fix: fixed various sniffer parsers

This commit is contained in:
evilsocket 2018-02-23 12:25:14 +01:00
parent c5baa7a077
commit b36bf4376c
7 changed files with 9 additions and 18 deletions

View file

@ -112,6 +112,8 @@ func (s EventsStream) viewSnifferEvent(e session.Event) {
misc += fmt.Sprintf(" \n %s:\n\n %s\n", core.Bold("Body"), string(b)) misc += fmt.Sprintf(" \n %s:\n\n %s\n", core.Bold("Body"), string(b))
} }
} }
} else if se.Data != nil {
misc = fmt.Sprintf("%s", se.Data)
} }
fmt.Printf("[%s] [%s] %s %s\n", fmt.Printf("[%s] [%s] %s %s\n",

View file

@ -39,10 +39,7 @@ func dnsParser(ip *layers.IPv4, pkt gopacket.Packet, udp *layers.UDP) bool {
"dns", "dns",
ip.SrcIP.String(), ip.SrcIP.String(),
ip.DstIP.String(), ip.DstIP.String(),
SniffData{ nil,
"Hostname": hostname,
"Addresses": ips,
},
"%s %s > %s : %s is %s", "%s %s > %s : %s is %s",
core.W(core.BG_DGRAY+core.FG_WHITE, "dns"), core.W(core.BG_DGRAY+core.FG_WHITE, "dns"),
vIP(ip.SrcIP), vIP(ip.SrcIP),

View file

@ -11,9 +11,7 @@ func dot11Parser(radiotap *layers.RadioTap, dot11 *layers.Dot11, pkt gopacket.Pa
"802.11", "802.11",
"-", "-",
"-", "-",
SniffData{ len(pkt.Data()),
"Size": len(pkt.Data()),
},
"%s %s proto=%d a1=%s a2=%s a3=%s a4=%s seqn=%d frag=%d", "%s %s proto=%d a1=%s a2=%s a3=%s a4=%s seqn=%d frag=%d",
dot11.Type, dot11.Type,
dot11.Flags, dot11.Flags,

View file

@ -14,8 +14,8 @@ type SnifferEvent struct {
Protocol string Protocol string
Source string Source string
Destination string Destination string
Data interface{}
Message string Message string
Data interface{}
} }
func NewSnifferEvent(t time.Time, proto string, src string, dst string, data interface{}, format string, args ...interface{}) SnifferEvent { func NewSnifferEvent(t time.Time, proto string, src string, dst string, data interface{}, format string, args ...interface{}) SnifferEvent {
@ -24,8 +24,8 @@ func NewSnifferEvent(t time.Time, proto string, src string, dst string, data int
Protocol: proto, Protocol: proto,
Source: src, Source: src,
Destination: dst, Destination: dst,
Data: data,
Message: fmt.Sprintf(format, args...), Message: fmt.Sprintf(format, args...),
Data: data,
} }
} }

View file

@ -27,9 +27,7 @@ func krb5Parser(ip *layers.IPv4, pkt gopacket.Packet, udp *layers.UDP) bool {
"krb5", "krb5",
ip.SrcIP.String(), ip.SrcIP.String(),
ip.DstIP.String(), ip.DstIP.String(),
SniffData{ nil,
"req": req,
},
"%s %s -> %s : %s", "%s %s -> %s : %s",
core.W(core.BG_RED+core.FG_BLACK, "krb-as-req"), core.W(core.BG_RED+core.FG_BLACK, "krb-as-req"),
vIP(ip.SrcIP), vIP(ip.SrcIP),

View file

@ -51,9 +51,7 @@ func ntlmParser(ip *layers.IPv4, pkt gopacket.Packet, tcp *layers.TCP) bool {
"ntlm.response", "ntlm.response",
ip.SrcIP.String(), ip.SrcIP.String(),
ip.DstIP.String(), ip.DstIP.String(),
SniffData{ nil,
"data": data,
},
"%s %s > %s | %s", "%s %s > %s | %s",
core.W(core.BG_DGRAY+core.FG_WHITE, "ntlm.response"), core.W(core.BG_DGRAY+core.FG_WHITE, "ntlm.response"),
vIP(ip.SrcIP), vIP(ip.SrcIP),

View file

@ -36,9 +36,7 @@ func sniParser(ip *layers.IPv4, pkt gopacket.Packet, tcp *layers.TCP) bool {
"https", "https",
ip.SrcIP.String(), ip.SrcIP.String(),
domain, domain,
SniffData{ nil,
"Domain": domain,
},
"%s %s > %s", "%s %s > %s",
core.W(core.BG_YELLOW+core.FG_WHITE, "sni"), core.W(core.BG_YELLOW+core.FG_WHITE, "sni"),
vIP(ip.SrcIP), vIP(ip.SrcIP),