protocol-reverse-engineering

This skill provides a robust toolkit for engineers and security researchers tasked with deconstructing proprietary or undocumented network protocols. It acts as a guide and operational reference for navigating the entire lifecycle of protocol analysis—from initial traffic interception to the creation of formal technical specifications. Whether you are debugging complex distributed system communication, performing security audits for vulnerability assessment, or ensuring interoperability in black-box environments, this skill delivers the necessary commands and methodological patterns to succeed.

The skill covers core utilities like Wireshark, tshark, tcpdump, and mitmproxy, providing syntax for targeted capture, real-time filtering, and stream reconstruction. Beyond simple packet inspection, it offers advanced guidance on binary analysis, helping users identify structural patterns like Type-Length-Value (TLV) sequences, length-prefixed messages, and magic signatures. It also includes boilerplate code for parsing binary data using Python’s struct module, enabling rapid development of custom dissectors or protocol bridges.

• Capture and inspect traffic using standard industry tools like Wireshark, tshark, tcpdump, and mitmproxy with support for SSL/TLS interception.

• Analyze packet captures by applying display filters, following TCP/HTTP streams, and exporting protocol objects for deeper inspection.

• Leverage Scapy for script-based traffic analysis, packet modification, and custom packet creation for fuzzing or testing edge cases.

• Identify and map binary protocol structures, including magic numbers, headers, message types, and variable-length payloads.

• Utilize provided Python templates for parsing TLV structures, length-prefixed messages, and generating readable hex dumps for documentation.

• Consult a reference library of common protocol signatures for HTTP, TLS, DNS, SMB, SSH, and various database protocols like MySQL and PostgreSQL.

• Designed for security researchers, network engineers, and system integrators dealing with proprietary communications.

• Requires familiarity with command-line interface tools and basic Python for scripting custom parsers.

• Ideal for use cases involving protocol fuzzing, debugging inter-service communication, or legacy system migration.

• Output formats generally include structured JSON data from captures, annotated binary definitions, and human-readable analysis reports.