Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Ttshark filter script to get WPA-EAP Identities, EAP certs, HTTP passwords, Handshakes, DNS queries, NBTNS queries and LLMNR queries. Reading a file or a folder
#!/bin/bash
#author : Raul Calvo Laorden (raulcalvolaorden@gmail.com)
#description : Script to get WPA-EAP Identities, EAP certs, HTTP passwords, Handshakes, DNS queries, NBTNS queries and LLMNR queries
#date : 2021-06-24
#usage : bash pcapFilter.sh -f <pcap/folder> [options]
#-----------------------------------------------------------------------------------------------------------
red=`tput setaf 1`
green=`tput setaf 2`
reset=`tput sgr0`
#echo "${red}red text ${green}green text${reset}"
help () {
echo "$0 -f <pcap/folder> [OPTION]
-f <.pcap>: Read pcap or file of .caps
-h : help
OPTIONS:
-A : all
-P : Get HTTP POST passwords (HTTP)
-I : Filter WPA-EAP Identity
-C : Export EAP certs
-H : Get Handshakes 1 and 2
-D : Get DNS querys
-R : Responder vulnerable protocols (NBT-NS + LLMNR)
-N : Get NBT-NS querys
-L : Get LLMNR querys
"
}
filter () {
echo -e "\n${green}FILE: $FILE${reset}"
if [ ! -z "$ALL" ] ; then
PASSWORDS=true
IDENTITY=true
HANDSHAKES=true
DNS=true
NBTNS=true
LLMNR=true
CERT=true
fi
if [ ! -z "$PASSWORDS" ] ; then
echo -e "\n\tGet POST passwords\n"
tshark -r $FILE -Y 'http.request.method == POST and (lower(http.file_data) contains "pass" or lower(http.request.line) contains "pass" or tcp contains "login")' -T fields -e http.file_data -e http.request.full_uri
# basic auth?
fi
if [ ! -z "$IDENTITY" ] ; then
echo -e "\n\tGet WPA-EAP Identities\n"
echo -e 'DESTINATION\t\tSOURCE\t\t\tIDENTITY'
tshark -nr $FILE -Y "eap.type == 1 && eap.code == 2" -T fields -e wlan.da -e wlan.sa -e eap.identity 2> /tmp/error | sort -u
cat /tmp/error
fi
if [ ! -z "$HANDSHAKES" ] ; then
echo -e "\n\tGet Handshakes in pcap\n"
tshark -nr $FILE -Y "wlan_rsna_eapol.keydes.msgnr == 1 or wlan_rsna_eapol.keydes.msgnr == 2"
fi
if [ ! -z "$DNS" ] ; then
echo -e "\n\tGet DNS querys\n"
tshark -nr $FILE -Y "dns.flags == 0x0100" -T fields -e ip.src -e dns.qry.name
fi
if [ ! -z "$NBTNS" ] ; then
echo -e "\n\tGet NBTNS querys in file to responder\n"
tshark -nr $FILE -Y "nbns" -T fields -e ip.src -e nbns.name
fi
if [ ! -z "$LLMNR" ] ; then
echo -e "\n\tGet LLMNR querys in file to responder\n"
tshark -nr $FILE -Y "llmnr" -T fields -e ip.src -e dns.qry.name
fi
# https://gist.github.com/Cablethief/a2b8f0f7d5ece96423ba376d261bd711
if [ ! -z "$CERT" ] ; then
tmpbase=$(basename $FILE)
for x in $(tshark -r $FILE \
-Y "ssl.handshake.certificate and eapol" \
-T fields -e "tls.handshake.certificate"); do
echo $x | \
sed "s/://g" | \
xxd -ps -r | \
tee $(mktemp $tmpbase.cert.XXXX.der) | \
openssl x509 -inform der -text;
done
fi
}
if [ ! -x $(which tshark) ]; then
echo "${red}tshark not installed${reset}"
exit 0
fi
while getopts hf:APIHDRNLC flag
do
case "${flag}" in
h) HELP=true;;
f) INPUT=${OPTARG};;
A) ALL=true;;
P) PASSWORDS=true;;
I) IDENTITY=true;;
H) HANDSHAKES=true;;
D) DNS=true;;
R) NBTNS=true;LLMNR=true;;
N) NBTNS=true;;
L) LLMNR=true;;
C) CERT=true;;
esac
done
if [ "$HELP" = true ] ;
then
help
exit 0
fi
if [ -z "$INPUT" ] ; then
echo "File or folder needed"
echo
help
exit 1
fi
if [ -z "$ALL" ] && [ -z "$PASSWORDS" ] && [ -z "$IDENTITY" ] && [ -z "$HANDSHAKES" ] && [ -z "$DNS" ] && [ -z "$NBTNS" ] && [ -z "$LLMNR" ] && [ -z "$CERT" ]; then
echo "Argument needed"
help
exit 2
fi
if [ "$#" -lt 3 ]; then
echo "Argument needed"
help
exit 2
fi
#Check if INPUT is a folder
if [[ -d "$INPUT" ]]
then
for F in $INPUT/*cap ; do
if [ -f "$F" ] ; then
FILE=$F
filter
else
echo "${red}Warning: Some problem with \"$F\"${reset}"
fi
done
else
FILE=$INPUT
filter
fi
# # TODO
#- Passwords: basic auth, FTP, TFTP, SMB, SMB2, SMTP, POP3, IMAP
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment