network-core 0.2.0__tar.gz → 0.2.2__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {network_core-0.2.0 → network_core-0.2.2}/PKG-INFO +1 -1
- {network_core-0.2.0 → network_core-0.2.2}/network_core/dataModels.py +2 -2
- {network_core-0.2.0 → network_core-0.2.2}/network_core/http/httpExtract/helpers.py +25 -23
- {network_core-0.2.0 → network_core-0.2.2}/network_core.egg-info/PKG-INFO +1 -1
- {network_core-0.2.0 → network_core-0.2.2}/pyproject.toml +1 -1
- {network_core-0.2.0 → network_core-0.2.2}/network_core/__init__.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/conn.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/connOps.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/http/__init__.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/http/httpExtract/__init__.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/http/httpExtract/parser.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/http/httpExtract/pdh.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/http/httpIO.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/sni/__init__.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/sni/clientHello.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/sni/constants.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/sni/crypto.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/sni/helpers.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/sni/parsers.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/utils/__init__.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/utils/csvIO.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/utils/dt.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/utils/jsonIO.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core/utils/pcapIO.py +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core.egg-info/SOURCES.txt +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core.egg-info/dependency_links.txt +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core.egg-info/requires.txt +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/network_core.egg-info/top_level.txt +0 -0
- {network_core-0.2.0 → network_core-0.2.2}/setup.cfg +0 -0
|
@@ -6,6 +6,7 @@ import brotli
|
|
|
6
6
|
import json
|
|
7
7
|
import blackboxprotobuf
|
|
8
8
|
import zlib
|
|
9
|
+
import base64
|
|
9
10
|
|
|
10
11
|
|
|
11
12
|
def decompress_gzip_resilient(data):
|
|
@@ -54,7 +55,7 @@ def get_ft_from_layers(layers: dict):
|
|
|
54
55
|
)
|
|
55
56
|
|
|
56
57
|
|
|
57
|
-
def parse_hex(raw_bytes: bytes, encoding: str, content_type: str) -> dict |
|
|
58
|
+
def parse_hex(raw_bytes: bytes, encoding: str, content_type: str) -> dict | str:
|
|
58
59
|
# 1. Decompress (Existing logic)
|
|
59
60
|
encoding = str(encoding).lower() # in case I have arrays like ["application/json"]
|
|
60
61
|
content_type = str(content_type).lower()
|
|
@@ -75,14 +76,12 @@ def parse_hex(raw_bytes: bytes, encoding: str, content_type: str) -> dict | byte
|
|
|
75
76
|
print(
|
|
76
77
|
f"Decompression failed: {e}, with encoding {encoding} and content-type {content_type}"
|
|
77
78
|
)
|
|
78
|
-
print(raw_bytes[:100])
|
|
79
|
-
print("=" * 100)
|
|
80
79
|
decompressed = raw_bytes
|
|
81
80
|
|
|
82
81
|
# 2. Handle Binary types
|
|
83
82
|
binary_types = ["image/", "video/", "audio/", "application/octet-stream"]
|
|
84
83
|
if any(bt in content_type for bt in binary_types):
|
|
85
|
-
return decompressed
|
|
84
|
+
return base64.b64encode(decompressed).decode("ascii") # JSON-safe string
|
|
86
85
|
|
|
87
86
|
# 3. Handle Protobuf explicitly if the content type suggests it
|
|
88
87
|
# Google often uses "application/json+protobuf" or "application/x-protobuf"
|
|
@@ -103,39 +102,42 @@ def parse_hex(raw_bytes: bytes, encoding: str, content_type: str) -> dict | byte
|
|
|
103
102
|
try:
|
|
104
103
|
# message is a dict, typedef is the guessed structure
|
|
105
104
|
message, typedef = blackboxprotobuf.decode_message(decompressed)
|
|
106
|
-
return
|
|
107
|
-
"type": "protobuf_decoded",
|
|
108
|
-
"data": message,
|
|
109
|
-
"structure": typedef,
|
|
110
|
-
}
|
|
105
|
+
return str(message) # Convert to string for JSON serialization
|
|
111
106
|
except Exception as pb_e:
|
|
112
107
|
print(f"Protobuf decoding failed: {pb_e}")
|
|
113
108
|
|
|
114
|
-
return text_output
|
|
109
|
+
return str(text_output)
|
|
115
110
|
except:
|
|
116
|
-
return decompressed
|
|
111
|
+
return base64.b64encode(decompressed).decode("ascii") # JSON-safe string
|
|
117
112
|
|
|
118
113
|
|
|
119
114
|
def parse_http_unit_data(http_unit: HttpUnit):
|
|
120
115
|
try:
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
116
|
+
if isinstance(http_unit.response_data, str):
|
|
117
|
+
raw_bytes = bytes.fromhex(http_unit.response_data)
|
|
118
|
+
encoding = http_unit.response_headers.get("content-encoding", "").lower()
|
|
119
|
+
content_type = http_unit.response_headers.get("content-type", "").lower()
|
|
120
|
+
|
|
121
|
+
http_unit.response_data = parse_hex(
|
|
122
|
+
raw_bytes=raw_bytes, encoding=encoding, content_type=content_type
|
|
123
|
+
)
|
|
124
|
+
else:
|
|
125
|
+
print("Response data is not a string, skipping parsing.")
|
|
124
126
|
|
|
125
|
-
http_unit.response_data = parse_hex( # type: ignore
|
|
126
|
-
raw_bytes=raw_bytes, encoding=encoding, content_type=content_type
|
|
127
|
-
)
|
|
128
127
|
except:
|
|
129
128
|
pass
|
|
130
129
|
|
|
131
130
|
try:
|
|
132
|
-
|
|
131
|
+
if isinstance(http_unit.request_data, str):
|
|
132
|
+
raw_bytes = bytes.fromhex(http_unit.request_data)
|
|
133
133
|
|
|
134
|
-
|
|
135
|
-
|
|
134
|
+
encoding = http_unit.request_headers.get("content-encoding", "").lower()
|
|
135
|
+
content_type = http_unit.request_headers.get("content-type", "").lower()
|
|
136
136
|
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
137
|
+
http_unit.request_data = parse_hex( # type: ignore
|
|
138
|
+
raw_bytes=raw_bytes, encoding=encoding, content_type=content_type
|
|
139
|
+
)
|
|
140
|
+
else:
|
|
141
|
+
print("Request data is not a string, skipping parsing.")
|
|
140
142
|
except:
|
|
141
143
|
pass
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|