CODEWITHSUNDEEP
pythonregex
Th3carpenter
Th3carpenter

Reputation: 201

Python regular expression

I have this HTTP Request and I want to display only the Authorization section (base64 Value) : any help ? 

This Request is stored on a variable called hreq

I have tried this :

reg = re.search(r"Authorization:\sBasic\s(.*)\r", hreq)
print reg.group()

but doesn't work

Here is the request : 

HTTP Request: 
Path: /dynaform/custom.js 
Http-Version: HTTP/1.1 
Host: 192.168.1.254 
Accept-Language: en-US,en;q=0.5 
Accept-Encoding: gzip, deflate 
Referer: http://domain.com/userRpm/StatusRpm.htm 
Authorization: Basic YWhtEWa6MDfGcmVlc3R6bGH

I want to display the value YWhtEWa6MDfGcmVlc3R6bGH Please I need your help thanks in advance experts

Upvotes: 0

Views: 170

Answers (4)

Th3carpenter
Th3carpenter

Reputation: 201

Thanks for your answers :), actually I got an error msg

but anyway I'm gonna show what exactly I wanna do,

here is the script :

!/usr/bin/python

from scapy.all import *

from scapy.error import Scapy_Exception

from scapy import HTTP

my_iface="wlan0"

count=0

def pktTCP(pkt):

global count

count=count+1

if HTTP.HTTPRequest or HTTP.HTTPResponse in pkt:
     src=pkt[IP].src
     srcport=pkt[IP].sport
     dst=pkt[IP].dst
     dstport=pkt[IP].dport
     test=pkt[TCP].payload

     if HTTP.HTTPRequest in pkt:
        print "HTTP Request:"

        print test 
        print "======================================================================"
     if HTTP.HTTPResponse in pkt:
        print "HTTP Response:"
        print test 
        print "======================================================================"

sniff(filter='tcp and port 80',iface=my_iface,prn=pktTCP)

Upvotes: 0

Maxime Lorant
Maxime Lorant

Reputation: 36141

You can get rid of the \r at the end of the regex, in Linux it is a \n and it might break your script since you were expecting \r instead of \n:

>>> reg = re.search(r"Authorization:\sBasic\s(.*)", a)
>>> reg.groups()
('YWhtEWa6MDfGcmVlc3R6bGH ',)

Upvotes: 1

Dalorzo
Dalorzo

Reputation: 20014

If that is your whole input text maybe /(\b[ ].*)$/ could help

Online Demo

[ ] match a space character present in the text. followed by

.* any character (except newline) followed by

$ the end of the string

Upvotes: 0

Andrew
Andrew

Reputation: 5083

The \r is probably throwing things off; there probably isn't a carriage return at the end of the request (but it's hard to say from this end). Try removing it or using $ (end-of-input) instead.

You can use this online Python regex tester to try your inputs by hand before putting them in your code.

Upvotes: 0

Related Questions