xbase-util 0.8.4__tar.gz → 0.8.6__tar.gz

{xbase_util-0.8.4 → xbase_util-0.8.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: xbase_util
-Version: 0.8.4
+Version: 0.8.6
 Summary: 网络安全基础工具
 Home-page: https://gitee.com/jimonik/xbase_util.git
 Author: xyt

{xbase_util-0.8.4 → xbase_util-0.8.6}/setup.py

@@ -3,7 +3,7 @@ from distutils.core import setup
 from setuptools import find_packages
 
 setup(name="xbase_util",
-      version="0.8.4",
+      version="0.8.6",
       description="网络安全基础工具",
       long_description="包含提取，预测，训练的基础工具",
       author="xyt",

{xbase_util-0.8.4 → xbase_util-0.8.6}/xbase_util/common_util.py

@@ -3,6 +3,7 @@ import json
 import logging
 import os
 import re
+from collections import Counter
 from datetime import datetime
 from logging.handlers import TimedRotatingFileHandler
 from urllib.parse import urlparse, parse_qs
@@ -68,27 +69,25 @@ def parse_expression(expression):
         return None
 
 
-def get_cookie_end_with_semicolon_count(text_data):
-    count = 0
-    for text in text_data.replace("-", "_").lower().splitlines():
-        item_text = text.replace("\n", "").replace("\t", "").replace(" ", "")
-        if "cookie:" in item_text and f"{item_text}".endswith(";"):
-            count = count + 1
-    if count == 0:
-        return -1
-    return count
+def get_cookie_end_with_semicolon_count(all_packets):
+    headers = [item['req_header'] + item['res_header'] for item in all_packets]
+    c = 0
+    for header in headers:
+        lines = [item for item in header.split('\r\n') if 'Cookie:' in item and item.strip().endswith(';')]
+        c += len(lines)
+    return c
 
 
-def get_ua_duplicate_count(text_data):
+def get_ua_duplicate_count(all_packets):
+    headers = [item['req_header'] + item['res_header'] for item in all_packets]
     ua_list = []
-    for text in text_data.replace("-", "_").lower().splitlines():
-        item_text = text.replace("\n", "").replace("\t", "").replace(" ", "")
-        if "user_agent:" in item_text and f"{item_text}".endswith(";"):
-            ua_list.append(item_text.replace("user_agent:", ""))
-    count = list(set(ua_list))
-    if count == 0:
-        return -1
-    return sum(count)
+    for header in headers:
+        lines = [item for item in header.split('\r\n') if 'User-Agent:' in item]
+        ua_list.extend(lines)
+    counter = Counter(ua_list)
+    pairs = sum(count // 2 for count in counter.values())
+    print(pairs)
+    return pairs
 
 
 def get_res_status_code_list(all_packets):

{xbase_util-0.8.4 → xbase_util-0.8.6}/xbase_util/pcap_util.py

@@ -366,8 +366,8 @@ def reassemble_tcp_pcap(p):
             info[key]['max'] = seq
         packets2.append(packet)
     if len(keys) == 1:
-        key = f"{packets['pkt'][IP].dst}:{packets['pkt'][IP].dport}"
-        ack = packets['pkt'][TCP].ack
+        key = f"{packets2[0]['pkt'][IP].dst}:{packets2[0]['pkt'][IP].dport}"
+        ack = packets2[0]['pkt'][TCP].ack
         info[key] = {
             "min": ack,
             "max": ack,
@@ -375,8 +375,7 @@ def reassemble_tcp_pcap(p):
             "wrapack": False,
         }
         keys.append(key)
-    packets = packets2
-    if len(packets) == 0:
+    if len(packets2) == 0:
         return []
     needwrap = False
     if info[keys[0]] and info[keys[0]]['max'] - info[keys[0]]['min'] > 0x7fffffff:
@@ -388,13 +387,13 @@ def reassemble_tcp_pcap(p):
         info[keys[0]]['wrapack'] = True
         needwrap = True
     if needwrap:
-        for packet in packets:
+        for packet in packets2:
             key = f"{packet['ip']['addr1']}:{packet['tcp']['sport']}"
             if info[key]['wrapseq'] and packet['tcp']['seq'] < 0x7fffffff:
                 packet['tcp']['seq'] += 0xffffffff
             if info[key]['wrapack'] and packet['tcp']['ack'] < 0x7fffffff:
                 packet['tcp']['ack'] += 0xffffffff
-    clientKey = f"{packets[0]['pkt'][IP].src}:{packets[0]['pkt'][IP].sport}"
+    clientKey = f"{packets2[0]['pkt'][IP].src}:{packets2[0]['pkt'][IP].sport}"
 
     def compare_packets(a, b):
         a_seq = a['pkt'][TCP].seq
@@ -413,14 +412,14 @@ def reassemble_tcp_pcap(p):
             return (a_seq + len(a_data) - 1) - b_ack
         return a_ack - (b_seq + len(b_data) - 1)
 
-    packets.sort(key=cmp_to_key(compare_packets))
+    packets2.sort(key=cmp_to_key(compare_packets))
     # del packets[num_packets:]
     # Now divide up conversation
     clientSeq = 0
     hostSeq = 0
     previous = 0
     results = []
-    for i, item in enumerate(packets):
+    for i, item in enumerate(packets2):
         sip = item['pkt'][IP].src
         sport = item['pkt'][IP].sport
         seq = item['pkt'][TCP].seq

xbase_util-0.8.6/xbase_util/test.py

@@ -0,0 +1,15 @@
+from scapy.packet import Raw
+from scapy.utils import rdpcap
+
+from xbase_util.pcap_util import reassemble_tcp_pcap, reassemble_session_pcap
+
+if __name__ == '__main__':
+    packets_scapy = reassemble_tcp_pcap(rdpcap("gzip2.pcap"))
+    skey = '10.28.7.16:54398'
+    streams = b""
+    for pkt in packets_scapy:
+        if Raw in pkt:
+            streams += pkt[Raw].load
+    text_data = streams.decode('ascii', errors='ignore')
+    all_packets = reassemble_session_pcap(packets_scapy, skey=skey)
+

{xbase_util-0.8.4 → xbase_util-0.8.6}/xbase_util.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: xbase-util
-Version: 0.8.4
+Version: 0.8.6
 Summary: 网络安全基础工具
 Home-page: https://gitee.com/jimonik/xbase_util.git
 Author: xyt

xbase_util-0.8.4/xbase_util/test.py

@@ -1,40 +0,0 @@
-import re
-
-import numpy as np
-from scapy.packet import Raw
-from scapy.utils import rdpcap
-
-from xbase_util.common_util import get_res_status_code_list
-from xbase_util.pcap_util import reassemble_tcp_pcap, reassemble_session_pcap
-from xbase_util.xbase_constant import res_status_code_pattern
-
-if __name__ == '__main__':
-    packets_scapy = reassemble_tcp_pcap(rdpcap("gzip2.pcap"))
-    skey = '10.28.7.16:54398'
-    streams = b""
-    for pkt in packets_scapy:
-        if Raw in pkt:
-            streams += pkt[Raw].load
-    text_data = streams.decode('ascii', errors='ignore')
-    all_packets = reassemble_session_pcap(packets_scapy, skey=skey)
-    if len(all_packets) != 0:
-        all_req_size = [item['req_size'] for item in all_packets if item['key'] == skey]
-        all_res_size = [item['res_size'] for item in all_packets if item['key'] != skey]
-        num_1, num_2, num_3, num_4, num_5 = get_res_status_code_list(all_packets)
-        # 获取请求头参数数量
-        req_header_count_list = [req['req_header'].count(":") for req in all_packets]
-        # 请求的时间间隔
-        request_flattened_time = [item['req_time'] for item in all_packets]
-        request_time_diffs = [request_flattened_time[i + 1] - request_flattened_time[i] for i in
-                              range(len(request_flattened_time) - 1)]
-        request_mean_diff = round(np.nanmean(request_time_diffs), 5) or 0
-        request_variance_diff = round(np.nanvar(request_time_diffs), 5) or 0
-        # 响应的时间间隔
-        response_flattened_time = [item['res_time'] for item in all_packets]
-        response_time_diffs = [response_flattened_time[i + 1] - response_flattened_time[i] for i in
-                               range(len(response_flattened_time) - 1)]
-        response_mean_diff = round(np.nanmean(response_time_diffs), 5) or 0
-        response_variance_diff = round(np.nanvar(response_time_diffs), 5) or 0
-
-        time_period = [(abs(item['res_time'] - item['req_time'])) for item in
-                       all_packets if item['res_time'] != 0 and item['req_time'] != 0]