Spaces:
Sleeping
Sleeping
File size: 9,050 Bytes
5e0ca0f |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 |
from rich import print
from subprocess import run, PIPE, STDOUT
from concurrent.futures import ThreadPoolExecutor
from typing import Any
from rich.console import Console
from rich.table import Table
import json
import re
import platform
class PacketAnalysis:
tshark_loc = ""
services = []
tcp_streams = []
sources = []
destinations = []
resolved = []
dns_query_names = []
dns_resp_names = []
unique_eapol_data = []
combined_json = []
def detect_tshark(self) -> None:
try:
osp = platform.system()
match osp:
case 'Darwin':
self.tshark_loc = "tshark"
case 'Linux':
self.tshark_loc = "tshark"
case 'Windows':
self.tshark_loc = '"C:\\Program Files\\Wireshark\\tshark.exe"'
except Exception:
pass
def extract_network_info(self, json_data):
services = set()
tcp_streams = set()
source_addresses = set()
destination_addresses = set()
resolved_sources = set()
dns_query_names = set()
dns_resp_names = set()
unique_eapol_data = set()
for entry in json_data:
layers = entry.get('_source', {}).get('layers', {})
tcp_layer = layers.get('tcp', {})
if tcp_layer:
service = tcp_layer.get('tcp.srcport')
if service:
services.add(service)
if tcp_layer:
tcp_stream_val = tcp_layer.get('tcp.stream')
if service:
tcp_streams.add(tcp_stream_val)
ip_layer = layers.get('ip', {})
if ip_layer:
source_address = ip_layer.get('ip.src_host')
destination_address = ip_layer.get('ip.dst_host')
if source_address:
source_addresses.add(source_address)
if destination_address:
destination_addresses.add(destination_address)
eth_layer = layers.get('eth', {})
if eth_layer:
source_mac = eth_layer.get('eth.src')
resolved_source_mac = eth_layer.get('eth.src_tree', {}).get('eth.src_resolved')
if source_mac and resolved_source_mac:
resolved_sources.add(resolved_source_mac)
dns_layer = layers.get('dns', {})
if dns_layer:
queries = dns_layer.get('Queries', [])
if isinstance(queries, list):
for query in queries:
query_name = query.get('dns.qry.name')
if query_name:
dns_query_names.add(query_name)
elif isinstance(queries, dict):
for query_name, query_info in queries.items():
dns_query_names.add(query_info.get('dns.qry.name'))
answers = dns_layer.get('Answers', [])
if isinstance(answers, list):
for answer in answers:
resp_name = answer.get('dns.resp.name')
if resp_name:
dns_resp_names.add(resp_name)
elif isinstance(answers, dict):
for resp_name, resp_info in answers.items():
dns_resp_names.add(resp_info.get('dns.resp.name'))
eapol_layer = layers.get('eapol', {})
if eapol_layer:
eapol_data = eapol_layer.get('wlan_rsna_eapol.keydes.data', "")
unique_eapol_data.add(eapol_data)
self.services = list(services)
self.tcp_streams = list(tcp_streams)
self.source_addresses = list(source_addresses)
self.destination_addresses = list(destination_addresses)
self.resolved_sources = list(resolved_sources)
self.dns_query_names = list(dns_query_names)
self.dns_resp_names = list(dns_resp_names)
self.unique_eapol_data = list(unique_eapol_data)
def run_tshark_command(self, service, source, streams):
stream_cmd = f'{self.tshark_loc} -r test.pcap -q -z follow,tcp,raw,{streams} -Y "ip.addr=={source} and tcp.port=={service}"'
runner = run(stream_cmd, shell=True, stdout=PIPE, stderr=STDOUT, text=True)
output_lines = runner.stdout.splitlines()
node_regex = re.compile(r'Node (\d+): (.+)$')
data_regex = re.compile(r'\s+(.+)$')
node_0, node_1, data = None, None, None
for line in output_lines:
node_match = node_regex.match(line)
data_match = data_regex.match(line)
if node_match:
node_num, node_value = node_match.groups()
if node_num == '0':
node_0 = node_value
elif node_num == '1':
node_1 = node_value
elif data_match:
data = data_match.group(1)
if node_0 is not None and node_1 is not None and data is not None:
return ['Source: ' f'{node_0}', 'Destination: ' f'{node_1}', 'stream: ' f'{streams}']
else:
return []
def flatten_json(self, data: Any, separator: Any = '.') -> Any:
flattened_data = {}
for key, value in data.items():
if isinstance(value, dict):
nested_data = self.flatten_json(value, separator)
for nested_key, nested_value in nested_data.items():
flattened_data[key + separator + nested_key] = nested_value
else:
flattened_data[key] = value
return flattened_data
def stream(self, service_list, source_list, tcp_streams_list, max_workers=20):
results = []
with ThreadPoolExecutor(max_workers=max_workers) as executor:
command_params = [(service, source, streams) for service in service_list for source in source_list for streams in tcp_streams_list]
print("Total Streams combination: ", len(command_params))
print("Number of workers in progress: ", max_workers)
results = list(executor.map(lambda params: self.run_tshark_command(*params), command_params))
results = [result for result in results if result]
self.combined_json = results
def PacketAnalyzer(self, cap_loc, save_loc, max_workers):
self.detect_tshark()
print('Collecting Json Data')
raw_pcap = run(f"{self.tshark_loc} -r {cap_loc} -T json", shell=True, capture_output=True, text=True)
try:
raw_data = raw_pcap.stdout
json_data = json.loads(raw_data)
except json.JSONDecodeError as e:
print(f"Error decoding JSON: {e}")
json_data = []
print('Extracting IP details...')
print('Extracting DNS details...')
print('Extracting EAPOL details...')
self.extract_network_info(json_data)
print('Extracting TCP STREAMS details...')
print('TCP streams can take some time..')
self.stream(service_list=self.services,
source_list=self.source_addresses,
tcp_streams_list=self.tcp_streams,
max_workers=max_workers)
print("Completed")
filtered_stream_data = self.combined_json
values = {
"PacketAnalysis": {
"Services": self.services,
"TCP Streams": self.tcp_streams,
"Sources Address": self.source_addresses,
"Destination Address": self.destination_addresses,
"DNS Resolved": self.resolved,
"DNS Query": self.dns_query_names,
"DNS Response": self.dns_resp_names,
"EAPOL Data": self.unique_eapol_data,
"Stream Data": filtered_stream_data
}
}
table_val = {
"PacketAnalysis": {
"Services": self.services,
"TCP Streams": self.tcp_streams,
"Sources Address": self.source_addresses,
"Destination Address": self.destination_addresses,
"DNS Resolved": self.resolved,
"DNS Query": self.dns_query_names,
"DNS Response": self.dns_resp_names,
"EAPOL Data": self.unique_eapol_data,
" Total Streams Data": str(len(filtered_stream_data))
}
}
table = Table(title="GVA Report for PCAP", show_header=True, header_style="bold magenta")
table.add_column("Identifiers", style="cyan")
table.add_column("Data", style="green")
flattened_data: dict = self.flatten_json(table_val, separator='.')
for key, value in flattened_data.items():
value_str = str(value)
table.add_row(key, str(value_str))
console = Console()
console.print(table)
with open(f'{save_loc}', 'w+') as file:
file.write(str(json.dumps(values)))
|