scapyfic/scapy-sniff-web.py at main · vmapps/scapyfic · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
#!/usr/bin/env python3

import scapy.all as scapy
import socket

# --------------------------------------------------
# VARIABLES
# --------------------------------------------------

dhost =  ''

# --------------------------------------------------
# FUNCTIONS
# --------------------------------------------------
def resolve(addr):
    try:
        hst = socket.gethostbyaddr(addr)[0]
    except:
        hst = addr

    return hst

def display(p):
    global dhost

    if( p[scapy.IP].dst != dhost):
        dhost = p[scapy.IP].dst
        dport = p[scapy.TCP].dport
        print(f'[*] HTTP/S request on tcp/{dport} to {resolve(dhost)} ({dhost})')

# --------------------------------------------------
# MAIN
# --------------------------------------------------
if __name__ == '__main__':

    # filter on packets with TCP layer on destination port tcp/80 or tcp/443
    filter = lambda p: p.haslayer(scapy.TCP) and (p[scapy.TCP].dport==80 or p[scapy.TCP].dport==443)

    scapy.sniff(count=0,prn=display,lfilter=filter)