Can I use tcpdump to get HTTP requests, response header and response body?
ip=$(ip a|grep inet|awk '{print $2}'|grep 10|cut -d/ -f1);sudo tcpdump "src ${ip} and (dst 1.1.1.1 or dst 2.2.2.2 or dst 3.3.3.3) and ( tcp[20:2]=0x4745 or tcp[20:2]=0x504f or ((tcp[((tcp[12:1] & 0xf0) >> 2)+5:1] = 0x01) and (tcp[((tcp[12:1] & 0xf0) >> 2):1] = 0x16)) )" -s0 -A|grep -Ei '\.com'|grep -v ' IP '
There are tcpdump filters for HTTP GET & HTTP POST (or for both plus message body):
Run man tcpdump | less -Ip examples to see some examples
Here’s a tcpdump filter for HTTP GET:
sudo tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'
Here’s a tcpdump filter for HTTP POST:
sudo tcpdump -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'
Monitor HTTP traffic including request and response headers and message body (source):
tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
tcpdump -X -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
For more information on the bit-twiddling in the TCP header see: String-Matching Capture Filter Generator (link to Sake Blok's explanation).
转载于:https://blog.51cto.com/tenderrain/2129849