PcapFileExtractStreams

Extract payloads of each stream from a pcap file.

python · PCAP Analysis

Details

IDPcapFileExtractStreams
Languagepython
From Version6.2.0
Docker Imagedemisto/pcap-miner:1.0.0.10133006
Tagspcap file Utility

README

Extract payloads of each stream from a pcap file.

Script Data


Name Description
Script Type python3
Tags pcap, file, Utility

Inputs


Argument Name Description
entry_id The entry_id of the pcap file from which to extract streams.
bin2txt_mode The mode of how to convert the binary to text.
pcap_filter Filter to apply on pcap. Wireshark syntax as can be found here: https://www.wireshark.org/docs/man-pages/wireshark-filter.html
rsa_decrypt_key_entry_id The entry ID for the RSA decryption key.
wpa_password The WPA password. By providing the password you will be able to decrypt encrypted traffic data.
filter_keys Keys of output items by which to filter them.
verbose Set to true to generate stream entries, otherwise false.
server_ports Default server port numbers by which to decide the direction.

Outputs


Path Description Type
PCAPStream.entry_id The entry ID of the pcap file parsed. string
PCAPStream.protocol Protocol. string
PCAPStream.client_ip Client IP address. string
PCAPStream.client_port Client port number. number
PCAPStream.server_ip Server IP address. string
PCAPStream.server_poprt Server port nream data in bytes. number
PCAPStream.stream_text The data stream in text. string
PCAPStream.stream_base64 The data stream in base64. string
PCAPStream.outgoing_size Size of the outgoing data in bytes. number
PCAPStream.outgoing_text The outgoing data stream in text. string
PCAPStream.outgoing_base64 The outgoing data stream in base64. string
PCAPStream.incoming_size Size of the incoming data in bytes. number
PCAPStream.incoming_text The incoming data stream in text. string
PCAPStream.incoming_base64 The incoming data stream in base64. string
import json

import demistomock as demisto


def equals_object(obj1, obj2) -> bool:
    if type(obj1) is not type(obj2):
        return False
    elif isinstance(obj1, dict):
        for k1, v1 in obj1.items():
            if k1 not in obj2:
                return False
            if not equals_object(v1, obj2[k1]):
                return False
        return not (set(obj1.keys()) ^ set(obj2.keys()))
    elif isinstance(obj1, list):
        # Compare lists (ignore order)
        list2 = list(obj2)
        for _i1, v1 in enumerate(obj1):
            for i2, v2 in enumerate(list2):
                if equals_object(v1, v2):
                    list2.pop(i2)
                    break
            else:
                return False
        return not list2
    else:
        return obj1 == obj2


def side_effect_demisto_getFilePath(entry_id):
    return {"path": entry_id}


def test_main(mocker):
    """
    Given:
    - PCAP files are given with control parameters

    When:
    - Running PcapFileExtractStreams

    Then:
    - Validate results output that returned to CortexSOAR
    """
    from PcapFileExtractStreams import main

    mocker.patch.object(demisto, "getFilePath", side_effect=side_effect_demisto_getFilePath)

    with open("./test_data/test-1.json") as f:
        test_list = json.load(f)

    for t in test_list:
        mocker.patch.object(
            demisto,
            "args",
            return_value={
                "entry_id": t["entry_id"],
                "bin2txt_mode": t.get("bin2txt_mode"),
                "pcap_filter": t.get("pcap_filter"),
                "rsa_decrypt_key": t.get("rsa_decrypt_key"),
                "wpa_password": t.get("wpa_password"),
                "filter_keys": t.get("filter_keys"),
                "verbose": t.get("verbose"),
                "server_ports": t.get("server_ports"),
            },
        )
        mocker.patch.object(demisto, "results")
        main()
        assert demisto.results.call_count == 1

        results = demisto.results.call_args[0][0]
        contents = results["Contents"]
        assert equals_object(contents, t["contents"])