Merge pull request #41 from dimorphic/feature/sniff-truncate-urls

[feature] net.sniff.http truncate urls option

modules/net_sniff.go

@@ -23,6 +23,10 @@ func NewSniffer(s *session.Session) *Sniffer {
 		Stats:         nil,
 	}
 
+	sniff.AddParam(session.NewBoolParameter("net.sniff.truncate",
+		"true",
+		"If true, will truncate long request URLs so user-agent fits on same line when possible, otherwise extra verbose / full URLs."))
+
 	sniff.AddParam(session.NewBoolParameter("net.sniff.verbose",
 		"true",
 		"If true, will print every captured packet, otherwise only selected ones."))
@@ -112,7 +116,7 @@ func (s Sniffer) isLocalPacket(packet gopacket.Packet) bool {
 }
 
 func (s *Sniffer) onPacketMatched(pkt gopacket.Packet) {
-	if mainParser(pkt, s.Ctx.Verbose) == true {
+	if mainParser(pkt, s.Ctx.Verbose, s.Ctx.Truncate) == true {
 		s.Stats.NumDumped++
 	}
 }

modules/net_sniff_context.go

@@ -16,6 +16,7 @@ import (
 type SnifferContext struct {
 	Handle       *pcap.Handle
 	DumpLocal    bool
+	Truncate     bool
 	Verbose      bool
 	Filter       string
 	Expression   string
@@ -42,6 +43,10 @@ func (s *Sniffer) GetContext() (error, *SnifferContext) {
 		return err, ctx
 	}
 
+	if err, ctx.Truncate = s.BoolParam("net.sniff.truncate"); err != nil {
+		return err, ctx
+	}
+
 	if err, ctx.Filter = s.StringParam("net.sniff.filter"); err != nil {
 		return err, ctx
 	} else if ctx.Filter != "" {
@@ -77,6 +82,7 @@ func NewSnifferContext() *SnifferContext {
 	return &SnifferContext{
 		Handle:       nil,
 		DumpLocal:    false,
+		Truncate:     true,
 		Verbose:      true,
 		Filter:       "",
 		Expression:   "",
@@ -99,6 +105,12 @@ func (c *SnifferContext) Log(sess *session.Session) {
 		log.Info("Skip local packets : %s", yes)
 	}
 
+	if c.Truncate {
+		log.Info("Truncate            : %s", yes)
+	} else {
+		log.Info("Truncate            : %s", no)
+	}
+
 	if c.Verbose {
 		log.Info("Verbose            : %s", yes)
 	} else {

modules/net_sniff_http.go

@@ -2,9 +2,9 @@ package modules
 
 import (
 	"fmt"
+	"regexp"
 
 	"github.com/evilsocket/bettercap-ng/core"
-	"regexp"
 
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
@@ -13,7 +13,12 @@ import (
 var httpRe = regexp.MustCompile("(?s).*(GET|HEAD|POST|PUT|DELETE|CONNECT|OPTIONS|TRACE|PATCH) (.+) HTTP/\\d\\.\\d.+Host: ([^\\s]+)")
 var uaRe = regexp.MustCompile("(?s).*User-Agent: ([^\\n]+).+")
 
-func httpParser(ip *layers.IPv4, pkt gopacket.Packet, tcp *layers.TCP) bool {
+func httpParser(
+	ip *layers.IPv4,
+	pkt gopacket.Packet,
+	tcp *layers.TCP,
+	truncateURLs bool,
+) bool {
 	data := tcp.Payload
 	dataSize := len(data)
 
@@ -41,6 +46,12 @@ func httpParser(ip *layers.IPv4, pkt gopacket.Packet, tcp *layers.TCP) bool {
 	}
 	url += fmt.Sprintf("%s", path)
 
+	// shorten / truncate long URLs if needed
+	formattedURL := string(url)
+	if truncateURLs {
+		formattedURL = vURL(url)
+	}
+
 	NewSnifferEvent(
 		pkt.Metadata().Timestamp,
 		"http",
@@ -57,7 +68,7 @@ func httpParser(ip *layers.IPv4, pkt gopacket.Packet, tcp *layers.TCP) bool {
 		core.W(core.BG_RED+core.FG_BLACK, "http"),
 		vIP(ip.SrcIP),
 		core.W(core.BG_LBLUE+core.FG_BLACK, method),
-		vURL(url),
+		formattedURL,
 		core.Dim(ua),
 	).Push()
 

modules/net_sniff_parsers.go

@@ -10,12 +10,17 @@ import (
 	"github.com/google/gopacket/layers"
 )
 
-func tcpParser(ip *layers.IPv4, pkt gopacket.Packet, verbose bool) {
+func tcpParser(
+	ip *layers.IPv4,
+	pkt gopacket.Packet,
+	verbose bool,
+	truncateURLs bool,
+) {
 	tcp := pkt.Layer(layers.LayerTypeTCP).(*layers.TCP)
 
 	if sniParser(ip, pkt, tcp) {
 		return
-	} else if httpParser(ip, pkt, tcp) {
+	} else if httpParser(ip, pkt, tcp, truncateURLs) {
 		return
 	}
 
@@ -88,7 +93,7 @@ func unkParser(ip *layers.IPv4, pkt gopacket.Packet, verbose bool) {
 	}
 }
 
-func mainParser(pkt gopacket.Packet, verbose bool) bool {
+func mainParser(pkt gopacket.Packet, verbose bool, truncateURLs bool) bool {
 	nlayer := pkt.NetworkLayer()
 	if nlayer == nil {
 		log.Debug("Missing network layer skipping packet.")
@@ -109,7 +114,7 @@ func mainParser(pkt gopacket.Packet, verbose bool) bool {
 	}
 
 	if tlayer.LayerType() == layers.LayerTypeTCP {
-		tcpParser(ip, pkt, verbose)
+		tcpParser(ip, pkt, verbose, truncateURLs)
 	} else if tlayer.LayerType() == layers.LayerTypeUDP {
 		udpParser(ip, pkt, verbose)
 	} else {

modules/net_sniff_sni.go

@@ -2,9 +2,9 @@ package modules
 
 import (
 	"fmt"
+	"regexp"
 
 	"github.com/evilsocket/bettercap-ng/core"
-	"regexp"
 
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
@@ -37,7 +37,7 @@ func sniParser(ip *layers.IPv4, pkt gopacket.Packet, tcp *layers.TCP) bool {
 		ip.SrcIP.String(),
 		domain,
 		SniffData{
-			"Domain": domain,
+			"host": domain,
 		},
 		"[%s] %s %s > %s",
 		vTime(pkt.Metadata().Timestamp),

modules/net_sniff_views.go

@@ -11,8 +11,10 @@ import (
 	"github.com/evilsocket/bettercap-ng/session"
 )
 
+const sniffTimeFormat = "2006-01-02 15:04:05"
+
 func vTime(t time.Time) string {
-	return t.Format("15:04:05")
+	return t.Format(sniffTimeFormat)
 }
 
 func vIP(ip net.IP) string {