Python Ethical Hacking - MODIFYING DATA IN HTTP LAYER（2）
发布时间：2020-12-20 10:45:30 所属栏目：Python 来源：网络整理
导读：MODIFYING DATA IN HTTP LAYER ? Edit requests/responses. Replace download requests. Inject code(html/Javascript) Analyzing HTTP Responses # !/usr/bin/env python from netfilterqueue import NetfilterQueue from scapy.layers.inet import IP,TCP
|
MODIFYING DATA IN HTTP LAYER
?
Analyzing HTTP Responses #!/usr/bin/env python from netfilterqueue import NetfilterQueue from scapy.layers.inet import IP,TCP from scapy.packet import Raw def set_load(packet,load): packet[Raw].load = load del packet[IP].len del packet[IP].chksum del packet[TCP].chksum return packet def process_packet(packet): scapy_packet = IP(packet.get_payload()) if scapy_packet.haslayer(Raw) and scapy_packet.haslayer(TCP): if scapy_packet[TCP].dport == 80: print("[+] Request") print(scapy_packet.show()) elif scapy_packet[TCP].sport == 80: print("[+] Response") print(scapy_packet.show()) packet.accept() queue = NetfilterQueue() queue.bind(0,process_packet) try: queue.run() except KeyboardInterrupt: print(‘‘) Execute the Python script and browse www.bing.com website. Then we can catch the Request and Response packets.
? ?We can analyst the following packets to find out something interesting. [+] Request ###[ IP ]### version = 4 ihl = 5 tos = 0x0 len = 493 id = 37988 flags = DF frag = 0 ttl = 64 proto = tcp chksum = 0x5352 src = 10.0.0.43 dst = 180.97.146.200 options ###[ TCP ]### sport = 52596 dport = http seq = 917165288 ack = 3467538228 dataofs = 5 reserved = 0 flags = PA window = 229 chksum = 0x305d urgptr = 0 options = [] ###[ Raw ]### load = ‘POST /gsorganizationvalsha2g2 HTTP/1.1rnHost: ocsp2.globalsign.comrnUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0rnAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8rnAccept-Language: en-US,en;q=0.5rnAccept-Encoding: gzip,deflaternContent-Length: 79rnContent-Type: application/ocsp-requestrnConnection: keep-alivernrn0M0K0I0G0E0tx06x05+x0ex03x02x1ax05x00x04x14x0cx9eMx9c=xedxefx84xd8x91xe9rxc7xcfx84x06xbcx19{x07x04x14x96xdeaxf1xbdx1cx16)Sx1cxc0xcc};x83[email?protected]xe6x1a|x02x0c,xeex19<x18x82xxea>Cus‘ None [+] Response ###[ IP ]### version = 4 ihl = 5 tos = 0x0 len = 1492 id = 33866 flags = DF frag = 0 ttl = 57 proto = tcp chksum = 0x6685 src = 180.97.146.200 dst = 10.0.0.43 options ###[ TCP ]### sport = http dport = 52596 seq = 3467538228 ack = 917165741 dataofs = 5 reserved = 0 flags = A window = 980 chksum = 0xe490 urgptr = 0 options = [] ###[ Raw ]### load = ‘HTTP/1.1 200 OKrnServer: cloudflarernConnection: keep-alivernDate: Tue,10 Sep 2019 15:39:41 GMTrnLast-Modified: Tue,10 Sep 2019 15:04:58 GMTrnContent-Type: application/ocsp-responsernContent-Length: 1574rnX-NWS-UUID-VERIFY: f8e5676c8ec469ea31af609c0f9c9e63rnSet-Cookie: __cfduid=da7388f88361056058bb2012e85bdeede1568129982; expires=Wed,09-Sep-20 15:39:42 GMT; path=/; domain=.globalsign.com; HttpOnlyrnExpires: Sat,14 Sep 2019 15:04:58 GMTrnX-Powered-By: Undertow/1rnETag: "103d0ae54c63692206078c77475341a29d7c9e68"rnCF-Cache-Status: HITrnAge: 2084rnAccept-Ranges: bytesrnVary: Accept-EncodingrnCF-RAY: 51427f080877d203-HKGrnX-Daa-Tunnel: hop_count=3rnX-Via: DIANXIN-JIANGSU_152(200:miss);NULL-NULL_35(200:miss);UNKNOW-XIANGGANG_211(200:miss)rnX-NWS-LOG-UUID: 17577845690837411652 3d0598535bcfa9010eed9287fc0c0b26rnX-Cache: MISSrnX-Tencent-Cdn: 180.97.146.152rnCache-Control: public,must-revalidate,no-transform,max-age=3600,s-maxage=3600rnrn0x82x06"nx01x00xa0x82x06x1b0x82x06x17x06t+x06x01x05x05x070x01x01x04x82x06x080x82x06x040x81x9exa2x16x04x14x9cMx00x99x00x0ex8bxb0x01x81uxa1xbaxf0xd0%xd7xa0x1cGx18x0f20190910150458Z0s0q0E0tx06x05+x0ex03x02x1ax05x00x04x14x0cx9eMx9c=xedxefx84xd8x91xe9rxc7xcfx84x06xbcx19{x07x04x14x96xdeaxf1xbdx1cx16)Sx1cxc0xcc};x83[email?protected]xe6x1a|x02x0c,xeex19<x18x82xxea>Cusx80x00x18x0f20190910150458Zxa0x11x18x0f20190914150458Zxa1x020x000rx06t*x86Hx86xf7rx01x01x0bx05x00x03x82x01x01x003.x0fx93x8bd9xbdxd5Ax98lxcax00x12`5xa2DLx0fxc6Txdax0exf1xdexdelxf3‘xa3x0e xa3xef_x90xb2wxa7x86HWxc0x1dxf1xd8xb8xc6xe7[email?protected]xe37x0cx90nxfdTzxd9{x14xe0xe9)zxd2rx99xf9x05xf8x12xe9xd0qxc7[email?protected]xa4[email?protected]x8ax07=xbdy2e+xfaGl(x13DFxc2Bxc6x80pxa9Dxcexb9!x10xc9X1xc2xe2x12nxe6`xf0x19x99Cxc9 x88xe4gx18xd2K;xc3btatx1d=xd1BO&x9dTWx1ex07x1fxc3?x12xfdxf1oDwx9ex00Ux17xc6Bx18uxafaxd1xb2Qax0fT xcd/xe5x1axa5xcexb2xc9z}-.0x83x19xae5xf4x8bYXxeexd8xe1xe1[email?protected]xa1tsxe6xccxe6x1ahmxdexf66xe0xaaOxc3x07iMx1frx86xa2xc7x01x16x86T4_xd9x1ftxe7x1fx9e?x0e,x08;xa8gxe1xdbxa9xa1xf9xbfx11?4xa0x82x04K0x82x04G0x82x04C0x82x03+xa0x03x02x01x02x02x0cx15x9bAx00xeai.xb6‘ None [+] Response ###[ IP ]### version = 4 ihl = 5 tos = 0x0 len = 1112 id = 33867 flags = DF frag = 0 ttl = 57 proto = tcp chksum = 0x6800 src = 180.97.146.200 dst = 10.0.0.43 options ###[ TCP ]### sport = http dport = 52596 seq = 3467539680 ack = 917165741 dataofs = 5 reserved = 0 flags = PA window = 980 chksum = 0x8164 urgptr = 0 options = [] ###[ Raw ]### load = ‘xb1xf2xe4xc80rx06t*x86Hx86xf7rx01x01x0bx05x000f1x0b0tx06x03Ux04x06x13x02BE1x190x17x06x03Ux04nx13x10GlobalSign nv-sa1<0:x06x03Ux04x03x133GlobalSign Organization Validation CA - SHA256 - G20x1ex17r190709092251Zx17r191009092251Z0x81x8e1x0b0tx06x03Ux04x06x13x02BE1x190x17x06x03Ux04nx13x10GlobalSign nv-sa1x150x13x06x03Ux04x05x13x0c2019042400241M0Kx06x03Ux04x03x13DGlobalSign Organization Validation CA - SHA256 - G2 - OCSP Responder0x82x01"0rx06t*x86Hx86xf7rx01x01x01x05x00x03x82x01x0fx000x82x01nx02x82x01x01x00xd2Cx97xcf0jxe3xd9Rxcexdbxa7xebxdex05x8bxd70x13"xc8exa8&xde6‘x8adx96xfaxfa_xa9nx05x17xf58xf0x91xaaYxf5xcexb7xc1/x9dxc9zx7fxa3-hixafkx18xe0xb9xfdx9axaexedDxb7x14xb9xa5xd5xfcxffx83xedux17x06>hx1bxc1xb9xfcT2.x92~x0fxf1*;xbfxd6x9fvx1d^xa2!dxecxa8xeaxf7x0cxcaxfa8x83pxdaexa6xa2mexd5x15x94>xacxeeVx96xe1xa5lx13x07xbbPx196x86Vx81xc5Gxe5xd3;Xx9bx07x7fxdcxb9xfex0612Ux16)Dxd1E(ldQxearx8767xcd[email?protected]xaax9dx1dx1cxfdxc7lxf0x94x19Ax9e>lxe9xf3xbdxbcxddxf4mx05xd4e;xd8xb1x93x80xb7nxf6~x90x90Wbx81?xa2x8bgExd5x8cxb8x90x98xb9xb3axe0KMxf9Fxcex13x82}x81qo;Sxe5x04x1c`/xd6x12sx92x98xebx966x1cxf7x8dxa1Gxebax02x03x01x00x01xa3x81xc70x81xc40x1fx06x03Ux1d#x04x180x16x80x14x96xdeaxf1xbdx1cx16)Sx1cxc0xcc};x83[email?protected]xe6x1a|0Lx06x03Ux1d x04E0C0Ax06t+x06x01x04x01xa02x01_0402x06x08+x06x01x05x05x07x02x01x16&https://www.globalsign.com/repository/0x0fx06t+x06x01x05x05x070x01x05x04x02x05x000x13x06x03Ux1d%x04x0c0nx06x08+x06x01x05x05x07x03t0x1dx06x03Ux1dx0ex04x16x04x14x9cMx00x99x00x0ex8bxb0x01x81uxa1xbaxf0xd0%xd7xa0x1cG0x0ex06x03Ux1dx0fx01x01xffx04x04x03x02x07x800rx06t*x86Hx86xf7rx01x01x0bx05x00x03x82x01x01x008-,dx9ex99I}xdbxa8xc1x82PLxc0x18xc7xf4xfexc0xc4;xaex92xd7xxcclx16xacxffxc3xccxe9x8fVQ*xfcx15x00xb7x9cx13`xxff]5tRx00xb4x0fx03`x82xc0rx9dxc0xf8fx08x14Kx13xd6txfdxf2xdd4FxdeHxcdxe2x8dkxa3xc8bxe1x94xbc_x1dBxc5xa6x07Sxf5xd8x97xfd]xeax98xdbxdfx1exbdfx8f,R#p[x19lxf9<x0e[x94Ux05%xcb=xabx19xd5x88x93x8exea`xb3x9cxbfyxc9xe91xebnxcdx99x1e<x98xecxc2xbcxe0xe1xx97x9bxecxf3Pxc7‘x8ex19xf8xcfYx0cx98xecxabx9dxux8bxa7xebxb1x9ahx8dS+x97rxedrx80^x97}Txa3xb5x81xdc_xf4_Nx1cx96xf7xbex02xfb%dxefnDxcexfex8axc0xccxffx95xe57hBx9ex84x81nxc7:xf7xc7x89xc8x9e4xb5x0brpx9e(]~xb9x07xc8Bxfd?x11x8dxe3x8axb2;xb3UCxd5xb4xf7‘ None [+] Response ###[ IP ]### version = 4 ihl = 5 tos = 0x0 len = 1112 id = 33868 flags = DF frag = 0 ttl = 57 proto = tcp chksum = 0x67ff src = 180.97.146.200 dst = 10.0.0.43 options ###[ TCP ]### sport = http dport = 52596 seq = 3467539680 ack = 917165741 dataofs = 5 reserved = 0 flags = PA window = 980 chksum = 0x8164 urgptr = 0 options = [] ###[ Raw ]### load = ‘xb1xf2xe4xc80rx06t*x86Hx86xf7rx01x01x0bx05x000f1x0b0tx06x03Ux04x06x13x02BE1x190x17x06x03Ux04nx13x10GlobalSign nv-sa1<0:x06x03Ux04x03x133GlobalSign Organization Validation CA - SHA256 - G20x1ex17r190709092251Zx17r191009092251Z0x81x8e1x0b0tx06x03Ux04x06x13x02BE1x190x17x06x03Ux04nx13x10GlobalSign nv-sa1x150x13x06x03Ux04x05x13x0c2019042400241M0Kx06x03Ux04x03x13DGlobalSign Organization Validation CA - SHA256 - G2 - OCSP Responder0x82x01"0rx06t*x86Hx86xf7rx01x01x01x05x00x03x82x01x0fx000x82x01nx02x82x01x01x00xd2Cx97xcf0jxe3xd9Rxcexdbxa7xebxdex05x8bxd70x13"xc8exa8&xde6‘x8adx96xfaxfa_xa9nx05x17xf58xf0x91xaaYxf5xcexb7xc1/x9dxc9zx7fxa3-hixafkx18xe0xb9xfdx9axaexedDxb7x14xb9xa5xd5xfcxffx83xedux17x06>hx1bxc1xb9xfcT2.x92~x0fxf1*;xbfxd6x9fvx1d^xa2!dxecxa8xeaxf7x0cxcaxfa8x83pxdaexa6xa2mexd5x15x94>xacxeeVx96xe1xa5lx13x07xbbPx196x86Vx81xc5Gxe5xd3;Xx9bx07x7fxdcxb9xfex0612Ux16)Dxd1E(ldQxearx8767xcd[email?protected]xaax9dx1dx1cxfdxc7lxf0x94x19Ax9e>lxe9xf3xbdxbcxddxf4mx05xd4e;xd8xb1x93x80xb7nxf6~x90x90Wbx81?xa2x8bgExd5x8cxb8x90x98xb9xb3axe0KMxf9Fxcex13x82}x81qo;Sxe5x04x1c`/xd6x12sx92x98xebx966x1cxf7x8dxa1Gxebax02x03x01x00x01xa3x81xc70x81xc40x1fx06x03Ux1d#x04x180x16x80x14x96xdeaxf1xbdx1cx16)Sx1cxc0xcc};x83[email?protected]xe6x1a|0Lx06x03Ux1d x04E0C0Ax06t+x06x01x04x01xa02x01_0402x06x08+x06x01x05x05x07x02x01x16&https://www.globalsign.com/repository/0x0fx06t+x06x01x05x05x070x01x05x04x02x05x000x13x06x03Ux1d%x04x0c0nx06x08+x06x01x05x05x07x03t0x1dx06x03Ux1dx0ex04x16x04x14x9cMx00x99x00x0ex8bxb0x01x81uxa1xbaxf0xd0%xd7xa0x1cG0x0ex06x03Ux1dx0fx01x01xffx04x04x03x02x07x800rx06t*x86Hx86xf7rx01x01x0bx05x00x03x82x01x01x008-,R#p[x19lxf9<x0e[x94Ux05%xcb=xabx19xd5x88x93x8exea`xb3x9cxbfyxc9xe91xebnxcdx99x1e<x98xecxc2xbcxe0xe1xx97x9bxecxf3Pxc7‘x8ex19xf8xcfYx0cx98xecxabx9dxux8bxa7xebxb1x9ahx8dS+x97rxedrx80^x97}Txa3xb5x81xdc_xf4_Nx1cx96xf7xbex02xfb%dxefnDxcexfex8axc0xccxffx95xe57hBx9ex84x81nxc7:xf7xc7x89xc8x9e4xb5x0brpx9e(]~xb9x07xc8Bxfd?x11x8dxe3x8axb2;xb3UCxd5xb4xf7‘ None [+] Response ###[ IP ]### version = 4 ihl = 5 tos = 0x0 len = 1492 id = 33869 flags = DF frag = 0 ttl = 57 proto = tcp chksum = 0x6682 src = 180.97.146.200 dst = 10.0.0.43 options ###[ TCP ]### sport = http dport = 52596 seq = 3467538228 ack = 917165741 dataofs = 5 reserved = 0 flags = A window = 980 chksum = 0xe490 urgptr = 0 options = [] ###[ Raw ]### load = ‘HTTP/1.1 200 OKrnServer: cloudflarernConnection: keep-alivernDate: Tue,10 Sep 2019 15:04:58 GMTrnContent-Type: application/ocsp-responsernContent-Length: 1574rnX-NWS-UUID-VERIFY: f8e5676c8ec469ea31af609c0f9c9e63rnSet-Cookie: __cfduid=da7388f88361056058bb2012e85bdeede1568129982; expires=Wed,09-Sep-20 15:39:42 GMT; path=/; domain=.globalsign.com; HttpOnlyrnExpires: Sat,14 Sep 2019 15:04:58 GMTrnX-Powered-By: Undertow/1rnETag: "103d0ae54c63692206078c77475341a29d7c9e68"rnCF-Cache-Status: HITrnAge: 2084rnAccept-Ranges: bytesrnVary: Accept-EncodingrnCF-RAY: 51427f080877d203-HKGrnX-Daa-Tunnel: hop_count=3rnX-Via: DIANXIN-JIANGSU_152(200:miss);NULL-NULL_35(200:miss);UNKNOW-XIANGGANG_211(200:miss)rnX-NWS-LOG-UUID: 17577845690837411652 3d0598535bcfa9010eed9287fc0c0b26rnX-Cache: MISSrnX-Tencent-Cdn: 180.97.146.152rnCache-Control: public,s-maxage=3600rnrn0x82x06"nx01x00xa0x82x06x1b0x82x06x17x06t+x06x01x05x05x070x01x01x04x82x06x080x82x06x040x81x9exa2x16x04x14x9cMx00x99x00x0ex8bxb0x01x81uxa1xbaxf0xd0%xd7xa0x1cGx18x0f20190910150458Z0s0q0E0tx06x05+x0ex03x02x1ax05x00x04x14x0cx9eMx9c=xedxefx84xd8x91xe9rxc7xcfx84x06xbcx19{x07x04x14x96xdeaxf1xbdx1cx16)Sx1cxc0xcc};x83[email?protected]xe6x1a|x02x0c,xeex19<x18x82xxea>Cusx80x00x18x0f20190910150458Zxa0x11x18x0f20190914150458Zxa1x020x000rx06t*x86Hx86xf7rx01x01x0bx05x00x03x82x01x01x003.x0fx93x8bd9xbdxd5Ax98lxcax00x12`5xa2DLx0fxc6Txdax0exf1xdexdelxf3‘xa3x0e xa3xef_x90xb2wxa7x86HWxc0x1dxf1xd8xb8xc6xe7[email?protected]xe37x0cx90nxfdTzxd9{x14xe0xe9)zxd2rx99xf9x05xf8x12xe9xd0qxc7[email?protected]xa4[email?protected]x8ax07=xbdy2e+xfaGl(x13DFxc2Bxc6x80pxa9Dxcexb9!x10xc9X1xc2xe2x12nxe6`xf0x19x99Cxc9 x88xe4gx18xd2K;xc3btatx1d=xd1BO&x9dTWx1ex07x1fxc3?x12xfdxf1oDwx9ex00Ux17xc6Bx18uxafaxd1xb2Qax0fT xcd/xe5x1axa5xcexb2xc9z}-.0x83x19xae5xf4x8bYXxeexd8xe1xe1[email?protected]xa1tsxe6xccxe6x1ahmxdexf66xe0xaaOxc3x07iMx1frx86xa2xc7x01x16x86T4_xd9x1ftxe7x1fx9e?x0e,x08;xa8gxe1xdbxa9xa1xf9xbfx11?4xa0x82x04K0x82x04G0x82x04C0x82x03+xa0x03x02x01x02x02x0cx15x9bAx00xeai.xb6‘ None （编辑：李大同） 【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容! |
