netsec2014 Project 2

netsec2014_project2.py

#!/usr/bin/python
"""
Follow http://danmcinerney.org/http-post-analyzer-in-python/
Enviroment: python2.x and scapy 
Goal: Use scapy to sniffer tcp 80 port 
"""

import logging
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
from scapy.all import *
prev_body = ''
interface = 'enp2s0' #archlinux interface
def cb(pkt):
    global prev_ack, prev_body
    post_found = 0
    get_found = 0
    if pkt.haslayer(Raw):
        load = repr(pkt[Raw].load)[1:-1]
        print pkt[Tcp].load #dump tcp source
        try:
            headers, body = load.split(r"\r\n\r\n", 1)
        except:
            headers = load
            body = ''
        header_lines = headers.split(r"\r\n")
        for h in header_lines:
            if 'post /' in h.lower():
              post_found = h.split(' ')[1]
            if 'get /' in h.lower():
              get_found = h.split(' ')[1]
        if post_found:
          for h in header_lines:
              if 'host: ' in h.lower():
                host = h.split(' ')[1]
                print 'URL:',host+post_found
              elif 'referer: ' in h.lower():
                print h
          prev_body = body
          if body != '':
              print '\n'+body
              print '-----------------------------------------'
	elif get_found:
          for h in header_lines:
              if 'host: ' in h.lower():
                host = h.split(' ')[1]
                print 'URL:',host+get_found
              elif 'referer: ' in h.lower():
                print h
sniff(iface=interface, filter='tcp and (port 443 or port 80)', prn=cb, store=0) #sniffer  tcp 80 or 443