Introducing Frame Bench: read, edit and build packet captures at the byte level
Read, edit, and build packet captures at the byte level: open one you have, or make one from nothing.
Netomize Official Blog
Defensive Cybersecurity Consultancy.
Latest articles
Detect ICMP-Ghost Implant ICMP and DNS Tunnelling C2 Traffic Using PacketSmith Yara-X & ICMP Detection Modules
Introduction ICMP-Ghost is an open-source tunnelling framework written in pure x64 assembly. What stands out about this framework, compared to other closed- and open-source ones, is the author's claim
Clustering macOS ClickFix Campaign Webpages Using the HTTP-Basma Fingerprinting Algorithm
Introduction On August 5, 2026, the Microsoft Security Research Team (MSRT) blogged about a new macOS ClickFix campaign titled From open lures to cloaked gates: How a macOS ClickFix campaign learned t
HTTP-Basma - Clustering Verbosus Fingerprints
The design and architecture of the verbosus fingerprint (vfp) in HTTP-Basma allows for deeper inspection of every field of every probe. The reversibility property of the fingerprint coupled with the d
HTTP Status-Line (SL) Shenanigans
While working on HTTP-Basma, I had the idea of trying to construct "weird" (obfuscated looking) yet functional HTTP server response headers, that are still interpreted by the browser as valid server r
HTTP-Basma - Platform Update (v3.0 - Gaudi)
Following the first release of HTTP-Basma on May 20, 2026, on Netomize's official GitHub repository, including the research paper, source code, datasets, and 64-bit release versions for Windows and Li
Introducing HTTP-Basma - Adaptive Fingerprinting: HTTP-Basma's Multi-Stage Probing for Granular Server Differentiation
Netomize is happy to announce the release of a new HTTP fingerprinting algorithm called HTTP-Basma to identify HTTP servers using a reversible fingerprint codenamed verbosus. In the realm of cybersecu
Detecting Exploitation of CrushFTP Vulnerability (CVE-2025-31161) With PacketSmith Yara Detection Module - Using track_state and flow_state
Introduction This vulnerability was found by Outpost24 under the identifier CVE-2025-31161 (previously reported as CVE-2025-2825). Outpost24 and other vendors and security researchers have shared enou
Detect Shulfar Malware Encrypted TCP C&C Traffic Using PacketSmith Yara-X Detection Module
Introduction Splunk published a blog post about a variant of the Gh0stRat malware family used in a new campaign delivered alongside the CloverPlus adware. The blog post is titled "Not Just Annoying Ad