wPcap - Web Sniffer / Proxy

[thomascrabs]

Hi,

I am in the process of learning C++ and am creating a project on sourceforge in the process. Cue the shameless self promotion!

http://sourceforge.net/projects/http-test/

The next stage is to write / source some sort of web sniffer. I have been looking at PCAP for windows and have compiled a basic example to start with but can't seem to get anywhere finding examples of expanding this into a web / http sniffer and also getting wireless capture to work.

There is a tool out there that gives the type of output I want:

http://www.ieinspector.com/httpanalyzer/

...specifically just the URLs that are requested directly and indirectly during navigation.


My question is, does anyone know of an example or soruce for an actual tool that can do something like the above. I don't mind doing any dirty work myself to learn but this is probably a bit out of my ability at the minute.

P.S i have also downloaded wireshark but it is a bit heavy duty!

Thanks

[thomascrabs]

Anyone?

[tajendra]

Whats your ultimate goal, do you want to process sniffed data to show urls ? or some thing else

[thomascrabs]

What I want is to capture a users navigation on a browser, capturing all the requests that are made - directly and indirectly. Also would want to capture post data etc to allow for navigation on sites where users logon etc.

For now my hope was to at least get something that logs the URLs that have been visited.


I have been looking about for a few days now and am starting to think a proxy server may be a better starting point but still can't really find a good example.



Hope that helps and thanks for your reply

[tajendra]

So step would be capturing data, which you have already done with the winpcap library.

Next step is to read data again you can use winpacp for it. Parse each data packet for ip/tcp/udp
and finally for HTTP. take out url from this http data and then log it.

winpacp will help you to get to tcp payload, from where you need to parse http get request only.
And you can refer http rfc for get/post request format. I think this would do.

Regards
-Tajendra
http://www.tajendrasengar.blogspot.com/

[thomascrabs]

Sorry the only problem with wPcap is that my wireless adaptor does not appear to be supported and not sure how to get it to work. It appears to be possible but not for me!

[thomascrabs]

Ive set promiscious mode to 0 and it worked

i'll try what you suggested and report back what happens


Cheers

[thomascrabs]

Hi,

Ive finally got round to doing this properly and have started using windump.

I have used the following options

windump -p -i 1 -A -w dump.txt tcp dst port 80

and then the following to turn it into ascii
-A -r dump.txt

The problem i'm now having is that this truncates the urls so anything of about 50 chars and over is truncated. Does anyone have any ideas please? windump doesn't appear to be brilliantly supported, nor does wpcap...

[thomascrabs]

Found it...

-s 0

this sets the length to whatever is required. So much for not being well supported eh!