golang pcap

首先，你需要在下面链接中安装一个WinPcap

WinPcap - Home

下面，安装一下go需要使用的包。

go get github.com/google/gopacket
go get github.com/google/gopacket/pcap@v1.1.19

使用 pcap 子包识别设备

func main() {
    // 尝试迭代当前机器上的所有接口
    devices, err := pcap.FindAllDevs()
    if err != nil {
        log.Panic(err)
    }
    // 打印设备信息
    for _, device := range devices {
        fmt.Println("\nDevice Name: ", device.Name)
        fmt.Println("Device Description: ", device.Description)
        fmt.Println("Flags: ", device.Flags)
        fmt.Println("Device addresses:")
        for _, address := range device.Addresses {
            fmt.Printf("    IP:         %s\n", address.IP)
            fmt.Printf("    Netmask:    %s\n", address.Netmask)
        }
    }
}

实时捕获和结果过滤

var (
    iface    = "\\Device\\NPF_{CE8D510E-6FBB-4C12-8132-4B7256333718}"
    snaplen  = int32(1600) // 每帧要捕获的数据量
    promisc  = true        // 是否开启混杂模式
    timeout  = pcap.BlockForever
    filter   = "tcp"
    devFound = false
)

func main() {
    // find all interface
    devices, err := pcap.FindAllDevs()
    if err != nil {
        log.Panicln(err)
    }

    // find device
    for _, device := range devices {
        if device.Name == iface {
            devFound = true
            fmt.Println("found device:", device.Name)
        }
    }

    if !devFound {
        log.Panicf("device  %s not found\n", iface)
    }

    // get handle to read and insert packet
    handle, err := pcap.OpenLive(iface, snaplen, promisc, timeout)
    if err != nil {
        log.Panicln(err)
    }
    defer handle.Close()

    // set filter
    if err := handle.SetBPFFilter(filter); err != nil {
        log.Panicln(err)
    }

    // LinkType is decoder
    source := gopacket.NewPacketSource(handle, handle.LinkType())
    // Packets a chan to get packet
    for packet := range source.Packets() {
        fmt.Println(packet)
    }
}

嗅探和显示明文用户凭证

    packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
    for packet := range packetSource.Packets() {
        appLayer := packet.ApplicationLayer()
        if appLayer == nil {
            continue
        }

        payload := appLayer.Payload()
        if bytes.Contains(payload, []byte("USER")) {
            fmt.Println("[*] User:", string(payload))
        } else if bytes.Contains(payload, []byte("PASS")) {
            fmt.Println("[*] Pass:", string(payload))
        }
    }

参考：《Go黑帽子渗透测试编程之道》