ec_dissector_http.c
上传用户：nilegod
上传日期：2007-01-08
资源大小：220k
文件大小：6k
- /*
- ettercap -- dissector HTTP Authorization: Basic
- Copyright (C) 2001 ALoR <alor@users.sourceforge.net>, NaGA <crwm@freemail.it>
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
- */
- #include "include/ec_main.h"
- #include <string.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <errno.h>
- #include "include/ec_dissector.h"
- #include "include/ec_inet_structures.h"
- #include "include/ec_error.h"
- #ifdef DEBUG
- #include "include/ec_debug.h"
- #endif
- // protos
- FUNC_DISSECTOR(Dissector_http);
- int Dissector_http_base64decode_binary(unsigned char *bufplain, const char *bufcoded); // stolen from ap_base64.c
- int Dissector_http_base64decode(char *bufplain, const char *bufcoded); // part of apache source code
- // --------------------
- static const unsigned char pr2six[256] =
- {
- /* ASCII table */
- 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
- 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
- 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 62, 64, 64, 64, 63,
- 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 64, 64, 64, 64, 64, 64,
- 64, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
- 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 64, 64, 64, 64, 64,
- 64, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
- 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 64, 64, 64, 64, 64,
- 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
- 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
- 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
- 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
- 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
- 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
- 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
- 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64
- };
- int Dissector_http_base64decode_binary(unsigned char *bufplain, const char *bufcoded)
- {
- int nbytesdecoded;
- register const unsigned char *bufin;
- register unsigned char *bufout;
- register int nprbytes;
- bufin = (const unsigned char *) bufcoded;
- while (pr2six[*(bufin++)] <= 63);
- nprbytes = (bufin - (const unsigned char *) bufcoded) - 1;
- nbytesdecoded = ((nprbytes + 3) / 4) * 3;
- bufout = (unsigned char *) bufplain;
- bufin = (const unsigned char *) bufcoded;
- while (nprbytes > 4)
- {
- *(bufout++) = (unsigned char) (pr2six[*bufin] << 2 | pr2six[bufin[1]] >> 4);
- *(bufout++) = (unsigned char) (pr2six[bufin[1]] << 4 | pr2six[bufin[2]] >> 2);
- *(bufout++) = (unsigned char) (pr2six[bufin[2]] << 6 | pr2six[bufin[3]]);
- bufin += 4;
- nprbytes -= 4;
- }
- /* Note: (nprbytes == 1) would be an error, so just ingore that case */
- if (nprbytes > 1)
- *(bufout++) = (unsigned char) (pr2six[*bufin] << 2 | pr2six[bufin[1]] >> 4);
- if (nprbytes > 2)
- *(bufout++) = (unsigned char) (pr2six[bufin[1]] << 4 | pr2six[bufin[2]] >> 2);
- if (nprbytes > 3)
- *(bufout++) = (unsigned char) (pr2six[bufin[2]] << 6 | pr2six[bufin[3]]);
- nbytesdecoded -= (4 - nprbytes) & 3;
- return nbytesdecoded;
- }
- int Dissector_http_base64decode(char *bufplain, const char *bufcoded)
- {
- int len;
- len = Dissector_http_base64decode_binary((unsigned char *) bufplain, bufcoded);
- bufplain[len] = ' ';
- return len;
- }
- FUNC_DISSECTOR(Dissector_http)
- {
- TCP_header *tcp;
- u_char *payload;
- char *fromhere;
- u_char collector[MAX_DATA];
- ONLY_CONNECTION;
- tcp = (TCP_header *) data;
- if (ntohs(tcp->source) == 80) return 0; // skip server messages...
- if (data_to_ettercap->datalen == 0) return 0; // no data...
- payload = (char *)((int)tcp + tcp->doff * 4);
- memset(collector, 0, MAX_DATA);
- memcpy(collector, payload, data_to_ettercap->datalen);
- if ( (fromhere = strstr(collector, "Authorization: Basic")) || (fromhere = strstr(collector, "Proxy-authorization: Basic")) )
- {
- char user[25];
- char pass[25];
- char decoded[50];
- char to_be_decoded[50];
- char page[50];
- char host[50];
- strncpy(page, strstr(collector, "GET") + strlen("GET "), 50);
- strtok(page, " HTTP");
- strncpy(host, strstr(collector, "Host:") + strlen("Host: "), 50);
- strtok(host, "r");
- strtok(fromhere, "r");
- strncpy(to_be_decoded, fromhere+strlen("Authorization: Basic")+1 , 50 );
- Dissector_http_base64decode(decoded, to_be_decoded);
- strncpy(user, strtok(decoded, ":"), 25); strcat(user, "n");
- strncpy(pass, strtok(NULL, ":"), 25); strcat(pass, "n");
- strcat(data_to_ettercap->user, user);
- strcat(data_to_ettercap->pass, pass);
- snprintf(data_to_ettercap->info, 100, "http://%s%sn", host, page);
- // #ifdef DEBUG
- // Debug_msg("tDissector_HTTP -- [%s][%s]", host, page);
- // Debug_msg("tDissector_HTTP -- [%s]", to_be_decoded);
- // #endif
- }
- return 0;
- }
- /* EOF */
English
