Example #1
0
 def getfield(self, pkt, s):
     """
     this method will get the packet, takes what does need to be
     taken and let the remaining go, so it returns two values.
     first value which belongs to this field and the second is
     the remaining which does need to be dissected with
     other "field classes".
     @param pkt: holds the whole packet
     @param s: holds only the remaining data which is not dissected yet.
     """
     cstream = -1
     if pkt.underlayer.name == "TCP":
         cstream = dissector.check_stream(\
         pkt.underlayer.underlayer.fields["src"],\
          pkt.underlayer.underlayer.fields["dst"],\
           pkt.underlayer.fields["sport"],\
            pkt.underlayer.fields["dport"],\
             pkt.underlayer.fields["seq"], s)
     if not cstream == -1:
         s = cstream
     remain = ""
     value = ""
     ls = s.splitlines(True)
     f = ls[0].split()
     if "SIP" in f[0]:
         ls = s.splitlines(True)
         f = ls[0].split()
         length = len(f)
         value = ""
         if length == 3:
             value = "SIP-Version:" + f[0] + ", Status-Code:" +\
             f[1] + ", Reason-Phrase:" + f[2]
             ls.remove(ls[0])
             for element in ls:
                 remain = remain + element
         else:
             value = ls[0]
             ls.remove(ls[0])
             for element in ls:
                 remain = remain + element
         return remain, value
     elif "SIP" in f[2]:
         ls = s.splitlines(True)
         f = ls[0].split()
         length = len(f)
         value = []
         if length == 3:
             value = "Method:" + f[0] + ", Request-URI:" +\
             f[1] + ", SIP-Version:" + f[2]
             ls.remove(ls[0])
             for element in ls:
                 remain = remain + element
         else:
             value = ls[0]
             ls.remove(ls[0])
             for element in ls:
                 remain = remain + element
         return remain, value
     else:
         return s, ""
Example #2
0
 def getfield(self, pkt, s):
     """
     this method will get the packet, takes what does need to be
     taken and let the remaining go, so it returns two values.
     first value which belongs to this field and the second is
     the remaining which does need to be dissected with
     other "field classes".
     @param pkt: holds the whole packet
     @param s: holds only the remaining data which is not dissected yet.
     """
     cstream = -1
     if pkt.underlayer.name == "TCP":
         cstream = dissector.check_stream(\
         pkt.underlayer.underlayer.fields["src"],\
          pkt.underlayer.underlayer.fields["dst"],\
           pkt.underlayer.fields["sport"],\
            pkt.underlayer.fields["dport"],\
             pkt.underlayer.fields["seq"], s)
     if not cstream == -1:
         s = cstream
     remain = ""
     value = ""
     ls = s.splitlines(True)
     f = ls[0].split()
     if "SIP" in f[0]:
         ls = s.splitlines(True)
         f = ls[0].split()
         length = len(f)
         value = ""
         if length == 3:
             value = "SIP-Version:" + f[0] + ", Status-Code:" +\
             f[1] + ", Reason-Phrase:" + f[2]
             ls.remove(ls[0])
             for element in ls:
                 remain = remain + element
         else:
             value = ls[0]
             ls.remove(ls[0])
             for element in ls:
                 remain = remain + element
         return remain, value
     elif "SIP" in f[2]:
         ls = s.splitlines(True)
         f = ls[0].split()
         length = len(f)
         value = []
         if length == 3:
             value = "Method:" + f[0] + ", Request-URI:" +\
             f[1] + ", SIP-Version:" + f[2]
             ls.remove(ls[0])
             for element in ls:
                 remain = remain + element
         else:
             value = ls[0]
             ls.remove(ls[0])
             for element in ls:
                 remain = remain + element
         return remain, value
     else:
         return s, ""
Example #3
0
    def getfield(self, pkt, s):
        """
        this method will get the packet, takes what does need to be
        taken and let the remaining go, so it returns two values.
        first value which belongs to this field and the second is
        the remaining which does need to be dissected with
        other "field classes".
        @param pkt: holds the whole packet
        @param s: holds only the remaining data which is not dissected yet.
        """
        cstream = -1
        if pkt.underlayer.name == "TCP":
            cstream = dissector.check_stream(\
            pkt.underlayer.underlayer.fields["src"],\
             pkt.underlayer.underlayer.fields["dst"],\
              pkt.underlayer.fields["sport"],\
               pkt.underlayer.fields["dport"],\
                pkt.underlayer.fields["seq"], s)
        if not cstream == -1:
            s = cstream
        remain = ""
        value = ""
        ls = s.splitlines()
        length = len(ls)
        if length == 1:
            value = ls[0]
            arguments = ""
            first = True
            res = value.split(" ")
            for arg in res:
                if not first:
                    arguments = arguments + arg + " "
                first = False
            if "-" in res[0]:
                value = "(" + res[0][:3] + ") " +\
                 self.get_code_msg(res[0][:3]) + " " + res[0][3:]
            else:
                value = "(" + res[0] + ") " + self.get_code_msg(res[0])
            return arguments[:-1], [value]

        if length > 1:
            reponses = []
            for element in ls:
                element = element.split(" ")
                arguments = ""
                first = True
                for arg in element:
                    if not first:
                        arguments = arguments + arg + " "
                    first = False
                if "-" in element[0]:
                    reponses.append(["(" + element[0][:3] + ") " +
                                      self.get_code_msg(element[0][:3]) +
                                       " " + element[0][3:], arguments[:-1]])
                else:
                    reponses.append(["(" + element[0] + ") " +
                                      self.get_code_msg(element[0][:-1]),
                                       arguments])
            return "", reponses
        return "", ""
Example #4
0
    def getfield(self, pkt, s):
        """
        this method will get the packet, takes what does need to be
        taken and let the remaining go, so it returns two values.
        first value which belongs to this field and the second is
        the remaining which does need to be dissected with
        other "field classes".
        @param pkt: holds the whole packet
        @param s: holds only the remaining data which is not dissected yet.
        """
        cstream = -1
        if pkt.underlayer.name == "TCP":
            cstream = dissector.check_stream(\
            pkt.underlayer.underlayer.fields["src"],\
             pkt.underlayer.underlayer.fields["dst"],\
              pkt.underlayer.fields["sport"],\
               pkt.underlayer.fields["dport"],\
                pkt.underlayer.fields["seq"], s)
        if not cstream == -1:
            s = cstream
        remain = ""
        value = ""
        ls = s.split()
        length = len(ls)
        if ls[0].upper() == "DATA":
            bind(pkt.underlayer.underlayer.fields["src"],
                 pkt.underlayer.underlayer.fields["dst"],
                 pkt.underlayer.fields["sport"])
            return "", "DATA"
        if ls[0].upper() == "QUIT":
            unbind(pkt.underlayer.underlayer.fields["src"],
                   pkt.underlayer.underlayer.fields["dst"],
                   pkt.underlayer.fields["sport"])
            return "", "QUIT"
        if is_bounded(pkt.underlayer.underlayer.fields["src"],
                     pkt.underlayer.underlayer.fields["dst"],
                     pkt.underlayer.fields["sport"]):
            set_tcp_ip(pkt.underlayer.underlayer.fields["src"],
                     pkt.underlayer.underlayer.fields["dst"],
                     pkt.underlayer.fields["sport"],\
                      pkt.underlayer.fields["dport"],\
                       pkt.underlayer.fields["seq"])
            smtpd = SMTPData(s).fields["data"]
            return "", ["DATA", smtpd]

        if length > 1:
            value = ls[0]
            if length == 2:
                remain = ls[1]
                return remain, value
            else:
                i = 1
                remain = ' '
                while i < length:
                    remain = remain + ls[i] + ' '
                    i = i + 1
                return remain[:-1], value
        else:
            return "", ls[0]
Example #5
0
    def getfield(self, pkt, s):
        """
        this method will get the packet, takes what does need to be
        taken and let the remaining go, so it returns two values.
        first value which belongs to this field and the second is
        the remaining which does need to be dissected with
        other "field classes".
        @param pkt: holds the whole packet
        @param s: holds only the remaining data which is not dissected yet.
        """
        cstream = -1
        if pkt.underlayer.name == "TCP":
            cstream = dissector.check_stream(\
            pkt.underlayer.underlayer.fields["src"],\
             pkt.underlayer.underlayer.fields["dst"],\
              pkt.underlayer.fields["sport"],\
               pkt.underlayer.fields["dport"],\
                pkt.underlayer.fields["seq"], s)
        if not cstream == -1:
            s = cstream
        remain = ""
        value = ""
        ls = s.split()
        length = len(ls)
        if ls[0].upper() == "DATA":
            bind(pkt.underlayer.underlayer.fields["src"],
                 pkt.underlayer.underlayer.fields["dst"],
                 pkt.underlayer.fields["sport"])
            return "", "DATA"
        if ls[0].upper() == "QUIT":
            unbind(pkt.underlayer.underlayer.fields["src"],
                   pkt.underlayer.underlayer.fields["dst"],
                   pkt.underlayer.fields["sport"])
            return "", "QUIT"
        if is_bounded(pkt.underlayer.underlayer.fields["src"],
                      pkt.underlayer.underlayer.fields["dst"],
                      pkt.underlayer.fields["sport"]):
            set_tcp_ip(pkt.underlayer.underlayer.fields["src"],
                     pkt.underlayer.underlayer.fields["dst"],
                     pkt.underlayer.fields["sport"],\
                      pkt.underlayer.fields["dport"],\
                       pkt.underlayer.fields["seq"])
            smtpd = SMTPData(s).fields["data"]
            return "", ["DATA", smtpd]

        if length > 1:
            value = ls[0]
            if length == 2:
                remain = ls[1]
                return remain, value
            else:
                i = 1
                remain = ' '
                while i < length:
                    remain = remain + ls[i] + ' '
                    i = i + 1
                return remain[:-1], value
        else:
            return "", ls[0]
Example #6
0
    def getfield(self, pkt, s):
        """
        this method will get the packet, takes what does need to be
        taken and let the remaining go, so it returns two values.
        first value which belongs to this field and the second is
        the remaining which does need to be dissected with
        other "field classes".
        @param pkt: holds the whole packet
        @param s: holds only the remaining data which is not dissected yet.
        """
        cstream = -1
        if pkt.underlayer.name == "TCP":
            cstream = dissector.check_stream(
                pkt.underlayer.underlayer.fields["src"],
                pkt.underlayer.underlayer.fields["dst"],
                pkt.underlayer.fields["sport"],
                pkt.underlayer.fields["dport"],
                pkt.underlayer.fields["seq"],
                s,
            )
        if not cstream == -1:
            s = cstream
        self.myresult = ""
        subOptions = False
        resultlist = []
        firstb = struct.unpack(self.fmt, s[0])[0]
        if firstb != 255:
            self.myresult = ""
            for c in s:
                self.myresult = self.myresult + base64.standard_b64encode(c)
            return "", "data " + self.myresult

        for c in s:
            ustruct = struct.unpack(self.fmt, c)
            command = self.get_code_msg(ustruct[0])
            if command == "SB ":
                subOptions = True
                self.myresult = self.myresult + "SB "
                continue
            if command == "SE ":
                subOptions = False
                self.myresult = self.myresult = self.myresult + "SE "
                continue
            if subOptions:
                self.myresult = self.myresult + "subop(" + str(ustruct[0]) + ") "
                continue
            else:
                self.myresult = self.myresult + command
        comlist = self.myresult.split("Command ")
        for element in comlist:
            if element != "":
                resultlist.append(("command", element))
        # return  "", resultlist
        return "", self.myresult
Example #7
0
    def getfield(self, pkt, s):
        """
        this method will get the packet, takes what does need to be
        taken and let the remaining go, so it returns two values.
        first value which belongs to this field and the second is
        the remaining which does need to be dissected with
        other "field classes".
        @param pkt: holds the whole packet
        @param s: holds only the remaining data which is not dissected yet.
        """
        cstream = -1
        if pkt.underlayer.name == "TCP":
            cstream = dissector.check_stream(\
                    pkt.underlayer.underlayer.fields["src"],\
                     pkt.underlayer.underlayer.fields["dst"],\
                      pkt.underlayer.fields["sport"],\
                       pkt.underlayer.fields["dport"],\
                        pkt.underlayer.fields["seq"], s)
        if not cstream == -1:
            s = cstream
        self.myresult = ""
        subOptions = False
        resultlist = []
        firstb = struct.unpack(self.fmt, s[0])[0]
        if firstb != 255:
            self.myresult = ""
            for c in s:
                self.myresult = self.myresult + base64.standard_b64encode(c)
            return "", "data " + self.myresult

        for c in s:
            ustruct = struct.unpack(self.fmt, c)
            command = self.get_code_msg(ustruct[0])
            if command == "SB ":
                subOptions = True
                self.myresult = self.myresult + "SB "
                continue
            if command == "SE ":
                subOptions = False
                self.myresult = self.myresult = self.myresult + "SE "
                continue
            if subOptions:
                self.myresult = self.myresult +\
                 "subop(" + str(ustruct[0]) + ") "
                continue
            else:
                self.myresult = self.myresult + command
        comlist = self.myresult.split("Command ")
        for element in comlist:
            if element != "":
                resultlist.append(("command", element))
        #return  "", resultlist
        return "", self.myresult
Example #8
0
 def getfield(self, pkt, s):
     """
     this method will get the packet, takes what does need to be
     taken and let the remaining go, so it returns two values.
     first value which belongs to this field and the second is
     the remaining which does need to be dissected with
     other "field classes".
     @param pkt: holds the whole packet
     @param s: holds only the remaining data which is not dissected yet.
     """
     cstream = -1
     if pkt.underlayer.name == "TCP":
         cstream = dissector.check_stream(\
         pkt.underlayer.underlayer.fields["src"],\
          pkt.underlayer.underlayer.fields["dst"],\
           pkt.underlayer.fields["sport"],\
            pkt.underlayer.fields["dport"],\
             pkt.underlayer.fields["seq"], s)
     if not cstream == -1:
         s = cstream
     remain = ""
     value = ""
     ls = s.splitlines()
     myresult = []
     lslen = len(ls)
     i = 0
     k = 0
     for line in ls:
         k = k + 1
         ls2 = line.split()
         length = len(ls2)
         if length > 1:
             value = ls2[0]
             c = 1
             remain = ""
             while c < length:
                 remain = remain + ls2[c] + " "
                 c = c + 1
             if self.name.startswith("request"):
                 myresult = myresult + "Request Command: " + value +\
                 ", Request Parameter(s): " + remain
                 if k < lslen:
                     myresult = myresult + " | "
             if self.name.startswith("response"):
                 myresult = myresult + "Response Indicator: " + value +\
                 ", Response Parameter(s): " + remain
                 if k < lslen:
                     myresult = myresult + " | "
         i = i + 1
         if i == lslen:
             return "", myresult
Example #9
0
 def getfield(self, pkt, s):
     """
     this method will get the packet, takes what does need to be
     taken and let the remaining go, so it returns two values.
     first value which belongs to this field and the second is
     the remaining which does need to be dissected with
     other "field classes".
     @param pkt: holds the whole packet
     @param s: holds only the remaining data which is not dissected yet.
     """
     cstream = -1
     if pkt.underlayer.name == "TCP":
         cstream = dissector.check_stream(
             pkt.underlayer.underlayer.fields["src"],
             pkt.underlayer.underlayer.fields["dst"],
             pkt.underlayer.fields["sport"],
             pkt.underlayer.fields["dport"],
             pkt.underlayer.fields["seq"],
             s,
         )
     if not cstream == -1:
         s = cstream
     remain = ""
     value = ""
     ls = s.split()
     length = len(ls)
     if length > 1:
         value = "command: " + ls[0] + ","
         if length == 2:
             remain = ls[1]
             value = value + " Parameters: " + remain
             return "", value
         else:
             i = 1
             remain = ""
             while i < length:
                 if i != 1:
                     remain = remain + " " + ls[i]
                 else:
                     remain = remain + ls[i]
                 i = i + 1
             value = value + " Parameters: " + remain
             return "", value
     else:
         return "", ls[0]
Example #10
0
 def getfield(self, pkt, s):
     """
     this method will get the packet, takes what does need to be
     taken and let the remaining go, so it returns two values.
     first value which belongs to this field and the second is
     the remaining which does need to be dissected with
     other "field classes".
     @param pkt: holds the whole packet
     @param s: holds only the remaining data which is not dissected yet.
     """
     cstream = -1
     if pkt.underlayer.name == "TCP":
         cstream = dissector.check_stream(\
         pkt.underlayer.underlayer.fields["src"],\
          pkt.underlayer.underlayer.fields["dst"],\
           pkt.underlayer.fields["sport"], pkt.underlayer.fields["dport"],\
            pkt.underlayer.fields["seq"], s)
     if not cstream == -1:
         s = cstream
     if pkt.underlayer.name == "TCP" and cstream == -1:
         return "", ""
     remain = ""
     value = ""
     if self.name == "request-line: ":
         ls = s.splitlines(True)
         f = ls[0].split()
         length = len(f)
         if length == 3:
             value = "Method:" + f[0] + ", Request-URI:" +\
                     f[1] + ", HTTP-Version:" + f[2]
             HTTPMethodsRFC2616 = ['get','post','options','head','put','delete','trace','connect']
             #HTTP methods as per rfc2616 http://www.ietf.org/rfc/rfc2616
             #There are other methods in other RFCs but nobody cares about those.
             if f[0].lower() in HTTPMethodsRFC2616:
                 add_file(pkt.underlayer.underlayer.fields["src"],\
                           pkt.underlayer.underlayer.fields["dst"],\
                            pkt.underlayer.fields["sport"],\
                             pkt.underlayer.fields["dport"], f[1],\
                              pkt.underlayer.fields["seq"] + len(s))
             ls.remove(ls[0])
             for element in ls:
                 remain = remain + element
             return remain, value
         return s, ""
Example #11
0
 def getfield(self, pkt, s):
     """
     this method will get the packet, takes what does need to be
     taken and let the remaining go, so it returns two values.
     first value which belongs to this field and the second is
     the remaining which does need to be dissected with
     other "field classes".
     @param pkt: holds the whole packet
     @param s: holds only the remaining data which is not dissected yet.
     """
     cstream = -1
     if pkt.underlayer.name == "TCP":
         cstream = dissector.check_stream(\
                     pkt.underlayer.underlayer.fields["src"],\
                      pkt.underlayer.underlayer.fields["dst"],\
                       pkt.underlayer.fields["sport"],\
                        pkt.underlayer.fields["dport"],\
                         pkt.underlayer.fields["seq"], s)
     if not cstream == -1:
         s = cstream
     remain = ""
     value = ""
     ls = s.split()
     length = len(ls)
     if length > 1:
         value = "command: " + ls[0] + ","
         if length == 2:
             remain = ls[1]
             value = value + " Parameters: " + remain
             return "", value
         else:
             i = 1
             remain = ""
             while i < length:
                 if i != 1:
                     remain = remain + " " + ls[i]
                 else:
                     remain = remain + ls[i]
                 i = i + 1
             value = value + " Parameters: " + remain
             return "", value
     else:
         return "", ls[0]
Example #12
0
 def getfield(self, pkt, s):
     """
     this method will get the packet, takes what does need to be
     taken and let the remaining go, so it returns two values.
     first value which belongs to this field and the second is
     the remaining which does need to be dissected with
     other "field classes".
     @param pkt: holds the whole packet
     @param s: holds only the remaining data which is not dissected yet.
     """
     cstream = -1
     if pkt.underlayer.name == "TCP":
         cstream = dissector.check_stream(
             pkt.underlayer.underlayer.fields["src"],
             pkt.underlayer.underlayer.fields["dst"],
             pkt.underlayer.fields["sport"],
             pkt.underlayer.fields["dport"],
             pkt.underlayer.fields["seq"],
             s,
         )
     if not cstream == -1:
         s = cstream
     value = ""
     ls = s.split("\r\n")
     length = len(ls)
     if length == 1:
         return "", value
     elif length > 1:
         value = ""
         value = value + "response: " + ls[0]
         i = 1
         while i < length - 1:
             value = value + " response: " + ls[i]
             if i < length - 2:
                 value = value + " | "
             i = i + 1
         return "", value
     else:
         return "", ""
Example #13
0
 def getfield(self, pkt, s):
     cstream = -1
     if pkt.underlayer.name == "TCP":
         cstream = dissector.check_stream(\
         pkt.underlayer.underlayer.fields["src"],\
          pkt.underlayer.underlayer.fields["dst"],\
           pkt.underlayer.fields["sport"],\
            pkt.underlayer.fields["dport"],\
             pkt.underlayer.fields["seq"], s)
     if not cstream == -1:
         s = cstream
     if pkt.underlayer.name == "TCP" and cstream == -1:
         return "", ""
     name = get_file()
     if not dissector.Dissector.default_download_folder_changed:
         cwd = os.getcwd() + "/downloaded/"
         try:
             os.mkdir("downloaded")
         except:
             None
         f = open(cwd + clean_file_name(name, cwd), "wb")
     else:
         f = open(dissector.Dissector.path +\
          clean_file_name(name, dissector.Dissector.path), "wb")
     f.write(s)
     f.close()
     self.myresult = ""
     firstb = struct.unpack(self.fmt, s[0])[0]
     self.myresult = ""
     for c in s:
         ustruct = struct.unpack(self.fmt, c)
         byte = base64.standard_b64encode(str(ustruct[0]))
         self.myresult = self.myresult + byte
     if not is_created_session(pkt.underlayer.underlayer.fields["src"],
                             pkt.underlayer.underlayer.fields["dst"],
                             pkt.underlayer.fields["sport"]):
         return self.myresult, ""
     return "", self.myresult
Example #14
0
 def getfield(self, pkt, s):
     cstream = -1
     if pkt.underlayer.name == "TCP":
         cstream = dissector.check_stream(\
         pkt.underlayer.underlayer.fields["src"],\
          pkt.underlayer.underlayer.fields["dst"],\
           pkt.underlayer.fields["sport"],\
            pkt.underlayer.fields["dport"],\
             pkt.underlayer.fields["seq"], s)
     if not cstream == -1:
         s = cstream
     if pkt.underlayer.name == "TCP" and cstream == -1:
         return "", ""
     name = get_file()
     if not dissector.Dissector.default_download_folder_changed:
         cwd = os.getcwd() + "/downloaded/"
         try:
             os.mkdir("downloaded")
         except:
             None
         f = open(cwd + clean_file_name(name, cwd), "wb")
     else:
         f = open(dissector.Dissector.path +\
          clean_file_name(name, dissector.Dissector.path), "wb")
     f.write(s)
     f.close()
     self.myresult = ""
     firstb = struct.unpack(self.fmt, s[0])[0]
     self.myresult = ""
     for c in s:
         ustruct = struct.unpack(self.fmt, c)
         byte = base64.standard_b64encode(str(ustruct[0]))
         self.myresult = self.myresult + byte
     if not is_created_session(pkt.underlayer.underlayer.fields["src"],
                               pkt.underlayer.underlayer.fields["dst"],
                               pkt.underlayer.fields["sport"]):
         return self.myresult, ""
     return "", self.myresult
Example #15
0
 def getfield(self, pkt, s):
     """
     this method will get the packet, takes what does need to be
     taken and let the remaining go, so it returns two values.
     first value which belongs to this field and the second is
     the remaining which does need to be dissected with
     other "field classes".
     @param pkt: holds the whole packet
     @param s: holds only the remaining data which is not dissected yet.
     """
     cstream = -1
     if pkt.underlayer.name == "TCP":
         cstream = dissector.check_stream(\
                     pkt.underlayer.underlayer.fields["src"],\
                      pkt.underlayer.underlayer.fields["dst"],\
                       pkt.underlayer.fields["sport"],\
                        pkt.underlayer.fields["dport"],\
                         pkt.underlayer.fields["seq"], s)
     if not cstream == -1:
         s = cstream
     value = ""
     ls = s.split("\r\n")
     length = len(ls)
     if length == 1:
         return "", value
     elif length > 1:
         value = ""
         value = value + "response: " + ls[0]
         i = 1
         while i < length - 1:
             value = value + " response: " + ls[i]
             if i < length - 2:
                 value = value + " | "
             i = i + 1
         return "", value
     else:
         return "", ""
Example #16
0
    def getfield(self, pkt, s):
        """
        this method will get the packet, takes what does need to be
        taken and let the remaining go, so it returns two values.
        first value which belongs to this field and the second is
        the remaining which does need to be dissected with
        other "field classes".
        @param pkt: holds the whole packet
        @param s: holds only the remaining data which is not dissected yet.
        """

        src, dst, sport, dport, seq = get_tcp_ip()

        cstream = -1
        cstream = dissector.check_stream(src, dst, sport, dport, seq, s)
        if not cstream == -1:
            s = cstream
        if cstream == -1:
            return "", ""

        name = name_generator()
        if not dissector.Dissector.default_download_folder_changed:
            cwd = os.getcwd() + "/downloaded/"
            try:
                os.mkdir("downloaded")
            except:
                None
            f = open(cwd + name, "wb")
        else:
            f = open(dissector.Dissector.path + name, "wb")
        f.write(s)
        f.close()
        self.myresult = ""
        for c in s:
            self.myresult = self.myresult + base64.standard_b64encode(c)
        return "", self.myresult
Example #17
0
    def getfield(self, pkt, s):
        """
        this method will get the packet, takes what does need to be
        taken and let the remaining go, so it returns two values.
        first value which belongs to this field and the second is
        the remaining which does need to be dissected with
        other "field classes".
        @param pkt: holds the whole packet
        @param s: holds only the remaining data which is not dissected yet.
        """

        src, dst, sport, dport, seq = get_tcp_ip()

        cstream = -1
        cstream = dissector.check_stream(src, dst, sport, dport, seq, s)
        if not cstream == -1:
            s = cstream
        if cstream == -1:
            return "", ""

        name = name_generator()
        if not dissector.Dissector.default_download_folder_changed:
            cwd = os.getcwd() + "/downloaded/"
            try:
                os.mkdir("downloaded")
            except:
                None
            f = open(cwd + name, "wb")
        else:
            f = open(dissector.Dissector.path + name, "wb")
        f.write(s)
        f.close()
        self.myresult = ""
        for c in s:
            self.myresult = self.myresult + base64.standard_b64encode(c)
        return "", self.myresult
Example #18
0
    def getfield(self, pkt, s):
        """
        this method will get the packet, takes what does need to be
        taken and let the remaining go, so it returns two values.
        first value which belongs to this field and the second is
        the remaining which does need to be dissected with
        other "field classes".
        @param pkt: holds the whole packet
        @param s: holds only the remaining data which is not dissected yet.
        """
        cstream = -1
        if pkt.underlayer.name == "TCP":
            cstream = dissector.check_stream(\
            pkt.underlayer.underlayer.fields["src"],\
             pkt.underlayer.underlayer.fields["dst"],\
              pkt.underlayer.fields["sport"],\
               pkt.underlayer.fields["dport"],\
                pkt.underlayer.fields["seq"], s)
        if not cstream == -1:
            s = cstream
        remain = ""
        value = ""
        ls = s.splitlines()
        length = len(ls)
        if length == 1:
            value = ls[0]
            arguments = ""
            first = True
            res = value.split(" ")
            for arg in res:
                if not first:
                    arguments = arguments + arg + " "
                first = False
            if "-" in res[0]:
                value = "(" + res[0][:3] + ") " +\
                 self.get_code_msg(res[0][:3]) + " " + res[0][3:]
            else:
                value = "(" + res[0] + ") " + self.get_code_msg(res[0])
            return arguments[:-1], [value]

        if length > 1:
            reponses = []
            for element in ls:
                element = element.split(" ")
                arguments = ""
                first = True
                for arg in element:
                    if not first:
                        arguments = arguments + arg + " "
                    first = False
                if "-" in element[0]:
                    reponses.append([
                        "(" + element[0][:3] + ") " +
                        self.get_code_msg(element[0][:3]) + " " +
                        element[0][3:], arguments[:-1]
                    ])
                else:
                    reponses.append([
                        "(" + element[0] + ") " +
                        self.get_code_msg(element[0][:-1]), arguments
                    ])
            return "", reponses
        return "", ""