github/bettercap
1
0
Fork 0
mirror of https://github.com/bettercap/bettercap synced 2025-08-14 10:46:57 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

new: net.sniff module is now able to capture WPA handshake from RadioTap packets.

Browse source
This commit is contained in:
evilsocket 2018-02-19 16:24:45 +01:00
commit 69248094c4
3 changed files with 82 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

3
modules/net_sniff_context.go
View file

@ -8,7 +8,6 @@ import (
"github.com/evilsocket/bettercap-ng/log"
"github.com/evilsocket/bettercap-ng/session"
"github.com/google/gopacket/layers"
"github.com/google/gopacket/pcap"
"github.com/google/gopacket/pcapgo"
)
@ -78,7 +77,7 @@ func (s *Sniffer) GetContext() (error, *SnifferContext) {
}
ctx.OutputWriter = pcapgo.NewWriter(ctx.OutputFile)
ctx.OutputWriter.WriteFileHeader(65536, layers.LinkTypeEthernet)
ctx.OutputWriter.WriteFileHeader(65536, ctx.Handle.LinkType())
}
return nil, ctx

78
modules/net_sniff_parsers.go
View file

@ -5,6 +5,7 @@ import (
"github.com/evilsocket/bettercap-ng/core"
"github.com/evilsocket/bettercap-ng/log"
"github.com/evilsocket/bettercap-ng/packets"
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
@ -85,33 +86,54 @@ func unkParser(ip *layers.IPv4, pkt gopacket.Packet, verbose bool) {
}
}
func mainParser(pkt gopacket.Packet, verbose bool) bool {
nlayer := pkt.NetworkLayer()
if nlayer == nil {
log.Debug("Missing network layer skipping packet.")
return false
func dot11Parser(radiotap *layers.RadioTap, dot11 *layers.Dot11, pkt gopacket.Packet, verbose bool) {
if verbose == true {
NewSnifferEvent(
pkt.Metadata().Timestamp,
"802.11",
"-",
"-",
SniffData{
"Size": len(pkt.Data()),
},
"%v",
dot11,
).Push()
}
if nlayer.LayerType() != layers.LayerTypeIPv4 {
log.Debug("Unexpected layer type %s, skipping packet.", nlayer.LayerType())
return false
}
ip := nlayer.(*layers.IPv4)
tlayer := pkt.TransportLayer()
if tlayer == nil {
log.Debug("Missing transport layer skipping packet.")
return false
}
if tlayer.LayerType() == layers.LayerTypeTCP {
tcpParser(ip, pkt, verbose)
} else if tlayer.LayerType() == layers.LayerTypeUDP {
udpParser(ip, pkt, verbose)
} else {
unkParser(ip, pkt, verbose)
}
return true
}
func mainParser(pkt gopacket.Packet, verbose bool) bool {
// simple networking sniffing mode?
nlayer := pkt.NetworkLayer()
if nlayer != nil {
if nlayer.LayerType() != layers.LayerTypeIPv4 {
log.Debug("Unexpected layer type %s, skipping packet.", nlayer.LayerType())
return false
}
ip := nlayer.(*layers.IPv4)
tlayer := pkt.TransportLayer()
if tlayer == nil {
log.Debug("Missing transport layer skipping packet.")
return false
}
if tlayer.LayerType() == layers.LayerTypeTCP {
tcpParser(ip, pkt, verbose)
} else if tlayer.LayerType() == layers.LayerTypeUDP {
udpParser(ip, pkt, verbose)
} else {
unkParser(ip, pkt, verbose)
}
return true
}
// are we sniffing in monitor mode?
if ok, radiotap, dot11 := packets.Dot11Parse(pkt); ok == true {
dot11Parser(radiotap, dot11, pkt, verbose)
return true
}
return false
}