GithubHelp home page GithubHelp logo

chovy-3012 / httpdump Goto Github PK

View Code? Open in Web Editor NEW

This project forked from hsiafan/httpdump

0.0 0.0 0.0 5.25 MB

Capture and parse http traffics

License: BSD 2-Clause "Simplified" License

Go 100.00%

httpdump's Introduction

Parse and display http traffic from network device or pcap file. This is a go version of origin pcap-parser, thanks to gopacket project, this tool has simpler code base and is more efficient.

For original python implementation, refer to httpcap on pypi.

Install & Requirement

Build httpdump requires libpcap-dev and cgo enabled.

libpcap

for ubuntu/debian:

sudo apt install libpcap-dev

for centos/redhat/fedora:

sudo yum install libpcap-devel

for osx:

Libpcap and header files should be available in macOS already.

Install

go get github.com/hsiafan/httpdump

Usage

httpdump can read from pcap file, or capture data from network interfaces. Usage:

Usage: httpdump 
  -curl
    	Output an equivalent curl command for each http request
  -device string
    	Capture packet from network device. If is any, capture all interface traffics (default "any")
  -dump-body
    	dump http request/response body to file
  -file string
    	Read from pcap file. If not set, will capture data from network device by default
  -force
    	Force print unknown content-type http body even if it seems not to be text content
  -host string
    	Filter by request host, using wildcard match(*, ?)
  -idle duration
    	Idle time to remove connection if no package received (default 4m0s)
  -ip string
    	Filter by ip, if either source or target ip is matched, the packet will be processed
  -level string
    	Output level, options are: url(only url) | header(http headers) | all(headers, and textuary http body) (default "header")
  -output string
    	Write result to file [output] instead of stdout
  -port uint
    	Filter by port, if either source or target port is matched, the packet will be processed.
  -pretty
    	Try to format and prettify json content
  -status string
    	Filter by response status code. Can use range. eg: 200, 200-300 or 200:300-400
  -uri string
    	Filter by request url path, using wildcard match(*, ?)

Samples

A simple capture:

$ httpdump
192.168.110.48:56585  ----->  101.201.170.152:80
GET / HTTP/1.1
Host: geek.csdn.net
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
DNT: 1
Accept-Encoding: gzip, deflate, sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: uuid_tt_dd=-7445280944848876972_20160309; _JQCMT_ifcookie=1; _JQCMT_browser=8cc6c51a0610de98f19cf86af0855a3e; lzstat_uv=24444940273412920400|2839507@3117794@3311294


101.201.170.152:80  <-----  192.168.110.48:56585
HTTP/1.1 200 OK
Server: openresty
Date: Tue, 31 May 2016 02:40:14 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Vary: Accept-Encoding
Vary: Accept-Encoding
Content-Encoding: gzip

{body size: 15482 , set level arg to all to display body content}

More:

# parse pcap file
sudo tcpdump -wa.pcap tcp
httpdump -file a.pcap

# capture specified device:
httpdump -device eth0

# filter by ip and/or port
httpdump -port 80  # filter by port
httpdump -ip 101.201.170.152 # filter by ip
httpdump -ip 101.201.170.152 -port 80 # filter by ip and port

httpdump's People

Contributors

asdftamir avatar hsiafan avatar hubt avatar juanpabloaj avatar stool233 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.