-
Notifications
You must be signed in to change notification settings - Fork 1
/
client-hello-tools-python
60 lines (50 loc) · 1.85 KB
/
client-hello-tools-python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
#!/usr/bin/env python
# Hack-and-slash derived from https://github.com/pquerna/tls-client-hello-stats
import os, sys, dpkt
TLS_HANDSHAKE = 22
def pcap_reader(fp):
return dpkt.pcap.Reader(fp)
def grab_negotiated_ciphers(cap):
for ts, buf in cap:
eth = dpkt.ethernet.Ethernet(buf)
if not isinstance(eth.data, dpkt.ip.IP):
continue
ip = eth.data
if not isinstance(ip.data, dpkt.tcp.TCP):
continue
tcp = ip.data
if (tcp.dport != 443 and tcp.sport != 443) or (len(tcp.data) <= 0) or (ord(tcp.data[0]) != TLS_HANDSHAKE):
continue
records = []
try:
records, bytes_used = dpkt.ssl.TLSMultiFactory(tcp.data)
except dpkt.ssl.SSL3Exception, e:
continue
except dpkt.dpkt.NeedData, e:
continue
if len(records) <= 0:
continue
for record in records:
# TLS handshake only
if (record.type == 22 and len(record.data) != 0 and ord(record.data[0]) == 2):
try:
handshake = dpkt.ssl.TLSHandshake(record.data)
except dpkt.dpkt.NeedData, e:
continue
if isinstance(handshake.data, dpkt.ssl.TLSServerHello):
ch = handshake.data
print '%s\t0x%0.2x,0x%0.2x' %(dpkt.ssl.ssl3_versions_str[ch.version], (ch.cipher_suite&0xff00)>>8, ch.cipher_suite&0xff)
else:
continue
def main(argv):
if len(argv) != 2:
print "Tool to grab and print TLS Server Hello cipher_suite"
print ""
print "Usage: parser.py <pcap file>"
print ""
sys.exit(1)
with open(argv[1], 'rb') as fp:
capture = pcap_reader(fp)
stats = grab_negotiated_ciphers(capture)
if __name__ == "__main__":
main(sys.argv)