首先,你需要在下面链接中安装一个WinPcap
下面,安装一下go需要使用的包。
go get github.com/google/gopacket
go get github.com/google/gopacket/pcap@v1.1.19
使用 pcap 子包识别设备
func main() {
// 尝试迭代当前机器上的所有接口
devices, err := pcap.FindAllDevs()
if err != nil {
log.Panic(err)
}
// 打印设备信息
for _, device := range devices {
fmt.Println("\nDevice Name: ", device.Name)
fmt.Println("Device Description: ", device.Description)
fmt.Println("Flags: ", device.Flags)
fmt.Println("Device addresses:")
for _, address := range device.Addresses {
fmt.Printf(" IP: %s\n", address.IP)
fmt.Printf(" Netmask: %s\n", address.Netmask)
}
}
}
实时捕获和结果过滤
var (
iface = "\\Device\\NPF_{CE8D510E-6FBB-4C12-8132-4B7256333718}"
snaplen = int32(1600) // 每帧要捕获的数据量
promisc = true // 是否开启混杂模式
timeout = pcap.BlockForever
filter = "tcp"
devFound = false
)
func main() {
// find all interface
devices, err := pcap.FindAllDevs()
if err != nil {
log.Panicln(err)
}
// find device
for _, device := range devices {
if device.Name == iface {
devFound = true
fmt.Println("found device:", device.Name)
}
}
if !devFound {
log.Panicf("device %s not found\n", iface)
}
// get handle to read and insert packet
handle, err := pcap.OpenLive(iface, snaplen, promisc, timeout)
if err != nil {
log.Panicln(err)
}
defer handle.Close()
// set filter
if err := handle.SetBPFFilter(filter); err != nil {
log.Panicln(err)
}
// LinkType is decoder
source := gopacket.NewPacketSource(handle, handle.LinkType())
// Packets a chan to get packet
for packet := range source.Packets() {
fmt.Println(packet)
}
}
嗅探和显示明文用户凭证
packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
for packet := range packetSource.Packets() {
appLayer := packet.ApplicationLayer()
if appLayer == nil {
continue
}
payload := appLayer.Payload()
if bytes.Contains(payload, []byte("USER")) {
fmt.Println("[*] User:", string(payload))
} else if bytes.Contains(payload, []byte("PASS")) {
fmt.Println("[*] Pass:", string(payload))
}
}
参考:《Go黑帽子渗透测试编程之道》