def smtp_creds(pcap):
    strings = []
    output = []
    try:
        pkts = rdpcap(pcap)
        for p in pkts:
            if p.haslayer(TCP) and p.haslayer(Raw) and p.getlayer(TCP).dport == 25:
                load = p[Raw].load
                if load not in strings:
                    strings.append(load)
                else:
                    pass
            else:
                pass
    except Exception as e:
        error_logging(str(e), 'SMTP Creds')

    for s in strings:
        t = decode_base64(s)
        if t is not None:
            c = check_ascii(t)
            if c is not None and len(c) > 3:
                output.append(c)
            else:
                pass
        else:
            pass

    return output
Example #2
0
def smtp_creds(pcap):
    strings = []
    output = []
    try:
        pkts = rdpcap(pcap)
        for p in pkts:
            if p.haslayer(TCP) and p.haslayer(Raw) and p.getlayer(
                    TCP).dport == 25:
                load = p[Raw].load
                if load not in strings:
                    strings.append(load)
                else:
                    pass
            else:
                pass
    except Exception as e:
        error_logging(str(e), 'SMTP Creds')

    for s in strings:
        t = decode_base64(s)
        if t is not None:
            c = check_ascii(t)
            if c is not None and len(c) > 3:
                output.append(c)
            else:
                pass
        else:
            pass

    return output
def find_layers(pkts, pcap, pcap_id, streamid):
    packet = OrderedDict()
    count = 1
    pcap_id = pcap_id.encode('utf-8')
    streamid = streamid.encode('utf-8')
    try:
        for p in pkts:
            header = {"Buffer": {"timestamp": datetime.datetime.fromtimestamp(p.time).strftime('%Y-%m-%d %H:%M:%S.%f'),
                                 "packetnumber": count, "PCAP ID": pcap_id, "pcapfile": pcap, "StreamID": streamid}}
            packet.update(header)
            counter = 0
            while True:
                layer = p.getlayer(counter)
                if layer != None:
                    i = int(counter)
                    x = p[0][i].fields
                    t = exclude_layers(x, layer.name)
                    s = rename_layer(t, layer.name)
                    v = '{"' + layer.name.replace('.', '_') + '[' + str(i) + ']' + '":' + str(s) + '}'
                    s = eval(v)
                    try:
                        del s['HTTP[3]']
                        del s['HTTP[5]']
                    except KeyError:
                        pass
                    packet.update(s)
                else:
                    break
                counter += 1
            count += 1
            yield packet
            packet.clear()
    except Exception as e:
        error_logging(str(e), 'PacketParser')
        pass