Open Source Tools on Martin Gallo

Impacket

Mon, 01 Jan 0001 00:00:00 +0000

Contribution

Between March 2021 and August 2022, I acted as the core maintainer of the project, accepting, reviewing and coding contributions, as well as leading one part-time security researcher dedicated as a developer of the project. I also personally contributed with several research and features to the project.

The project was later transferred to Fortra/Core Security in October 2022 which was my employer at that time.

Description

Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself. Packets can be constructed from scratch, as well as parsed from raw data, and the object-oriented API makes it simple to work with deep hierarchies of protocols. The library provides a set of tools as examples of what can be done within the context of this library.

pysap

Mon, 01 Jan 0001 00:00:00 +0000

Contribution

pysap was authored as part of my intial research about the Diag protocol and published as an open source tool in July 2012. The tool was further expanded to cover other SAP’s network protocols and then file formats.

pysap was contributed to the OWASP CBAS Project in October 2022 by SecureAuth which was my employer at that time. It’s been actively maintained as part of the CBAS Project since that time.

HoneySAP

Mon, 01 Jan 0001 00:00:00 +0000

Contribution

HoneySAP was authored during my research about SAP’s deception which was presented in March 2015.

HoneySAP was contributed to the OWASP CBAS Project in October 2022 by SecureAuth which was my employer at that time. It’s been actively maintained as part of the CBAS Project since that time.

Description

HoneySAP is a low-interaction research-focused honeypot specific for SAP services. It’s aimed at learn the techniques and motivations behind attacks against SAP systems.

SAP Dissection plug-in for Wireshark

Mon, 01 Jan 0001 00:00:00 +0000

Contribution

SAP Dissection plug-in was authored as part of my intial research about the Diag protocol and published as an open source tool in July 2012. The tool was further expanded to cover other SAP’s network protocols.

SAP Dissection plug-in was contributed to the main Wireshark project in October 2022 by SecureAuth which was my employer at that time. The dissectors are now part of the core dissection library and been actively maintained by the Wireshark Foundation community.