I replaced Wireshark with a Rust binary and an identity crisis.

WireHunt started life as WireGar, which is a name I can only explain by admitting I was in polytechnic and thought a portmanteau counted as branding. Nanyang Polytechnic, final year, about six years ago. I wanted one program that would read a packet capture so I could stop tabbing between Wireshark, tshark, and whatever else the lab machine had installed that week.

The Python prototype could barely finish a small file. I would start it, go make coffee, and come back to a process that was still thinking about the third packet. Then I rewrote the whole thing in Rust. I went looking for a file worth keeping. There was not one. None of the school code made the trip. Twenty-year-old me can file a complaint.

██╗    ██╗██╗██████╗ ███████╗██╗  ██╗██╗   ██╗███╗   ██╗████████╗
██║    ██║██║██╔══██╗██╔════╝██║  ██║██║   ██║████╗  ██║╚══██╔══╝
██║ █╗ ██║██║██████╔╝█████╗  ███████║██║   ██║██╔██╗ ██║   ██║
██║███╗██║██║██╔══██╗██╔══╝  ██╔══██║██║   ██║██║╚██╗██║   ██║
╚███╔███╔╝██║██║  ██║███████╗██║  ██║╚██████╔╝██║ ╚████║   ██║
 ╚══╝╚══╝ ╚═╝╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝ ╚═════╝ ╚═╝  ╚═══╝   ╚═╝

The pipeline is boring if you say it like a README, so I will say it like someone who has stared at a capture that started halfway through a conversation. Read the pcap. Glue the TCP stream back together, including the ones that begin after the handshake, which is most of the interesting ones. Guess the protocol from the port, and if the port is lying, look at the first bytes. Pull files out of HTTP. Notice when someone typed a password because the protocol was designed in a more trusting century. Score the weird stuff. Write the report.

Flags get their own tantrum. flag{}, CTF{}, picoCTF{}, and the formats people invent at 2am. If the flag is sitting inside base64, or hex, or a single-byte XOR, the decoder tries the combinations and prints the chain it used. base64 | xor:0x42 is a sentence I have read more often than I have read my own calendar. The same flag in four streams counts once. I got tired of congratulating myself.

There are three ways to drive it. A page on localhost, for dragging a file onto a rectangle. A terminal UI with vim keys, for people who have opinions about mice. A CLI, for the script that has to run while the coffee is happening. wirehunt serve and you are already in the first one.

The GitHub repo is still called WireGar. Renaming it felt like a commitment, and I have met me. https://github.com/cheongcode/WireGar