Skip to content

Instantly share code, notes, and snippets.

@sfilyh

sfilyh/Capture_HTTP_traffic.sh

Forked from igreenfield/Capture_HTTP_traffic.sh
Created August 29, 2022 09:35
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save sfilyh/b673f40675b2a442f72236325fc6559c to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save sfilyh/b673f40675b2a442f72236325fc6559c to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. Izek Greenfield revised this gist Jun 8, 2017. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions Capture_HTTP_traffic.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -20,6 +20,6 @@
    tcpdump -Avvvnn "tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x50555420)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x44454c45 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x5445 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48454144 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48545450 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x2f31 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x2e)"
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x44454c45 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x5445 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48454144 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48545450 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x2f31 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x2e)"
  2. Izek Greenfield created this gist Jun 8, 2017.
    25 changes: 25 additions & 0 deletions Capture_HTTP_traffic.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,25 @@
    #!/bin/bash

    ##########################################
    # Generate Filter tool:
    # https://www.wireshark.org/tools/string-cf.html
    #
    # GET Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420
    # POST Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20
    # PUT Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x50555420
    # DELETE Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x44454c45 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x5445 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x20
    # HEAD Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48454144 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20
    # HTTP RESPONSE Filter:
    # tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48545450 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x2f31 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x2e

    tcpdump -Avvvnn "tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x50555420)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x44454c45 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x5445 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48454144 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:1] = 0x20)
    || (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48545450 && tcp[((tcp[12:1] & 0xf0) >> 2) + 4:2] = 0x2f31 && tcp[((tcp[12:1] & 0xf0) >> 2) + 6:1] = 0x2e)"