  |_/_.___/\____/|___/\___/ 
+
+    Above: Network Security Sniffer
+    Developer: Mahama Bazarov (Caster)
+    Contact: mahamabazarov@mailbox.org
+    Version: 2.8.1
+    Codename: Rubens Barrichello
+    Documentation & Usage: https://github.com/caster0x00/Above
+
+    [+] Analyzing pcap file...
+
+
+[+] Detected HSRP Packet
+[*] HSRP Active Router Priority: 90
+[+] Attack Impact: MITM
+[*] Tools: Loki, Scapy, Yersinia
+[*] HSRP Group Number: 10
+[+] HSRP Virtual IP Address: 10.28.168.254
+[*] HSRP Sender IP: 10.28.168.253
+[*] HSRP Sender MAC: 00:00:0c:07:ac:0a
+[!] Authentication: Plaintext Phrase: cisco
 [*] Mitigation: Priority 255, Authentication, Extended ACL
 [*] Vendor: Cisco Systems
 ```
@@ -356,8 +346,7 @@ Copyright (c) 2025 Mahama Bazarov. This project is licensed under the Apache 2.0
 
 # Outro
 
-When I create this instrument, I am inspired by the track KOAN Sound - View From Above (VIP)
-This track was everything to me when I was working on this tool.
+If you have any suggestions or find any bugs, feel free to create issues in the repository or contact me: [mahamabazarov@mailbox.org](mailto:mahamabazarov@mailbox.org)
+
 
----