new: new events.stream.http.request.dump and events.stream.http.response.dump parameters to enable or disable http dumps

This commit is contained in:
evilsocket 2018-09-29 12:32:11 +02:00
commit 4a6d429bf8
2 changed files with 23 additions and 22 deletions

View file

@ -19,6 +19,8 @@ type EventsStream struct {
waitChan chan *session.Event waitChan chan *session.Event
eventListener <-chan session.Event eventListener <-chan session.Event
quit chan bool quit chan bool
dumpHttpReqs bool
dumpHttpResp bool
} }
func NewEventsStream(s *session.Session) *EventsStream { func NewEventsStream(s *session.Session) *EventsStream {
@ -112,6 +114,14 @@ func NewEventsStream(s *session.Session) *EventsStream {
"", "",
"If not empty, events will be written to this file instead of the standard output.")) "If not empty, events will be written to this file instead of the standard output."))
stream.AddParam(session.NewBoolParameter("events.stream.http.request.dump",
"false",
"If true all HTTP requests will be dumped."))
stream.AddParam(session.NewBoolParameter("events.stream.http.response.dump",
"false",
"If true all HTTP responses will be dumped."))
return stream return stream
} }
@ -136,6 +146,10 @@ func (s *EventsStream) Configure() (err error) {
} else if output, err = core.ExpandPath(output); err == nil { } else if output, err = core.ExpandPath(output); err == nil {
s.output, err = os.OpenFile(output, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644) s.output, err = os.OpenFile(output, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
} }
} else if err, s.dumpHttpReqs = s.BoolParam("events.stream.http.request.dump"); err != nil {
return err
} else if err, s.dumpHttpResp = s.BoolParam("events.stream.http.response.dump"); err != nil {
return err
} }
return err return err

View file

@ -15,49 +15,37 @@ import (
) )
var ( var (
cookieFilter = map[string]bool{
"__cfduid": true,
"_ga": true,
"_gat": true,
}
reJsonKey = regexp.MustCompile(`("[^"]+"):`) reJsonKey = regexp.MustCompile(`("[^"]+"):`)
) )
func (s *EventsStream) shouldDumpHttpRequest(req HTTPRequest) bool { func (s *EventsStream) shouldDumpHttpRequest(req HTTPRequest) bool {
// dump if it's not just a GET if s.dumpHttpReqs {
if req.Method != "GET" { // dump all
return true
} else if req.Method != "GET" {
// dump if it's not just a GET
return true return true
} }
// search for interesting headers and cookies // search for interesting headers and cookies
for name, values := range req.Headers { for name, _ := range req.Headers {
headerName := strings.ToLower(name) headerName := strings.ToLower(name)
if strings.Contains(headerName, "auth") || strings.Contains(headerName, "token") { if strings.Contains(headerName, "auth") || strings.Contains(headerName, "token") {
return true return true
} else if headerName == "cookie" {
for _, value := range values {
cookies := strings.Split(value, ";")
for _, cookie := range cookies {
parts := strings.Split(cookie, "=")
if _, found := cookieFilter[parts[0]]; found == false {
return true
}
}
}
} }
} }
return false return false
} }
func (s *EventsStream) shouldDumpHttpResponse(res HTTPResponse) bool { func (s *EventsStream) shouldDumpHttpResponse(res HTTPResponse) bool {
if strings.Contains(res.ContentType, "text/plain") { if s.dumpHttpResp {
return true
} else if strings.Contains(res.ContentType, "text/plain") {
return true return true
} else if strings.Contains(res.ContentType, "application/json") { } else if strings.Contains(res.ContentType, "application/json") {
return true return true
} else if strings.Contains(res.ContentType, "text/xml") { } else if strings.Contains(res.ContentType, "text/xml") {
return true return true
} }
// search for interesting headers // search for interesting headers
for name, _ := range res.Headers { for name, _ := range res.Headers {
headerName := strings.ToLower(name) headerName := strings.ToLower(name)
@ -65,7 +53,6 @@ func (s *EventsStream) shouldDumpHttpResponse(res HTTPResponse) bool {
return true return true
} }
} }
return false return false
} }