0x01 利用pcap包進行抓包

利用pcap對http進行抓包，缺點是pypcap包要安裝一系列的依賴包，安裝比較麻煩。且pypcap包更新緩慢。

#_*_coding=utf-8_*_
import pcap
import dpkt

class Capute(object):
    '''
    類的作用是抓取http請求
    '''
    def __init__(self):
        self.target = 'demo.aisec.cn'
        self.caputeRequest()
    
    def caputeRequest(self):
        '''
        監聽當前類的請求
        '''
        pc = pcap.pcap('eth0')
        pc.setfilter('tcp port 80')

        for ptime,pdata in pc:
            p = dpkt.ethernet.Ethernet(pdata)
            try:
                ip = p.data
                tcp = ip.data
                if tcp.dport == 80 and len(tcp.data)>0:
                    http = dpkt.http.Request(tcp.data)
                    host = http.headers['host']
                    if (host == self.target):
                        if http.method == "GET":
                            http_get_url = "http://{0}{1}".format(self.target, http.uri)
                            print http_get_url  #get型請求
                                                
                        elif http.method == "POST":
                            http_url = "{0}?".format(http.uri) if http.uri[-1:]!="?" else http.uri
                            if http.body:
                                http_post_url = "http://{0}{1}{2}".format(self.target, http_url, http.body)
                            else:
                                http_post_url = "http://{0}{1}".format(self.target,http_url)
                            print http_post_url  #post請求，body內容直接拼接在URL後，可根據自己的情況修改
            except Exception,e:
                pass
 

[email protected]:/home/test/test# python cap.py 
http://demo.aisec.cn/demo/aisec/login2.php?username=aaaaaaaa&password=aaaaaaaaaaaaaa
http://demo.aisec.cn/demo/aisec
http://demo.aisec.cn/demo/aisec/
http://demo.aisec.cn/demo/aisec/ajax_link.php?id=1&t=0.9103860526513613?
http://demo.aisec.cn/demo/aisec/
http://demo.aisec.cn/demo/aisec/ajax_link.php?id=1&t=0.22269654061950928?
http://demo.aisec.cn/demo/aisec/html_link.php?id=2
 

0x02 利用scapy進行抓包

scapy功能強大，易於安裝和使用，有完整的開發文件等等優點，建議使用scapy進行抓包。

#_*_coding=utf-8_*_

import sys
import scapy_http.http as HTTP
from scapy.all import *
from scapy.error import Scapy_Exception

class Capute(object):
    '''
    嗅探資料包
    '''
    def __init__(self):
        self.host = 'demo.aisec.cn'
        self.port = 80
        self.run()

    def pktTCP(self,pkt):
        if HTTP.HTTPRequest in pkt:
            test=pkt[TCP].payload
            if HTTP.HTTPRequest in pkt:
                if test.Method == "POST":
                    headers,body= str(test).split("\r\n\r\n",1)
                    path = "{0}?".format(test.Path) if test.Path[-1:] !="?" else test.Path
                    link = "http://{0}{1}{2}".format(test.Host,path,body)
                    if test.Host == self.host:
                        print link
                elif (test.Method == "GET"):
                    link = "http://{0}{1}".format(test.Host,test.Path)
                    if test.Host == self.host:
                        print link
                else:
                    pass
    def run(self):
        sniff(filter='tcp and port %d'%self.port,prn=self.pktTCP)
 

抓包結果：

[email protected]:/home/test/test# python http.py 
http://demo.aisec.cn/demo/aisec/login2.php?username=test&password=aaaaaa
http://demo.aisec.cn/demo/aisec/
http://demo.aisec.cn/demo/aisec/ajax_link.php?id=1&t=0.5521931602579171?
http://demo.aisec.cn/demo/aisec/html_link.php?id=2