0

My goal is to read responses of my HTTP requests, their data, headers and all that comes with them. I would like to get readable data, similar to what you can read when opening the network tab in developer tools in Chrome.

I tried using this code:

from scapy.all import *

def process_packet(packet):
    if packet.haslayer(TCP):
        # Process TCP packets
        src_ip = packet[IP].src
        src_port = packet[TCP].sport
        dst_ip = packet[IP].dst
        dst_port = packet[TCP].dport


        if packet.haslayer(Raw):
            payload = packet[Raw].load

            print(f"Source IP: {src_ip}")
            print(f"Source Port: {src_port}")
            print(f"Destination IP: {dst_ip}")
            print(f"Destination Port: {dst_port}")
            print(f"Raw Payload: {payload}")
            print()

# Start sniffing network packets
sniff(filter="tcp", prn=process_packet)

and this is the typcial result I get:

Source IP: xxx.xxx.xxx.xxx
Source Port: xxxxx
Destination IP: xxx.xxx.xxx.xxx
Destination Port: xxxxx
Raw Payload: b'\x17\x03\x03\x00"\xdc\xfcK\xa5\xb3N\xdfv\xf3$\x06\xeb\n\\V\x8c2\x0cM\xa2^\x02b\x8e\'=\xfc\xe6_%\x1b\x03\t\xe6'

and the payloads are usualy longer, but i picked this one so it doesnt take up the whole screen :). My question is, how do i now decode this raw payload i got, into something readable? I'm really lost.

Thanks in advance!

I tried using this code and i tried decoding it with all sorts of decoders but i never got anything useful.

Edit:

This is what i found in Scapys documentation, and i think thats the desired result im looking for, but i still can't get it.

scapys documentation example

When i try and run the command from the picture above, i get the same result as in my code, and not like from the picture.

  • Instead of using `Raw`, you could use `HTTPRequest` (imported `from scapy.layers.http`). You can then easily get the different fields of your request : `packet[HTTPRequest].Method`, `packet[HTTPRequest].Path`, `packet[HTTPRequest].Cookie`, and so on. – qouify Jun 05 '23 at 13:16

0 Answers0