Every tool in GraphDagger

Something on the network is misbehaving and the only way to know for certain is to see the actual packets.

Live network traffic capture with a Wireshark-style display filter language and real-time packet inspection across all protocol layers.

• Live multi-interface packet capture
• Wireshark-style display filter language
• Dissection: TCP, UDP, DNS, TLS, HTTP/2
• TCP stream reassembly and follow
• Protocol hierarchy and conversation statistics

An app is making HTTPS calls you cannot see into without standing up a proxy and wrestling with certificates.

Inspect and modify HTTP traffic: breakpoints, proxy rules, a scripting engine and full request and response inspection.

• HTTPS interception with a generated CA
• HTTP/2, WebSocket, gRPC and SSE inspection
• Breakpoints to pause, edit and drop requests
• Match and replace rules for URLs, headers and bodies
• HAR and CSV export, SOCKS5 upstream chaining

Testing an endpoint means hand-rolled curl commands or a heavyweight client that wants an account and a cloud sync.

Send HTTP requests with full control: method, headers, body and authentication. Save and organise request collections.

• OAuth2, AWS SigV4, JWT and Digest auth
• HTTP, GraphQL, WebSocket, SSE and gRPC
• Pre-request and test scripts in a sandbox
• Code generation for 19 languages
• Import Postman, Insomnia, OpenAPI, cURL and HAR

The fault happened an hour ago. Without a recorded trace to walk back through, the evidence is gone.

Review and analyse collected network traces: timeline visualisation and detailed request inspection.

• Records Chromium, Firefox and WebKit sessions
• Screenshots plus full DOM snapshots
• Standard Playwright trace archives
• Network, console and action replay
• Time-travel DOM snapshot playback

A suspicious email lands and you need a verdict. Reading raw headers by eye is slow and easy to get wrong.

Check whether an email really came from who it claims: headers, routing, attachments and SPF, DKIM and DMARC validation.

• SPF, DKIM and DMARC result validation
• Received routing chain reconstruction
• Display-name and domain-alignment spoofing checks
• ARC authentication-chain integrity checks
• 70 built-in rules, attachment hashing and .msg parsing

An unknown file turns up on a server, and uploading it to a web scanner is exactly what you should not do.

Inspect unknown or suspicious files: hex viewer, entropy heatmap, string extraction and YARA rule scanning.

• YARA-X rule editor and scanner
• PE, ELF and Mach-O parsing with imphash
• Shannon entropy heatmap and treemap
• Multi-hash plus TLSH and ssdeep fuzzy hashing
• IoC extraction with defang, PDF/OLE and OCR

The answer is buried in hundreds of megabytes of logs, and grep stops helping once you need structure or timelines.

Parse and analyse application logs: structured field extraction, filtering and pattern detection.

• Auto-detects around 50 log formats
• SQL querying via an embedded DataFusion engine
• Arrow and Parquet columnar storage
• Timeline histograms and faceted field filtering
• Live file tailing with Gzip and Zstd decompression

You have a recording and need to know what is in it. Most audio tools are made for editing, not inspection.

Analyse audio files: waveform and spectrogram views, plus decoders that pull hidden content out of the signal.

• DTMF and Morse decoding to digits and text
• SSTV image decoding: Martin, Scottie, Robot and PD modes
• LSB steganography payload extraction from WAV samples
• Spectrogram with selectable FFT size, window and colour map
• WAV, MP3, FLAC, OGG, AAC and M4A decoding

Unpicking nested Base64, hex and gzip means chaining scripts together and pasting data into random converter websites.

Transform data with a drag-and-drop recipe builder: encode, decode, hash, compress and convert between formats.

• 100+ chainable operations in 13 categories
• Visual node-graph flow builder
• Base64 and hex encoding, hashing and ciphers
• Native compression, entropy and string extraction
• Save and reload named recipes

A token is being rejected, or worse accepted, and pasting it into a website hands your credentials to a stranger.

A local credential workbench, not just a JWT decoder: it auto-handles JWTs, SAML, OAuth and OpenID Connect and X.509 certificates, with a security audit for weak algorithms, expiry and signature checks.

• JWT decode, verify and generate (HS, RS, ES, PS)
• JWT security audit: alg:none, expiry and claims
• SAML assertion analysis with severity findings
• X.509 audit: weak signatures, short keys, expiry
• Kerberos ticket decode with weak-etype flagging

Checking DNS, WHOIS, open ports and certificates means juggling half a dozen commands and browser tabs.

Network lookup toolkit: DNS, WHOIS, port scan, traceroute and SSL certificate checks.

• DNS, WHOIS and SSL certificate lookups
• Ten TCP/UDP/SCTP scan modes (SYN, Xmas, ACK)
• Service banner grabbing and OS fingerprinting
• Visual traceroute with reverse-DNS enrichment
• Firewall evasion: decoys, fragmentation, spoofing

The answer sits in a database, but opening it properly means installing a separate client for every engine you touch.

Connect to SQLite, PostgreSQL, MySQL and SQL Server, several at once: visual schema, data browsing with inline cell editing, an auto-generated ERD and a SQL editor with autocomplete.

• SQLite, PostgreSQL, MySQL and SQL Server
• Auto-generated entity-relationship diagram
• SQL editor with per-dialect autocomplete
• Inline cell editing: insert, update and delete
• Execution-plan viewer and live query log

You have a pile of coordinates and no quick way to see them on a map without uploading them to someone's service.

Visualise geographic data on interactive maps: layer management, filtering and coordinate search.

• MapLibre GL basemap with deck.gl layers
• Import Shapefile, GeoJSON, KML, GPX and WKT
• Offline place search from a bundled gazetteer
• Spatial queries: intersection and bbox overlap
• Thematic styling with Jenks and quantile breaks

Fixing the box at the end of the trail means switching to a separate SSH client and losing your context.

Built-in terminal: SSH, local shell, snippet library, session recording and credential management.

• Native PTY shells: bash, zsh and PowerShell
• SSH with password, key and agent auth
• Full SFTP file browser and transfers
• Session recording in asciinema format
• Command guard rules for dangerous commands