github/bettercap
1
0
Fork 0
mirror of https://github.com/bettercap/bettercap synced 2025-08-19 04:59:25 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

new: new http auth parser

Browse source
This commit is contained in:
evilsocket 2018-02-11 06:40:30 +01:00
commit af9679ecc1
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
modules/net_sniff_http.go
View file

@ -12,6 +12,7 @@ import (
var httpRe = regexp.MustCompile("(?s).*(GET|HEAD|POST|PUT|DELETE|CONNECT|OPTIONS|TRACE|PATCH) (.+) HTTP/\\d\\.\\d.+Host: ([^\\s]+)") var httpRe = regexp.MustCompile("(?s).*(GET|HEAD|POST|PUT|DELETE|CONNECT|OPTIONS|TRACE|PATCH) (.+) HTTP/\\d\\.\\d.+Host: ([^\\s]+)")
var uaRe = regexp.MustCompile("(?s).*User-Agent: ([^\\n]+).+") var uaRe = regexp.MustCompile("(?s).*User-Agent: ([^\\n]+).+")
var authRe = regexp.MustCompile("(?s).*Authorization: ([^\\n]+).+")
func httpParser(ip *layers.IPv4, pkt gopacket.Packet, tcp *layers.TCP) bool { func httpParser(ip *layers.IPv4, pkt gopacket.Packet, tcp *layers.TCP) bool {
data := tcp.Payload data := tcp.Payload
@ -34,6 +35,13 @@ func httpParser(ip *layers.IPv4, pkt gopacket.Packet, tcp *layers.TCP) bool {
if len(mu) == 2 { if len(mu) == 2 {
ua = string(mu[1]) ua = string(mu[1])
} }
auth := ""
authDesc := ""
mauth := authRe.FindSubmatch(data)
if len(mauth) == 2 {
auth = string(mauth[1])
authDesc = fmt.Sprintf(" auth=%s", core.Red(auth))
}
url := fmt.Sprintf("%s", core.Yellow(hostname)) url := fmt.Sprintf("%s", core.Yellow(hostname))
if tcp.DstPort != 80 { if tcp.DstPort != 80 {
@ -51,13 +59,15 @@ func httpParser(ip *layers.IPv4, pkt gopacket.Packet, tcp *layers.TCP) bool {
"host": hostname, "host": hostname,
"path": url, "path": url,
"agent": ua, "agent": ua,
"auth": auth,
}, },
"%s %s %s %s %s", "%s %s %s %s %s%s",
core.W(core.BG_RED+core.FG_BLACK, "http"), core.W(core.BG_RED+core.FG_BLACK, "http"),
vIP(ip.SrcIP), vIP(ip.SrcIP),
core.W(core.BG_LBLUE+core.FG_BLACK, method), core.W(core.BG_LBLUE+core.FG_BLACK, method),
vURL(url), vURL(url),
core.Dim(ua), core.Dim(ua),
authDesc,
).Push() ).Push()
return true return true