comment on

Hi all,

I need an utility to fetch GET, POST, and AUTH payloads. I started searching around, and I found this code, and that's exactly what I need. However, I didn't manage to make the output to be one-lined, as Lincoln showed in the forementioned page.
The code:

#!/usr/bin/perl

$LIMIT = shift || 5000;

$|=1;
open (STDIN,"/usr/sbin/tcpdump -lnx -s 1024 dst port 80 |");
while (<>) {
    if (/^\S/) {
    last unless $LIMIT--;
    while ($packet=~/(GET|POST|WWW-Authenticate|Authorization).+/g)  {
        print "$client -> $host\t$&\n";
    }
    undef $client; undef $host; undef $packet;
    ($client,$host) = /(\d+\.\d+\.\d+\.\d+).+ > (\d+\.\d+\.\d+\.\d+)/
        if /P \d+:\d+\((\d+)\)/ && $1 > 0;
    }
    next unless $client && $host;
    s/\s+//;
    s/([0-9a-f]{2})\s?/chr(hex($1))/eg;
    tr/\x1F-\x7E\r\n//cd;
    $packet .= $_;
}
[download]

I do get some output, but sliced, as if the "line builder" above didn't work.

I found this thread on Perlmonks on the same subject, which happens to have a very similar example. When trying that one, I don't get any output at all.

My OS: Slackware GNU Linux 10.0

Any help is appreciated. Cheers.

EDIT: Here's the output I'm getting when using the above code.

root@iceblue:~# perl sn
tcpdump: verbose output suppressed, use -v or -vv for full protocol de
+code
listening on eth0, link-type EN10MB (Ethernet), capture size 1024 byte
+s
192.168.0.249 -> 209.197.123.153        GET /ind P.......GET./ind
192.168.0.249 -> 209.197.123.153        GET /ind P...`...GET./ind
192.168.0.249 -> 209.197.123.153        GET /ind P...X...GET./ind
192.168.0.249 -> 209.197.123.153        GET /ima P.......GET./ima
192.168.0.249 -> 209.197.79.97          GET /i/p P.......GET./i/p
192.168.0.249 -> 66.39.54.27            GET /ima P...;...GET./ima
[download]

In reply to converting tcpdump output by RnC

Are you posting in the right place? Check out Where do I post X? to know for sure.
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big> <blockquote> <br /> <dd> <dl> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr /> <i> <li> <nbsp> <ol> <p> <small> <strike> <strong> <sub> <sup> <table> <td> <th> <tr> <tt> <u> <ul>
Snippets of code should be wrapped in <code> tags not <pre> tags. In fact, <pre> tags should generally be avoided. If they must be used, extreme care should be taken to ensure that their contents do not have long lines (<70 chars), in order to prevent horizontal scrolling (and possible janitor intervention).
Want more info? How to link or How to display code and escape characters are good places to start.


Pathologically Eclectic Rubbish Lister
	PerlMonks