github/bettercap
1
0
Fork 0
mirror of https://github.com/bettercap/bettercap synced 2025-08-14 02:36:57 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

new: net.sniff now supports ipv6

Browse source
This commit is contained in:
Simone Margaritelli 2021-04-03 19:20:12 +02:00
commit cbc1432358
13 changed files with 122 additions and 83 deletions
Download patch file Download diff file Expand all files Collapse all files

20
modules/net_sniff/net_sniff_tcp.go
View file

@ -2,6 +2,7 @@ package net_sniff
import (
"fmt"
"net"
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
@ -9,7 +10,7 @@ import (
"github.com/evilsocket/islazy/tui"
)
var tcpParsers = []func(*layers.IPv4, gopacket.Packet, *layers.TCP) bool{
var tcpParsers = []func(net.IP, net.IP, []byte, gopacket.Packet, *layers.TCP) bool{
sniParser,
ntlmParser,
httpParser,
@ -17,30 +18,31 @@ var tcpParsers = []func(*layers.IPv4, gopacket.Packet, *layers.TCP) bool{
teamViewerParser,
}
func onTCP(ip *layers.IPv4, pkt gopacket.Packet, verbose bool) {
func onTCP(srcIP, dstIP net.IP, payload []byte, pkt gopacket.Packet, verbose bool) {
tcp := pkt.Layer(layers.LayerTypeTCP).(*layers.TCP)
for _, parser := range tcpParsers {
if parser(ip, pkt, tcp) {
if parser(srcIP, dstIP, payload, pkt, tcp) {
return
}
}
if verbose {
sz := len(payload)
NewSnifferEvent(
pkt.Metadata().Timestamp,
"tcp",
fmt.Sprintf("%s:%s", ip.SrcIP, vPort(tcp.SrcPort)),
fmt.Sprintf("%s:%s", ip.DstIP, vPort(tcp.DstPort)),
fmt.Sprintf("%s:%s", srcIP, vPort(tcp.SrcPort)),
fmt.Sprintf("%s:%s", dstIP, vPort(tcp.DstPort)),
SniffData{
"Size": len(ip.Payload),
"Size": len(payload),
},
"%s %s:%s > %s:%s %s",
tui.Wrap(tui.BACKLIGHTBLUE+tui.FOREBLACK, "tcp"),
vIP(ip.SrcIP),
vIP(srcIP),
vPort(tcp.SrcPort),
vIP(ip.DstIP),
vIP(dstIP),
vPort(tcp.DstPort),
tui.Dim(fmt.Sprintf("%d bytes", len(ip.Payload))),
tui.Dim(fmt.Sprintf("%d bytes", sz)),
).Push()
}
}