def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream(\ pkt.underlayer.underlayer.fields["src"],\ pkt.underlayer.underlayer.fields["dst"],\ pkt.underlayer.fields["sport"],\ pkt.underlayer.fields["dport"],\ pkt.underlayer.fields["seq"], s) if not cstream == -1: s = cstream remain = "" value = "" ls = s.splitlines(True) f = ls[0].split() if "SIP" in f[0]: ls = s.splitlines(True) f = ls[0].split() length = len(f) value = "" if length == 3: value = "SIP-Version:" + f[0] + ", Status-Code:" +\ f[1] + ", Reason-Phrase:" + f[2] ls.remove(ls[0]) for element in ls: remain = remain + element else: value = ls[0] ls.remove(ls[0]) for element in ls: remain = remain + element return remain, value elif "SIP" in f[2]: ls = s.splitlines(True) f = ls[0].split() length = len(f) value = [] if length == 3: value = "Method:" + f[0] + ", Request-URI:" +\ f[1] + ", SIP-Version:" + f[2] ls.remove(ls[0]) for element in ls: remain = remain + element else: value = ls[0] ls.remove(ls[0]) for element in ls: remain = remain + element return remain, value else: return s, ""
def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream(\ pkt.underlayer.underlayer.fields["src"],\ pkt.underlayer.underlayer.fields["dst"],\ pkt.underlayer.fields["sport"],\ pkt.underlayer.fields["dport"],\ pkt.underlayer.fields["seq"], s) if not cstream == -1: s = cstream remain = "" value = "" ls = s.splitlines() length = len(ls) if length == 1: value = ls[0] arguments = "" first = True res = value.split(" ") for arg in res: if not first: arguments = arguments + arg + " " first = False if "-" in res[0]: value = "(" + res[0][:3] + ") " +\ self.get_code_msg(res[0][:3]) + " " + res[0][3:] else: value = "(" + res[0] + ") " + self.get_code_msg(res[0]) return arguments[:-1], [value] if length > 1: reponses = [] for element in ls: element = element.split(" ") arguments = "" first = True for arg in element: if not first: arguments = arguments + arg + " " first = False if "-" in element[0]: reponses.append(["(" + element[0][:3] + ") " + self.get_code_msg(element[0][:3]) + " " + element[0][3:], arguments[:-1]]) else: reponses.append(["(" + element[0] + ") " + self.get_code_msg(element[0][:-1]), arguments]) return "", reponses return "", ""
def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream(\ pkt.underlayer.underlayer.fields["src"],\ pkt.underlayer.underlayer.fields["dst"],\ pkt.underlayer.fields["sport"],\ pkt.underlayer.fields["dport"],\ pkt.underlayer.fields["seq"], s) if not cstream == -1: s = cstream remain = "" value = "" ls = s.split() length = len(ls) if ls[0].upper() == "DATA": bind(pkt.underlayer.underlayer.fields["src"], pkt.underlayer.underlayer.fields["dst"], pkt.underlayer.fields["sport"]) return "", "DATA" if ls[0].upper() == "QUIT": unbind(pkt.underlayer.underlayer.fields["src"], pkt.underlayer.underlayer.fields["dst"], pkt.underlayer.fields["sport"]) return "", "QUIT" if is_bounded(pkt.underlayer.underlayer.fields["src"], pkt.underlayer.underlayer.fields["dst"], pkt.underlayer.fields["sport"]): set_tcp_ip(pkt.underlayer.underlayer.fields["src"], pkt.underlayer.underlayer.fields["dst"], pkt.underlayer.fields["sport"],\ pkt.underlayer.fields["dport"],\ pkt.underlayer.fields["seq"]) smtpd = SMTPData(s).fields["data"] return "", ["DATA", smtpd] if length > 1: value = ls[0] if length == 2: remain = ls[1] return remain, value else: i = 1 remain = ' ' while i < length: remain = remain + ls[i] + ' ' i = i + 1 return remain[:-1], value else: return "", ls[0]
def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream( pkt.underlayer.underlayer.fields["src"], pkt.underlayer.underlayer.fields["dst"], pkt.underlayer.fields["sport"], pkt.underlayer.fields["dport"], pkt.underlayer.fields["seq"], s, ) if not cstream == -1: s = cstream self.myresult = "" subOptions = False resultlist = [] firstb = struct.unpack(self.fmt, s[0])[0] if firstb != 255: self.myresult = "" for c in s: self.myresult = self.myresult + base64.standard_b64encode(c) return "", "data " + self.myresult for c in s: ustruct = struct.unpack(self.fmt, c) command = self.get_code_msg(ustruct[0]) if command == "SB ": subOptions = True self.myresult = self.myresult + "SB " continue if command == "SE ": subOptions = False self.myresult = self.myresult = self.myresult + "SE " continue if subOptions: self.myresult = self.myresult + "subop(" + str(ustruct[0]) + ") " continue else: self.myresult = self.myresult + command comlist = self.myresult.split("Command ") for element in comlist: if element != "": resultlist.append(("command", element)) # return "", resultlist return "", self.myresult
def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream(\ pkt.underlayer.underlayer.fields["src"],\ pkt.underlayer.underlayer.fields["dst"],\ pkt.underlayer.fields["sport"],\ pkt.underlayer.fields["dport"],\ pkt.underlayer.fields["seq"], s) if not cstream == -1: s = cstream self.myresult = "" subOptions = False resultlist = [] firstb = struct.unpack(self.fmt, s[0])[0] if firstb != 255: self.myresult = "" for c in s: self.myresult = self.myresult + base64.standard_b64encode(c) return "", "data " + self.myresult for c in s: ustruct = struct.unpack(self.fmt, c) command = self.get_code_msg(ustruct[0]) if command == "SB ": subOptions = True self.myresult = self.myresult + "SB " continue if command == "SE ": subOptions = False self.myresult = self.myresult = self.myresult + "SE " continue if subOptions: self.myresult = self.myresult +\ "subop(" + str(ustruct[0]) + ") " continue else: self.myresult = self.myresult + command comlist = self.myresult.split("Command ") for element in comlist: if element != "": resultlist.append(("command", element)) #return "", resultlist return "", self.myresult
def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream(\ pkt.underlayer.underlayer.fields["src"],\ pkt.underlayer.underlayer.fields["dst"],\ pkt.underlayer.fields["sport"],\ pkt.underlayer.fields["dport"],\ pkt.underlayer.fields["seq"], s) if not cstream == -1: s = cstream remain = "" value = "" ls = s.splitlines() myresult = [] lslen = len(ls) i = 0 k = 0 for line in ls: k = k + 1 ls2 = line.split() length = len(ls2) if length > 1: value = ls2[0] c = 1 remain = "" while c < length: remain = remain + ls2[c] + " " c = c + 1 if self.name.startswith("request"): myresult = myresult + "Request Command: " + value +\ ", Request Parameter(s): " + remain if k < lslen: myresult = myresult + " | " if self.name.startswith("response"): myresult = myresult + "Response Indicator: " + value +\ ", Response Parameter(s): " + remain if k < lslen: myresult = myresult + " | " i = i + 1 if i == lslen: return "", myresult
def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream( pkt.underlayer.underlayer.fields["src"], pkt.underlayer.underlayer.fields["dst"], pkt.underlayer.fields["sport"], pkt.underlayer.fields["dport"], pkt.underlayer.fields["seq"], s, ) if not cstream == -1: s = cstream remain = "" value = "" ls = s.split() length = len(ls) if length > 1: value = "command: " + ls[0] + "," if length == 2: remain = ls[1] value = value + " Parameters: " + remain return "", value else: i = 1 remain = "" while i < length: if i != 1: remain = remain + " " + ls[i] else: remain = remain + ls[i] i = i + 1 value = value + " Parameters: " + remain return "", value else: return "", ls[0]
def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream(\ pkt.underlayer.underlayer.fields["src"],\ pkt.underlayer.underlayer.fields["dst"],\ pkt.underlayer.fields["sport"], pkt.underlayer.fields["dport"],\ pkt.underlayer.fields["seq"], s) if not cstream == -1: s = cstream if pkt.underlayer.name == "TCP" and cstream == -1: return "", "" remain = "" value = "" if self.name == "request-line: ": ls = s.splitlines(True) f = ls[0].split() length = len(f) if length == 3: value = "Method:" + f[0] + ", Request-URI:" +\ f[1] + ", HTTP-Version:" + f[2] HTTPMethodsRFC2616 = ['get','post','options','head','put','delete','trace','connect'] #HTTP methods as per rfc2616 http://www.ietf.org/rfc/rfc2616 #There are other methods in other RFCs but nobody cares about those. if f[0].lower() in HTTPMethodsRFC2616: add_file(pkt.underlayer.underlayer.fields["src"],\ pkt.underlayer.underlayer.fields["dst"],\ pkt.underlayer.fields["sport"],\ pkt.underlayer.fields["dport"], f[1],\ pkt.underlayer.fields["seq"] + len(s)) ls.remove(ls[0]) for element in ls: remain = remain + element return remain, value return s, ""
def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream(\ pkt.underlayer.underlayer.fields["src"],\ pkt.underlayer.underlayer.fields["dst"],\ pkt.underlayer.fields["sport"],\ pkt.underlayer.fields["dport"],\ pkt.underlayer.fields["seq"], s) if not cstream == -1: s = cstream remain = "" value = "" ls = s.split() length = len(ls) if length > 1: value = "command: " + ls[0] + "," if length == 2: remain = ls[1] value = value + " Parameters: " + remain return "", value else: i = 1 remain = "" while i < length: if i != 1: remain = remain + " " + ls[i] else: remain = remain + ls[i] i = i + 1 value = value + " Parameters: " + remain return "", value else: return "", ls[0]
def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream( pkt.underlayer.underlayer.fields["src"], pkt.underlayer.underlayer.fields["dst"], pkt.underlayer.fields["sport"], pkt.underlayer.fields["dport"], pkt.underlayer.fields["seq"], s, ) if not cstream == -1: s = cstream value = "" ls = s.split("\r\n") length = len(ls) if length == 1: return "", value elif length > 1: value = "" value = value + "response: " + ls[0] i = 1 while i < length - 1: value = value + " response: " + ls[i] if i < length - 2: value = value + " | " i = i + 1 return "", value else: return "", ""
def getfield(self, pkt, s): cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream(\ pkt.underlayer.underlayer.fields["src"],\ pkt.underlayer.underlayer.fields["dst"],\ pkt.underlayer.fields["sport"],\ pkt.underlayer.fields["dport"],\ pkt.underlayer.fields["seq"], s) if not cstream == -1: s = cstream if pkt.underlayer.name == "TCP" and cstream == -1: return "", "" name = get_file() if not dissector.Dissector.default_download_folder_changed: cwd = os.getcwd() + "/downloaded/" try: os.mkdir("downloaded") except: None f = open(cwd + clean_file_name(name, cwd), "wb") else: f = open(dissector.Dissector.path +\ clean_file_name(name, dissector.Dissector.path), "wb") f.write(s) f.close() self.myresult = "" firstb = struct.unpack(self.fmt, s[0])[0] self.myresult = "" for c in s: ustruct = struct.unpack(self.fmt, c) byte = base64.standard_b64encode(str(ustruct[0])) self.myresult = self.myresult + byte if not is_created_session(pkt.underlayer.underlayer.fields["src"], pkt.underlayer.underlayer.fields["dst"], pkt.underlayer.fields["sport"]): return self.myresult, "" return "", self.myresult
def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream(\ pkt.underlayer.underlayer.fields["src"],\ pkt.underlayer.underlayer.fields["dst"],\ pkt.underlayer.fields["sport"],\ pkt.underlayer.fields["dport"],\ pkt.underlayer.fields["seq"], s) if not cstream == -1: s = cstream value = "" ls = s.split("\r\n") length = len(ls) if length == 1: return "", value elif length > 1: value = "" value = value + "response: " + ls[0] i = 1 while i < length - 1: value = value + " response: " + ls[i] if i < length - 2: value = value + " | " i = i + 1 return "", value else: return "", ""
def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ src, dst, sport, dport, seq = get_tcp_ip() cstream = -1 cstream = dissector.check_stream(src, dst, sport, dport, seq, s) if not cstream == -1: s = cstream if cstream == -1: return "", "" name = name_generator() if not dissector.Dissector.default_download_folder_changed: cwd = os.getcwd() + "/downloaded/" try: os.mkdir("downloaded") except: None f = open(cwd + name, "wb") else: f = open(dissector.Dissector.path + name, "wb") f.write(s) f.close() self.myresult = "" for c in s: self.myresult = self.myresult + base64.standard_b64encode(c) return "", self.myresult
def getfield(self, pkt, s): """ this method will get the packet, takes what does need to be taken and let the remaining go, so it returns two values. first value which belongs to this field and the second is the remaining which does need to be dissected with other "field classes". @param pkt: holds the whole packet @param s: holds only the remaining data which is not dissected yet. """ cstream = -1 if pkt.underlayer.name == "TCP": cstream = dissector.check_stream(\ pkt.underlayer.underlayer.fields["src"],\ pkt.underlayer.underlayer.fields["dst"],\ pkt.underlayer.fields["sport"],\ pkt.underlayer.fields["dport"],\ pkt.underlayer.fields["seq"], s) if not cstream == -1: s = cstream remain = "" value = "" ls = s.splitlines() length = len(ls) if length == 1: value = ls[0] arguments = "" first = True res = value.split(" ") for arg in res: if not first: arguments = arguments + arg + " " first = False if "-" in res[0]: value = "(" + res[0][:3] + ") " +\ self.get_code_msg(res[0][:3]) + " " + res[0][3:] else: value = "(" + res[0] + ") " + self.get_code_msg(res[0]) return arguments[:-1], [value] if length > 1: reponses = [] for element in ls: element = element.split(" ") arguments = "" first = True for arg in element: if not first: arguments = arguments + arg + " " first = False if "-" in element[0]: reponses.append([ "(" + element[0][:3] + ") " + self.get_code_msg(element[0][:3]) + " " + element[0][3:], arguments[:-1] ]) else: reponses.append([ "(" + element[0] + ") " + self.get_code_msg(element[0][:-1]), arguments ]) return "", reponses return "", ""