HD Moore
5e74e80c89
git-svn-id: file:///home/svn/framework3/trunk@6899 4d416f70-5f16-0410-b530-b9f4589650da
46 lines
1.1 KiB
Ruby
46 lines
1.1 KiB
Ruby
# Sniffer class for GET URL's
|
|
class SnifferURL < BaseProtocolParser
|
|
def register_sigs
|
|
self.sigs = {
|
|
:get => /^GET\s+([^\n]+)\s+HTTP\/\d\.\d/si,
|
|
:host => /^Host\:\s+([^\n]+)/si
|
|
}
|
|
end
|
|
|
|
def parse(pkt)
|
|
# We want to return immediantly if we do not have a packet which is handled by us
|
|
return if not pkt[:tcp]
|
|
return if (pkt[:tcp].dst_port != 80)
|
|
|
|
# Ok it's a packet for us lets look fot the matching session
|
|
s = find_session("#{pkt[:ip].dst_ip}:#{pkt[:tcp].dst_port}-#{pkt[:ip].src_ip}:#{pkt[:tcp].src_port}","#{pkt[:ip].dst_ip}")
|
|
|
|
self.sigs.each_key do |k|
|
|
|
|
# There is only one pattern per run to test
|
|
matched = nil
|
|
matches = nil
|
|
|
|
if(pkt[:tcp].payload_data =~ self.sigs[k])
|
|
matched = k
|
|
matches = $1
|
|
end
|
|
|
|
case matched
|
|
when :host
|
|
if(s[:get])
|
|
print "-> Get request sniffed: #{s[:host]}#{s[:get]}\n"
|
|
sessions.delete(s[:session])
|
|
return
|
|
end
|
|
when nil
|
|
# No matches, no saved state
|
|
else
|
|
sessions[s[:session]].merge!({k => matches})
|
|
end # end case matched
|
|
|
|
end # end of each_key
|
|
|
|
end # end of parse
|
|
end # end of URL sniffer
|