FiddlerCore HTTPS 和 HTTP 实时捕获（数据包结构）

Question

最近我一直在研究用于实时捕获 HTTP 的 Pcap 库，该库很容易获得。现在我已经转向 FiddlerCore，因为它可以轻松解密 HTTPS 数据包。

我现在可以同时捕获 HTTP 和 HTTPS 数据包，但我面临的问题是数据包结构。我想在 datagridview 中显示数据包编号 URL、URL 引用者、时间、IP 地址但是fiddlercore 数据包结构向我展示了图像Click here to see image

我实际上想以以下样式在 datagridview 中显示数据包，请检查附加图像 This is second image

下面还有 pcap 代码示例

 if (packet.Ethernet.IpV4.Tcp.Http != null)
                        {

                            HttpDatagram http = packet.Ethernet.IpV4.Tcp.Http;


                            // if http is 
                            if (http != null && http.Header != null && http.IsRequest)
                            {

                            rtbTest.Invoke( new Action( ( ) => rtbTest.AppendText(count.ToString() + ": " + packet.Timestamp.ToString("yyyy-MM-dd hh:mm:ss.fff") + " length:" + packet.Length) ) );

                            //rtbTest.AppendText(count.ToString() + ": " + packet.Timestamp.ToString("yyyy-MM-dd hh:mm:ss.fff") + " length:" + packet.Length);
                            rtbTest.Invoke(new Action(() => rtbTest.AppendText("\r\n")));
                            //rtbTest.AppendText("\r\n");

                            PcapDotNet.Packets.Http.HttpRequestDatagram http2 = (HttpRequestDatagram)packet.Ethernet.IpV4.Tcp.Http;

                                URLClass urlclass = new URLClass();} 

代码不完整，仅供演示

 try
        {
            foreach (var x in URLData)

            {
                dgvPacket.Invoke(new Action(() => { dgvPacket.Rows.Add(); ; }));


                dgvPacket.Rows[index].Cells[0].Value = x.PktCount;

                // dgvPacket.Invoke(new Action(() => { this.dgvPacket.Rows.Add(); ; }));
                dgvPacket.Rows[index].Cells[1].Value = x.PktTime.ToString();
                dgvPacket.Rows[index].Cells[2].Value = x.SourceIP;
                dgvPacket.Rows[index].Cells[3].Value = x.HttpMethod;
                if (x.ConnectionType == null)
                    //  rtbTest.AppendText("-\t");
                    rtbTest.Invoke(new Action(() => rtbTest.AppendText("-\t")));
                else
                    rtbTest.Invoke(new Action(() => rtbTest.AppendText(x.ConnectionType + "\t")));
                //  rtbTest.AppendText(x.ConnectionType + "\t");

                this.dgvPacket.Rows[index].Cells[4].Value = x.ConnectionType;
                rtbTest.Invoke(new Action(() => rtbTest.AppendText(x.HttpVersion + "\t")));
                // rtbTest.AppendText(x.HttpVersion + "\t");

                this.dgvPacket.Rows[index].Cells[5].Value = x.HttpVersion;

                rtbTest.Invoke(new Action(() => rtbTest.AppendText(x.URLString + "\t")));
                // rtbTest.AppendText(x.URLString + "\t");

                this.dgvPacket.Rows[index].Cells[6].Value = x.URLString;
                if (x.URLReferer == null)
                    // rtbTest.AppendText("-\t");
                    rtbTest.Invoke(new Action(() => rtbTest.AppendText("-\t")));

                else
                    //rtbTest.AppendText(x.URLReferer + "\t");
                    rtbTest.Invoke(new Action(() => rtbTest.AppendText(x.URLReferer + "\t")));

                this.dgvPacket.Rows[index].Cells[7].Value = x.URLReferer;



                if (x.ContentType == null)
                {
                    //rtbTest.AppendText(" -\t");
                    rtbTest.Invoke(new Action(() => rtbTest.AppendText(" -\t")));
                }
                else
                {
                    rtbTest.Invoke(new Action(() => rtbTest.AppendText(x.ContentType + "\t")));
                    // rtbTest.AppendText(x.ContentType + "\t");
                    this.dgvPacket.Rows[index].Cells[8].Value = x.ContentType;
                }

                if (x.HttpCookie == null)
                {
                    // rtbTest.AppendText(" -\t");
                    rtbTest.Invoke(new Action(() => rtbTest.AppendText(" -\t")));

                }
                else
                {
                    rtbTest.Invoke(new Action(() => rtbTest.AppendText(x.HttpCookie + "\t")));
                    // rtbTest.AppendText(x.HttpCookie + "\t");
                    this.dgvPacket.Rows[index].Cells[9].Value = x.HttpCookie;
                }

                if (x.UserAgent == null)
                {
                    rtbTest.AppendText(" -\t");
                    rtbTest.Invoke(new Action(() => rtbTest.AppendText(" -\t")));
                }
                else
                {
                    // rtbTest.AppendText(x.UserAgent + "\t");
                    rtbTest.Invoke(new Action(() => rtbTest.AppendText(x.UserAgent + "\t")));
                    this.dgvPacket.Rows[index].Cells[10].Value = x.UserAgent;
                    index++;

                }
            }
        }
        catch (Exception ex)
        {
            MessageBox.Show(ex.Message);
        }

记得询问 FiddlerCore 数据包结构

Answer 1

Fiddler核心代码

string url = sess.fullUrl.ToLower();

        var extensions = CaptureConfiguration.ExtensionFilterExclusions;
        foreach (var ext in extensions)
        {
            if (url.Contains(ext))
                return;
        }

        var filters = CaptureConfiguration.UrlFilterExclusions;
        foreach (var urlFilter in filters)
        {
            if (url.Contains(urlFilter))
                return;
        }
        // }

        if (sess == null || sess.oRequest == null || sess.oRequest.headers == null)
            return;

        string headers = sess.oRequest.headers.ToString();
        var reqBody = Encoding.UTF8.GetString(sess.RequestBody); string firstLine = sess.RequestMethod + " " + sess.fullUrl + " " + sess.oRequest.headers.HTTPVersion;


        int at = headers.IndexOf("\r\n");
        if (at < 0)
            return;
        headers = firstLine + "\r\n" + headers.Substring(at + 1);

        string output = headers + "\r\n" +
                        (!string.IsNullOrEmpty(reqBody) ? reqBody + "\r\n" : string.Empty) +
                        Separator + "\r\n\r\n";

        // must marshal to UI thread
        BeginInvoke(new Action<string>((text) =>
       {
           txtCapture.AppendText(text);
           UpdateButtonStatus();
       }
        ), output);