Skip to content

Instantly share code, notes, and snippets.

Thomas Patzke thomaspatzke

  • Code published here is private and not affiliated with my employer.
  • Germany
View GitHub Profile
thomaspatzke / gist:7481047
Created Nov 15, 2013
Create "host;name;port;service;product" CSV from nmap scan XML.
View gist:7481047
xmlstarlet sel -t -m '//port/state[@state="open"]' -v 'concat(ancestor::host/address/@addr,";",ancestor::host/hostnames/hostname[position()=1]/@name,";",../@portid,";",../service/@name,";",../service/@product)' -n file.xml
thomaspatzke / gist:7445851
Created Nov 13, 2013
Create HTML with links to all HTTP servers from nmap scan results.
View gist:7445851
xmlstarlet sel -T -t -m '//port/service[@name="http"]' -v 'concat(ancestor::host/address/@addr, ":", ../@portid, " <a href=http://", ancestor::host/address/@addr, ":", ../@portid, ">HTTP</a> <a href=https://", ancestor::host/address/@addr, ":", ../@portid, ">HTTPS</a><br />")' -n file.xml
thomaspatzke / gist:7445776
Created Nov 13, 2013
Extract HTTP URLs, Requests and Responses from Wireshark PDML file.
View gist:7445776
xmlstarlet sel -t -m '//proto[@name="http"]' --if 'descendant::field[@name="http.request"]' -o 'URL: ' -v 'descendant::field[@name="http.request.full_uri"]/@show' -n -o 'Request: ' -v 'following-sibling::proto[@name="data-text-lines"]/field/@value' -n --elif 'descendant::field[@name="http.response"]' -o 'Code: ' -v 'descendant::field[@name="http.response.code"]/@show' -o ' ' -v 'descendant::field[@name="http.response.phrase"]/@show' -n -o 'Response: ' -v 'following-sibling::proto[@name="data-text-lines"]/field/@value' -n file.pdml | perl -ne 'if (/^((?:Request|Response): )?([0-9a-f]+)$/i) { $p = $1; $e = $2; $e =~ s/([0-9a-f]{2})/$1 /ig; print "$p"; print map { chr(hex($_)) } (split / /, $e); print "\n" if ($e !~ /0[da].?$/i) } else { print }'
You can’t perform that action at this time.