神刀安全网

CapTipper – Explore Malicious HTTP Traffic

CapTipper is a Python tool to explore malicious HTTP traffic, it can also help analyse and revive captured sessions from PCAP files. It sets up a web server that acts exactly as the server in the PCAP file and contains internal tools with a powerful interactive console for analysis and inspection of the hosts, objects and conversations found.

CapTipper – Explore Malicious HTTP Traffic

The tool provides the security researcher with easy access to the files and the understanding of the network flow, and is useful when trying to research exploits, pre-conditions, versions, obfuscations, plugins and shell-codes.

Using CapTipper

Feeding CapTipper with a drive-by traffic capture (e.g of an exploit kit) displays the user with the requests URI’s that were sent and responses meta-data.

The user can at this point browse to http://127.0.0.1/[host]/[URI] and receive the response back to the browser. In addition, an interactive shell is launched for deeper investigation using various commands such as: hosts, hexdump, info, ungzip, body, client, dump and more.

Usage: ./CapTipper.py <PCAP_file> [-p] [web_server_port=80] 

Example

Analysing the following Nuclear EK drive-by infection PCAP: 2014-11-06-Nuclear-EK-traffic.pcap

C:/CapTipper> CapTipper.py "C:/NuclearFiles/2014-11-06-Nuclear-EK-traffic.pcap"   CapTipperv0.1 - MaliciousHTTPtrafficexplorertool Copyright 2015 OmriHerscovici <omriher@gmail.com>   [A] AnalyzingPCAP: C:/NuclearFiles/2014-11-06-Nuclear-EK-traffic.pcap   [+] TrafficActivityTime: Thu, 11/06/14 17:02:35 [+] ConversationsFound:   0: / -> text/html (0.html) [5509 B] 1: /wp-includes/js/jquery/jquery.js?ver=1.7.2 -> application/javascript (jquery.js) [39562 B] 2: /seedadmin17.html -> text/html (seedadmin17.html) [354 B] 3: /15c0b14drr9f_1_08282d03fb0251bbd75ff6dc6e317bd9.html -> text/html (15c0b14drr9f_1_08282d03fb0251bbd75ff6dc6e317bd9.html) [113149 B] 4: /wp-content/uploads/2014/01/MetroWest_COVER_Issue2_Feb2014.jpg -> image/jpeg (MetroWest_COVER_Issue2_Feb2014.jpg) [350008 B] 5: /images/footer/3000melbourne.png -> image/png (3000melbourne.png) [2965 B] 6: /images/footer/3207portmelbourne.png -> image/png (3207portmelbourne.png) [3092 B] 7: /wp-content/uploads/2012/09/background1.jpg -> image/jpeg (background1.jpg) [33112 B] 8: /00015d76d9b2rr9f/1415286120 -> application/octet-stream (00015d76.swf) [31579 B] 9: /00015d766423rr9f/1415286120 -> application/pdf (XykpdWhZZ2.pdf) [9940 B] 10: /00015d76rr9f/1415286120/5/x00809070554515d565b010b03510053535c0505;1;6 -> application/octet-stream (5.exe) [139264 B] 11: /00015d76rr9f/1415286120/5/x00809070554515d565b010b03510053535c0505;1;6;1 -> application/octet-stream (5.exe) [139264 B] 12: /00015d76rr9f/1415286120/7 -> application/octet-stream (7.exe) [139264 B] 13: /00015d761709rr9f/1415286120 -> application/octet-stream (00015d76.swf) [8064 B] 14: /00015d76rr9f/1415286120/8 -> application/octet-stream (8.exe) [139264 B]     [+] StartedWebServeronhttp://localhost:80 [+] Listeningto requests...   CapTipperInterpreter Type 'open <conversation id>' to openaddressin browser type 'hosts' to viewtrafficflow Type 'help' for moreoptions   CT> 

You can download CapTipper here:

CapTipper-master.zip

Or read more here .

转载本站任何文章请注明:转载至神刀安全网,谢谢神刀安全网 » CapTipper – Explore Malicious HTTP Traffic

分享到:更多 ()

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址