mirror of
https://github.com/maride/pancap.git
synced 2024-11-24 01:34:26 +00:00
Compare commits
No commits in common. "0430a1b2147489cc1471d408595f45fd72a46bd3" and "8a76ed7d99745f0035705ae76720988dc4f712f9" have entirely different histories.
0430a1b214
...
8a76ed7d99
@ -1,7 +1,5 @@
|
|||||||
# pancap
|
# pancap
|
||||||
|
|
||||||
<img alt="pancap logo" src="pancap.png" width="250px" height="250px">
|
|
||||||
|
|
||||||
## Idea
|
## Idea
|
||||||
|
|
||||||
If you get access to a [PCAP](https://en.wikipedia.org/wiki/Pcap) file, for example during a CTF or captured on your own, you usually have the problem of overlooking all the relevant information to get a basic idea of the capture file. This gets worse if the capture file includes lots of white noise or irrelevant traffic - often included in the capture file to cloak *interesting* packets in a bunch of packets to YouTube, Reddit, Twitter and others.
|
If you get access to a [PCAP](https://en.wikipedia.org/wiki/Pcap) file, for example during a CTF or captured on your own, you usually have the problem of overlooking all the relevant information to get a basic idea of the capture file. This gets worse if the capture file includes lots of white noise or irrelevant traffic - often included in the capture file to cloak *interesting* packets in a bunch of packets to YouTube, Reddit, Twitter and others.
|
||||||
@ -12,7 +10,7 @@ If you get access to a [PCAP](https://en.wikipedia.org/wiki/Pcap) file, for exam
|
|||||||
|
|
||||||
Simply run
|
Simply run
|
||||||
|
|
||||||
`go get github.com/maride/pancap`
|
`go get git.darknebu.la/maride/pancap`
|
||||||
|
|
||||||
This will also build `pancap` and place it into your `GOBIN` directory - means you can directly execute it!
|
This will also build `pancap` and place it into your `GOBIN` directory - means you can directly execute it!
|
||||||
|
|
||||||
|
@ -2,8 +2,8 @@ package analyze
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"fmt"
|
"fmt"
|
||||||
"github.com/maride/pancap/output"
|
"git.darknebu.la/maride/pancap/output"
|
||||||
"github.com/maride/pancap/protocol"
|
"git.darknebu.la/maride/pancap/protocol"
|
||||||
"github.com/google/gopacket"
|
"github.com/google/gopacket"
|
||||||
"log"
|
"log"
|
||||||
)
|
)
|
||||||
|
42
analyzer_test.go
Normal file
42
analyzer_test.go
Normal file
@ -0,0 +1,42 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"github.com/google/gopacket"
|
||||||
|
"github.com/google/gopacket/layers"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func Test_analyzePCAP(t *testing.T) {
|
||||||
|
type args struct {
|
||||||
|
source *gopacket.PacketSource
|
||||||
|
linkType layers.LinkType
|
||||||
|
}
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
args args
|
||||||
|
wantErr bool
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "Faulty link type",
|
||||||
|
args: args{
|
||||||
|
source: &gopacket.PacketSource{
|
||||||
|
DecodeOptions: gopacket.DecodeOptions{
|
||||||
|
Lazy: false,
|
||||||
|
NoCopy: false,
|
||||||
|
SkipDecodeRecovery: false,
|
||||||
|
DecodeStreamsAsDatagrams: false,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
linkType: 2,
|
||||||
|
},
|
||||||
|
wantErr: true,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
for _, tt := range tests {
|
||||||
|
t.Run(tt.name, func(t *testing.T) {
|
||||||
|
if err := analyzePCAP(tt.args.source, tt.args.linkType); (err != nil) != tt.wantErr {
|
||||||
|
t.Errorf("analyzePCAP() error = %v, wantErr %v", err, tt.wantErr)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
2
go.mod
2
go.mod
@ -1,4 +1,4 @@
|
|||||||
module github.com/maride/pancap
|
module git.darknebu.la/maride/pancap
|
||||||
|
|
||||||
go 1.13
|
go 1.13
|
||||||
|
|
||||||
|
8
main.go
8
main.go
@ -3,8 +3,8 @@ package main
|
|||||||
import (
|
import (
|
||||||
"flag"
|
"flag"
|
||||||
"fmt"
|
"fmt"
|
||||||
"github.com/maride/pancap/analyze"
|
"git.darknebu.la/maride/pancap/analyze"
|
||||||
"github.com/maride/pancap/output"
|
"git.darknebu.la/maride/pancap/output"
|
||||||
"log"
|
"log"
|
||||||
"math/rand"
|
"math/rand"
|
||||||
"time"
|
"time"
|
||||||
@ -53,13 +53,13 @@ func printMOTD() {
|
|||||||
"PanCAP: Analyzer for pancake files",
|
"PanCAP: Analyzer for pancake files",
|
||||||
"You want some syrup with these packets?",
|
"You want some syrup with these packets?",
|
||||||
"Check out CONTRIBUTORS.md!",
|
"Check out CONTRIBUTORS.md!",
|
||||||
"Push your commits to github.com/maride/pancap",
|
"Push your commits to git.darknebu.la/maride/pancap",
|
||||||
"Don't let the white noise traffic confuse you.",
|
"Don't let the white noise traffic confuse you.",
|
||||||
"Grab a Club Mate if you don't have one yet.",
|
"Grab a Club Mate if you don't have one yet.",
|
||||||
"In Soviet Russia, traffic analyzes you.",
|
"In Soviet Russia, traffic analyzes you.",
|
||||||
"Who captures the captors?",
|
"Who captures the captors?",
|
||||||
"Respect other's privacy. Always.",
|
"Respect other's privacy. Always.",
|
||||||
"Make public data available, protect private data.", // https://www.ccc.de/en/hackerethik
|
"Make public data available, protect private data.", // https://www.ccc.de/en/hackerethik
|
||||||
"Most traffic is just there to confuse the russians.", // hat-tip to twitter.com/_harryr_
|
"Most traffic is just there to confuse the russians.", // hat-tip to twitter.com/_harryr_
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -2,18 +2,17 @@ package output
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"fmt"
|
"fmt"
|
||||||
|
"git.darknebu.la/maride/pancap/common"
|
||||||
"io/ioutil"
|
"io/ioutil"
|
||||||
"log"
|
"log"
|
||||||
"os"
|
"os"
|
||||||
"strings"
|
"strings"
|
||||||
|
|
||||||
"github.com/maride/pancap/common"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
var (
|
var (
|
||||||
registeredFiles []File
|
registeredFiles []File
|
||||||
notFound []string
|
notFound []string
|
||||||
extractedFiles int
|
extractedFiles int
|
||||||
)
|
)
|
||||||
|
|
||||||
// Registers a file with the given name and content.
|
// Registers a file with the given name and content.
|
||||||
@ -21,18 +20,12 @@ var (
|
|||||||
// This means that a module should _always_ call this function when a file is encountered.
|
// This means that a module should _always_ call this function when a file is encountered.
|
||||||
// origin is a descriptive string where the file comes from, e.g. the module name.
|
// origin is a descriptive string where the file comes from, e.g. the module name.
|
||||||
func RegisterFile(filename string, content []byte, origin string) {
|
func RegisterFile(filename string, content []byte, origin string) {
|
||||||
// Check if there even is anything to register
|
|
||||||
if len(content) == 0 {
|
|
||||||
// File is empty, won't register the void
|
|
||||||
log.Printf("Avoided registering file from %s because it is empty.", origin)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
thisFile := NewFile(filename, content, origin)
|
thisFile := NewFile(filename, content, origin)
|
||||||
// To avoid doubles, we need to check if that hash is already present
|
// To avoid doubles, we need to check if that hash is already present
|
||||||
for _, f := range registeredFiles {
|
for _, f := range registeredFiles {
|
||||||
if f.hash == thisFile.hash {
|
if f.hash == thisFile.hash {
|
||||||
// Found - stop here
|
// Found - stop here
|
||||||
log.Printf("Avoided registering file from %s because it has the same content as an already registered file ", origin)
|
log.Printf("Avoided registering file '%s' because it has the same content as an already registered file ", f.name)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
BIN
pancap.png
BIN
pancap.png
Binary file not shown.
Before Width: | Height: | Size: 434 KiB |
@ -2,8 +2,8 @@ package arp
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"fmt"
|
"fmt"
|
||||||
"github.com/maride/pancap/common"
|
"git.darknebu.la/maride/pancap/common"
|
||||||
"github.com/maride/pancap/output"
|
"git.darknebu.la/maride/pancap/output"
|
||||||
"github.com/google/gopacket"
|
"github.com/google/gopacket"
|
||||||
"github.com/google/gopacket/layers"
|
"github.com/google/gopacket/layers"
|
||||||
"log"
|
"log"
|
||||||
|
@ -1,7 +1,7 @@
|
|||||||
package dhcpv4
|
package dhcpv4
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"github.com/maride/pancap/output"
|
"git.darknebu.la/maride/pancap/output"
|
||||||
"github.com/google/gopacket"
|
"github.com/google/gopacket"
|
||||||
"github.com/google/gopacket/layers"
|
"github.com/google/gopacket/layers"
|
||||||
)
|
)
|
||||||
|
@ -2,7 +2,7 @@ package dhcpv4
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"fmt"
|
"fmt"
|
||||||
"github.com/maride/pancap/common"
|
"git.darknebu.la/maride/pancap/common"
|
||||||
"github.com/google/gopacket/layers"
|
"github.com/google/gopacket/layers"
|
||||||
"log"
|
"log"
|
||||||
)
|
)
|
||||||
|
@ -2,7 +2,7 @@ package dhcpv4
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"fmt"
|
"fmt"
|
||||||
"github.com/maride/pancap/common"
|
"git.darknebu.la/maride/pancap/common"
|
||||||
"github.com/google/gopacket/layers"
|
"github.com/google/gopacket/layers"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
@ -2,7 +2,7 @@ package dhcpv4
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"fmt"
|
"fmt"
|
||||||
"github.com/maride/pancap/common"
|
"git.darknebu.la/maride/pancap/common"
|
||||||
"github.com/google/gopacket/layers"
|
"github.com/google/gopacket/layers"
|
||||||
"log"
|
"log"
|
||||||
)
|
)
|
||||||
|
@ -2,7 +2,7 @@ package dns
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"fmt"
|
"fmt"
|
||||||
"github.com/maride/pancap/common"
|
"git.darknebu.la/maride/pancap/common"
|
||||||
"github.com/google/gopacket/layers"
|
"github.com/google/gopacket/layers"
|
||||||
"golang.org/x/net/publicsuffix"
|
"golang.org/x/net/publicsuffix"
|
||||||
"log"
|
"log"
|
||||||
|
@ -1,7 +1,7 @@
|
|||||||
package dns
|
package dns
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"github.com/maride/pancap/output"
|
"git.darknebu.la/maride/pancap/output"
|
||||||
"github.com/google/gopacket"
|
"github.com/google/gopacket"
|
||||||
"github.com/google/gopacket/layers"
|
"github.com/google/gopacket/layers"
|
||||||
)
|
)
|
||||||
|
@ -2,7 +2,7 @@ package dns
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"fmt"
|
"fmt"
|
||||||
"github.com/maride/pancap/common"
|
"git.darknebu.la/maride/pancap/common"
|
||||||
"github.com/google/gopacket/layers"
|
"github.com/google/gopacket/layers"
|
||||||
"golang.org/x/net/publicsuffix"
|
"golang.org/x/net/publicsuffix"
|
||||||
"log"
|
"log"
|
||||||
|
@ -1,8 +1,8 @@
|
|||||||
package http
|
package http
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"github.com/maride/pancap/common"
|
"git.darknebu.la/maride/pancap/common"
|
||||||
"github.com/maride/pancap/output"
|
"git.darknebu.la/maride/pancap/output"
|
||||||
"github.com/google/gopacket"
|
"github.com/google/gopacket"
|
||||||
"github.com/google/gopacket/layers"
|
"github.com/google/gopacket/layers"
|
||||||
"github.com/google/gopacket/tcpassembly"
|
"github.com/google/gopacket/tcpassembly"
|
||||||
|
@ -3,7 +3,7 @@ package http
|
|||||||
import (
|
import (
|
||||||
"bufio"
|
"bufio"
|
||||||
"fmt"
|
"fmt"
|
||||||
"github.com/maride/pancap/output"
|
"git.darknebu.la/maride/pancap/output"
|
||||||
"github.com/google/gopacket"
|
"github.com/google/gopacket"
|
||||||
"github.com/google/gopacket/tcpassembly"
|
"github.com/google/gopacket/tcpassembly"
|
||||||
"github.com/google/gopacket/tcpassembly/tcpreader"
|
"github.com/google/gopacket/tcpassembly/tcpreader"
|
||||||
|
@ -1,10 +1,10 @@
|
|||||||
package protocol
|
package protocol
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"github.com/maride/pancap/protocol/arp"
|
"git.darknebu.la/maride/pancap/protocol/arp"
|
||||||
"github.com/maride/pancap/protocol/dhcpv4"
|
"git.darknebu.la/maride/pancap/protocol/dhcpv4"
|
||||||
"github.com/maride/pancap/protocol/dns"
|
"git.darknebu.la/maride/pancap/protocol/dns"
|
||||||
"github.com/maride/pancap/protocol/http"
|
"git.darknebu.la/maride/pancap/protocol/http"
|
||||||
)
|
)
|
||||||
|
|
||||||
var (
|
var (
|
||||||
|
Loading…
Reference in New Issue
Block a user