从libpcap python脚本重构HTTP网页

Question

我正在尝试从python脚本从libpcap文件重建网页。我有所有的包，所以我想目标是有一个libpcap文件作为输入，你找到所有必要的包，不知何故有一个网页文件作为输出，所有的图片和数据来自该页面。谁能帮我从正确的方向出发吗。我想我需要dkpt和/或SCAPE。在

更新1:代码如下！这是我目前用Python编写的代码。假设它从单个HTTP会话获取第一组数据包，从SYN和ACK标志设置为1的数据包开始，以FIN标志设置为1的数据包结束。在

假设在包捕获过程中只有一个网站被访问，那么这个代码是否会附加所有必要的包来重建访问的网页？在

假设我有所有必要的包，我如何重建网页？在

import scaPy

pktList = list() #create a list to store the packets we want to keep
pcap = rdpcap('myCapture.pcap') #returns a packet list with every packet in the pcap
count = 0                       #will store the index of the syn-ack packet in pcap
for pkt in pcap:                #loops through packet list named pcap one packet at a time
    count = count + 1       #increments by 1
    if pkt[TCP].flags == 0x12 and pkt[TCP].sport == 80: #if it is a SYN-ACK packet session has been initiated as http
    break #breaks out of the for loop
currentPkt = count    #loop from here
while pcap[currentPkt].flags&0x01 != 0x01: #while the FIN bit is set to 0 keep loops stop when it is a 1 
    if pcap[currentPkt].sport == 80 and pcap[currentPkt].dport == pcap[count].dport and pcap[currentPkt].src == pcap[count].src and pcap[currentPkt].dst == pcap[count].dst:
            #if the src, dst ports and IP's are the same as the SYN-ACK packet then the http packets belong to this session and we want to keep them

        pktList.append(pcap[currentPkt])
#once the loop exits we have hit the packet with the FIN flag set and now we need to reconstruct the packets from this list.
        currentPkt = currentPkt + 1

Answer 1

这个python脚本将提取PCAP文件中所有未加密的HTTP网页，并将其输出为HTML文件。它使用scaPY处理各个包（另一个好的python模块是dpkt）。在

from scapy.all import *
from operator import *
import sys



def sorting(pcap):
    newerList = list()
        #remove everything not HTTP (anything not TCP or anything TCP and not HTTP (port 80)
    #count = 0 #dont need this it was for testing
    for x in pcap:
        if x.haslayer(TCP) and x.sport == 80 and bin(x[TCP].flags)!="0b10100": 
            newerList.append(x);
    newerList = sorted(newerList, key=itemgetter("IP.src","TCP.dport"))
    wrpcap("sorted.pcap", newerList)
    return newerList


def extract(pcap,num, count):
    listCounter = count
    counter = 0
    #print listCounter

    #Exit if we have reached the end of the the list of packets
    if count >= len(pcap):
        sys.exit()
    #Create a new file and find the packet with the payload containing the beginning HTML code and write it to file
    while listCounter != len(pcap):
        thisFile = "file" + str(num) + ".html"
        file = open(thisFile,"a")
        s = str(pcap[listCounter][TCP].payload)
        #print "S is: ", s
        x,y,z = s.partition("<")
        s = x + y + z #before was y+z
        if s.find("<html") != -1: 
            file.write(s)
            listCounter = listCounter + 1
            break
        listCounter = listCounter + 1

    #Continue to loop through packets and write their contents until we find the close HTML tag and 
    #include that packet as well
    counter = listCounter
    while counter != len(pcap):
        s =  str(pcap[counter][TCP].payload)
        if s.find("</html>") != -1:
            file.write(s)
            file.close
            break
        else:
            file.write(s)
            counter = counter + 1

    #Recursively call the function incrementing the file name by 1
    #and giving it the last spot in the PCAP we were in so we continue
    #at the next PCAP
    extract(pcap, num+1, counter)


if __name__ == "__main__":
    #Read in file from user
    f = raw_input("Please enter the name of your pcap file in this directory.  Example: myFile.pcap")
    pcapFile  = rdpcap(f)
    print "Filtering Pcap File of non HTTP Packets and then sorting packets"
    #Sort and Filter the PCAP
    pcapFile = sorting(pcapFile)
    print "Sorting Complete"
    print "Extracting Data"
    #Extract the Data
    extract(pcapFile,1,0)
    Print "Extracting Complete"

Answer 2

也许像tcpick -r your.pcap -wRS这样的东西可以帮你完成任务。在

• http://tcpick.sourceforge.net/?t=1&p=OPTIONS