{iCode}: Write a C++ program to read the HTTP header and analyse the parameters.

Program

#include <iostream>

#include <string>

#include <cstring>

#include <crafter.h>

#include <stdio.h>

/* Collapse namespaces */

using namespace std;

using namespace Crafter;

int tcpcount = 0;

int httpcount = 0;

int req_count = 0;

int res_count = 0;

int ok= 0;

int moved = 0;

int forbidden = 0;

struct Info

{

string hostname ;

int requestcount ;

string contenttype;

} ;

Info in[10];

int count=1;

void PacketHandler(Packet* sniff_packet, void* user) {

RawLayer* raw_payload = sniff_packet->GetLayer<RawLayer>();

if(raw_payload) {

TCP* tcp_layer = sniff_packet->GetLayer<TCP>();

cout << "[#] TCP packet from source port: " << tcp_layer->GetSrcPort() << endl;

tcpcount++;

string payload = raw_payload->GetStringPayload();

string test1="HTTP/1.1";

string test2="GET";

string test3="POST";

string test4="HTTP/1.0";

string test5="200";

string test6="302";

string test7="403";

if(strstr(payload.c_str(),test1.c_str())||strstr(payload.c_str(),test4.c_str()))

{

cout << "[+] ---PACKET--- [+]" << endl;

cout<<payload<<endl;

cout << "[#] With Properties: " << endl;

cout<<"HTTP PACKET FOUND!!!"<<endl;

httpcount++;

if((strstr(payload.c_str(),test5.c_str())))

{

ok++;

}

else if((strstr(payload.c_str(),test6.c_str())))

{

moved++;

}

else if((strstr(payload.c_str(),test7.c_str())))

{

forbidden++;

}

if((strstr(payload.c_str(),test2.c_str()))||(strstr(payload.c_str(),test3.c_str())))

{

cout<<"REQUEST PACKET FOUND!!!"<<endl;

req_count++;

}

else

{

cout<<"RESPONSE PACKET FOUND!!!"<<endl;

res_count++;

}

std::string delimiter = "\n";

size_t pos,pos1 = 0;

std::string token;

int isize=sizeof(in)/sizeof(in[0]);

int flag=0;

while ((pos = payload.find(delimiter)) != std::string::npos)

{

token = payload.substr(0, pos);

if((pos1=token.find("Host:"))!=std::string::npos)

{

for(int ii=0;ii<count;ii++)

{

if(in[ii].hostname==token)

{

in[ii].requestcount++;

flag=1;

}

else

{

flag=0;

}

if(flag==0)

{

in[count].hostname=token;

in[count].requestcount=1;

count++;

cout << "\n-->\t"<<token << endl;

}

payload.erase(0, pos + delimiter.length());

}

int main() {

string iface = "p1p1";

Sniffer sniff("tcp",iface,PacketHandler);

sniff.Capture(200);

cout <<"\nNumber of TCP packets: "<<tcpcount;

cout<<"\nNumber of HTTP headers :"<<httpcount<<endl;

cout<<"\nNumber of Request Packets :"<<req_count<<endl;

cout<<"\nNumber of Response Packets :"<<res_count<<endl;

cout<<"\nMoved :"<<moved<<endl;

cout<<"\nOK :"<<ok<<endl;

cout<<"\nForbidden :"<<forbidden<<endl;

for(int jj=0;jj<count;jj++)

{

cout<<"host name is "<<in[jj].hostname<<"\n";

cout<<"request count is "<<in[jj].requestcount<<"\n";

}

return 0;

}

Output

[exam10@localhost ~]$ su

Password:

[root@localhost exam10]# g++ new.cpp -lcrafter

[root@localhost exam10]# ./a.out

[#] TCP packet from source port: 3128

[#] TCP packet from source port: 57809

[+] ---PACKET--- [+]

GET http://facebook.com/ HTTP/1.1

Host: facebook.com

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:25.0) Gecko/20100101 Firefox/25.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive

[#] With Properties:

HTTP Packet Captured!

Request Packet Found!

--> Host: facebook.com

[#] TCP packet from source port: 3128

[+] ---PACKET--- [+]

HTTP/1.1 403 Forbidden

Server: squid/3.2.13

Mime-Version: 1.0

Date: Tue, 13 Jan 2015 10:00:31 GMT

Content-Type: text/html

Content-Length: 3370

X-Squid-Error: ERR_ACCESS_DENIED 0

Vary: Accept-Language

Content-Language: en-us

X-Cache: MISS from pict254

X-Cache-Lookup: NONE from pict254:3128

Via: 1.1 pict254 (squid/3.2.13)

Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css"><!-- /*

Stylesheet for Squid Error pages

Adapted from design by Free CSS Templates

http://www.freecsstemplates.org

Released for free under a Creative Commons Attribution 2.5 License

/* Page basics */

* {

font-family: verdana, sans-serif;

}

html body {

margin: 0;

padding: 0;

background: #efefef;

font-size: 12px;

color: #1e1e1e;

}

/* Page displayed title area */

#titles {

margin-left: 15px;

padding: 10px;

padding-left: 100px;

background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;

}

/* initial title */

#titles h1 {

color: #000000;

}

#titles h2 {

color: #000000;

}

/* special event: FTP success page titles */

#titles ftpsuccess {

background-color:#00ff00;

width:100%;

}

/* Page displayed body content area */

#content {

padding: 10px;

background: #ffffff;

}

/* General text

[#] With Properties:

HTTP Packet Captured!

Response Packet Found!

[#] TCP packet from source port: 3128

[#] TCP packet from source port: 50391

[#] TCP packet from source port: 57809

[+] ---PACKET--- [+]

GET http://facebook.com/ HTTP/1.1

Host: facebook.com

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:25.0) Gecko/20100101 Firefox/25.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive

[#] With Properties:

HTTP Packet Captured!

Request Packet Found!

[#] TCP packet from source port: 3128

[+] ---PACKET--- [+]

HTTP/1.1 403 Forbidden

Server: squid/3.2.13

Mime-Version: 1.0

Date: Tue, 13 Jan 2015 10:00:33 GMT

Content-Type: text/html

Content-Length: 3370

X-Squid-Error: ERR_ACCESS_DENIED 0

Vary: Accept-Language

Content-Language: en-us

X-Cache: MISS from pict254

X-Cache-Lookup: NONE from pict254:3128

Via: 1.1 pict254 (squid/3.2.13)

Connection: keep-alive

Stylesheet for Squid Error pages

Adapted from design by Free CSS Templates

http://www.freecsstemplates.org

Released for free under a Creative Commons Attribution 2.5 License

/* Page basics */

* {

font-family: verdana, sans-serif;

}

html body {

margin: 0;

padding: 0;

background: #efefef;

font-size: 12px;

color: #1e1e1e;

}

/* Page displayed title area */

#titles {

margin-left: 15px;

padding: 10px;

padding-left: 100px;

background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;

}

/* initial title */

#titles h1 {

color: #000000;

}

#titles h2 {

color: #000000;

}

/* special event: FTP success page titles */

#titles ftpsuccess {

background-color:#00ff00;

width:100%;

}

/* Page displayed body content area */

#content {

padding: 10px;

background: #ffffff;

}

/* General text

[#] With Properties:

HTTP Packet Captured!

Response Packet Found!

[#] TCP packet from source port: 3128

[#] TCP packet from source port: 50391

[+] ---PACKET--- [+]

GET http://www.google.com/ HTTP/1.1

Host: www.google.com

Proxy-Connection: keep-alive

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36

X-Client-Data: CJC2yQEIorbJAQiptskBCMS2yQEInobKAQjviMoB

Accept-Encoding: gzip, deflate, sdch

Accept-Language: en-US,en;q=0.8

Cookie: PREF=ID=04e37fd7b94e9a4a:U=3f39b35fd14849e4:LD=en:TM=1373511345:LM=1407994458:GM=1:S=HHcH43Wcau10o3OO; NID=67=mDsAszm_nJLNLK0uC1ShYqWIsE7heqMPpmK4xs0eBME1unsFs6OdXLg4KyGSXzNGXY4GMaeCD_LqGRvQrbPjFv4RjFtb2ll3GLBl_bc8ztvNG-HMl-Ae94064f0eA5oh

[#] With Properties:

HTTP Packet Captured!

Request Packet Found!

--> Host: www.google.com

[#] TCP packet from source port: 50391

[+] ---PACKET--- [+]

GET http://www.google.com/favicon.ico HTTP/1.1

Host: www.google.com

Proxy-Connection: keep-alive

Accept: */*

X-Client-Data: CJC2yQEIorbJAQiptskBCMS2yQEInobKAQjviMoB

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36

Accept-Encoding: gzip, deflate, sdch

Accept-Language: en-US,en;q=0.8

[#] With Properties:

HTTP Packet Captured!

Request Packet Found!

[#] TCP packet from source port: 50391

[+] ---PACKET--- [+]

GET http://www.google.com/favicon.ico HTTP/1.1

Host: www.google.com

Proxy-Connection: keep-alive

Accept: */*

X-Client-Data: CJC2yQEIorbJAQiptskBCMS2yQEInobKAQjviMoB

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36

Accept-Encoding: gzip, deflate, sdch

Accept-Language: en-US,en;q=0.8

[#] With Properties:

HTTP Packet Captured!

Request Packet Found!

[#] TCP packet from source port: 50391

[#] TCP packet from source port: 1138

[+] ---PACKET--- [+]

POST http://n.edns.biz:1001/?mew HTTP/1.1

Accept: */*

Accept-Language: en-us

User-Agent: O4_88D3BA0A\DSP12\Admin\WinXP Professional SP3 x32\1\0.5A\y\y\njq8IsHere.vbs

Proxy-Connection: Keep-Alive

UA-CPU: x86

Accept-Encoding: gzip, deflate

Host: n.edns.biz:1001

Content-Length: 22

Pragma: no-cache

MATLAB 7.5.0 (R2007b)

[#] With Properties:

HTTP Packet Captured!

Request Packet Found!

--> Host: n.edns.biz:1001

[#] TCP packet from source port: 1138

[#] TCP packet from source port: 3260

[#] TCP packet from source port: 3128

[#] TCP packet from source port: 57809

[+] ---PACKET--- [+]

GET http://google.com/ HTTP/1.1

Host: google.com

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:25.0) Gecko/20100101 Firefox/25.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Cookie: PREF=ID=462abb8bbd079add:U=c3d5c52f91c21ef9:LD=en:TM=1413170590:LM=1418809119:GM=1:S=e6AKkq483MfdcPDs; NID=67=vFoWOSGw52UeQsN54r1r8mvpZCtPn0OxGfY1DsFcgngJeKqQtwZL4GOavJt5MkPTrSYQ69X-STcBCQRcokO6il-JksQtsMND6I7svIFI8wHthgdGXGZukj0hAvtc0SBR2bHvMn_D0_eMS1qLd_1BPJGHVp4y6AM

Connection: keep-alive

[#] With Properties:

HTTP Packet Captured!

Request Packet Found!

--> Host: google.com

[#] TCP packet from source port: 3128

[+] ---PACKET--- [+]

HTTP/1.1 302 Moved Temporarily

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: http://www.google.co.in/?gfe_rd=cr&ei=xey0VMK4MYfV8geLzYC4Dg

Content-Length: 261

Date: Tue, 13 Jan 2015 10:00:37 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.02

X-Cache: MISS from pict254

X-Cache-Lookup: MISS from pict254:3128

Via: 1.1 pict254 (squid/3.2.13)

Connection: keep-alive

[#] With Properties:

HTTP Packet Captured!

Response Packet Found!

[#] TCP packet from source port: 3128

[#] TCP packet from source port: 57809

[+] ---PACKET--- [+]

GET http://www.google.co.in/?gfe_rd=cr&ei=xey0VMK4MYfV8geLzYC4Dg HTTP/1.1

Host: www.google.co.in

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:25.0) Gecko/20100101 Firefox/25.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Cookie: PREF=ID=918fc7bf71e7da3c:U=c4769a1c9dd82cba:FF=1:LD=en:TM=1413170584:LM=1420779655:S=iIqflIuemxb8MqXH; NID=67=WCJbE_6tSfAGGET072BcDdGHdHhQXn1pX-3Va6jIr3y__fPlMpUOx2Z8o8s75Opfrs0sXkqBEfoDuXWvGPM3j7aeBU35eMsun9xJmrxyposCVJeGxya9GsUbcG7oXk_2lF31GImilA

Connection: keep-alive

[#] With Properties:

HTTP Packet Captured!

Request Packet Found!

--> Host: www.google.co.in

[#] TCP packet from source port: 3128

[+] ---PACKET--- [+]

HTTP/1.1 302 Moved Temporarily

Location: https://www.google.co.in/?gfe_rd=cr&ei=xey0VMK4MYfV8geLzYC4Dg&gws_rd=ssl

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Date: Tue, 13 Jan 2015 10:00:37 GMT

Server: gws

Content-Length: 277

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02

X-Cache: MISS from pict254

X-Cache-Lookup: MISS from pict254:3128

Via: 1.1 pict254 (squid/3.2.13)

Connection: keep-alive

[#] With Properties:

HTTP Packet Captured!

Response Packet Found!

[#] TCP packet from source port: 3128

[#] TCP packet from source port: 57810

[#] TCP packet from source port: 3128

[#] TCP packet from source port: 57810

[#] TCP packet from source port: 3128

[#] TCP packet from source port: 1138

[+] ---PACKET--- [+]

POST http://n.edns.biz:1001/?mew HTTP/1.1

Accept: */*

Accept-Language: en-us

User-Agent: O4_88D3BA0A\DSP12\Admin\WinXP Professional SP3 x32\1\0.5A\y\y\njq8IsHere.vbs

Proxy-Connection: Keep-Alive

UA-CPU: x86

Accept-Encoding: gzip, deflate

Host: n.edns.biz:1001

Content-Length: 22

Pragma: no-cache

MATLAB 7.5.0 (R2007b)

[#] With Properties:

HTTP Packet Captured!

Request Packet Found!

--> Host: n.edns.biz:1001

[#] TCP packet from source port: 1138

[#] TCP packet from source port: 3128

[#] TCP packet from source port: 50391

[+] ---PACKET--- [+]

GET http://www.google.com/ HTTP/1.1

Host: www.google.com

Proxy-Connection: keep-alive

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36

X-Client-Data: CJC2yQEIorbJAQiptskBCMS2yQEInobKAQjviMoB

Accept-Encoding: gzip, deflate, sdch

Accept-Language: en-US,en;q=0.8

[#] With Properties:

HTTP Packet Captured!

Request Packet Found!

--> Host: www.google.com

[#] TCP packet from source port: 50391

[+] ---PACKET--- [+]

GET http://www.google.com/favicon.ico HTTP/1.1

Host: www.google.com

Proxy-Connection: keep-alive

Accept: */*

X-Client-Data: CJC2yQEIorbJAQiptskBCMS2yQEInobKAQjviMoB

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36

Accept-Encoding: gzip, deflate, sdch

Accept-Language: en-US,en;q=0.8

[#] With Properties:

HTTP Packet Captured!

Request Packet Found!

[#] TCP packet from source port: 3128

[#] TCP packet from source port: 50391

[#] TCP packet from source port: 57809

[+] ---PACKET--- [+]

GET http://yahoo.com/ HTTP/1.1

Host: yahoo.com

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:25.0) Gecko/20100101 Firefox/25.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Cookie: B=05g6fl9a97sjq&b=3&s=2d

Connection: keep-alive

[#] With Properties:

HTTP Packet Captured!

Request Packet Found!

--> Host: yahoo.com

[#] TCP packet from source port: 3128

[+] ---PACKET--- [+]

HTTP/1.1 301 Moved Permanently

Date: Tue, 13 Jan 2015 10:00:44 GMT

Server: ATS

Location: https://www.yahoo.com/

Content-Type: text/html

Content-Language: en

Cache-Control: no-store, no-cache

Content-Length: 1450

X-Cache: MISS from pict254

X-Cache-Lookup: MISS from pict254:3128

Via: http/1.1 ir42.fp.ne1.yahoo.com (ApacheTrafficServer), 1.1 pict254 (squid/3.2.13)

Connection: keep-alive

[#] With Properties:

HTTP Packet Captured!

Response Packet Found!

Number of TCP packets: 139

Number of HTTP headers :17

Number of Request Packets :12

Number of Response Packets :5

{iCode}

Friday, November 13, 2015

Write a C++ program to read the HTTP header and analyse the parameters.

2 comments:

Perform a suitable assignment using Xen Hypervisor or equivalent open source to configure it. Give necessary GUI.

Facebook Badge