CODEWITHSUNDEEP
python-3.xscapypacket-sniffers
prasad
prasad

Reputation: 11

scapy sniff with special characters

Hi i have written below program, it is sniffing packets and i could see username and passwords and URLs, but when i enter password with special character i am getting like this "%21" can somebody please help...

#!/bin/python3

import scapy.all as scapy

from scapy.layers import http

def sniff(interface):
    scapy.sniff(iface=interface, store=False, prn=process_sniffed_packets)

def get_url(packet):
    if packet.haslayer(http.HTTPRequest):
        url = packet[http.HTTPRequest].Host + packet[http.HTTPRequest].Path
        return url

def get_login_info(packet):
    if packet.haslayer(http.HTTPRequest):
        if packet.haslayer(scapy.Raw):
            load = packet[scapy.Raw].load
            #load = str(load)
            keybword = ["usr", "uname", "username", "pwd", "pass", "password"]
            for eachword in keybword:
                if eachword.encode() in load:
                    return load


def process_sniffed_packets(packet):
    if packet.haslayer(http.HTTPRequest):
        url = get_url(packet)
        print("[+] HTTP Request>>" + str(url))

        login_info = get_login_info(packet)
        if login_info:
            print("\n\n[+] Possible username and password >>" + str(login_info) + "\n\n")




sniff("eth0")

root@kali:~/python_course_by_zaid# ./packet_sniffer.py

[+] HTTP Request>>b'testing-ground.scraping.pro/login?mode=login'

[+] Possible username and password >>b"b'usr=admin&pwd=123456%21%40

it supposed to print 123456!@

Upvotes: 1

Views: 828

Answers (1)

Ross Jacobs
Ross Jacobs

Reputation: 3186

The problem is that the password is URL-encoded. Essentially some characters cannot be put into the URL like ! and @, so they are escaped with a %.

If you URL-decode these strings prior to printing them, you'll get the expected result. In Python3, you can decode like so:

# script.py
import urllib.parse

result = urllib.parse.unquote("123456%21%40")
print(result)

Running it we get:

$ python script.py
123456!@

Upvotes: 1

Related Questions