Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- -- Written by Eitam Doodai
- -- trivial postdissector example
- -- declare some Fields to be read
- full_uri_from_request = Field.new("http.request.full_uri")
- -- declare our (pseudo) protocol
- http_query_params_proto = Proto("http.query_parameters","HTTP Query Parameters Postdissector")
- -- create the fields for our "protocol"
- query_param1 = ProtoField.string("http.query_parameters.param1","PARAM1")
- query_param2 = ProtoField.string("http.query_parameters.param2","PARAM2")
- query_param3 = ProtoField.string("http.query_parameters.param3","PARAM3")
- -- add the field to the protocol
- http_query_params_proto.fields = {query_param1}
- http_query_params_proto.fields = {query_param2}
- http_query_params_proto.fields = {query_param3}
- -- Add prefs
- local p1 = http_query_params_proto.prefs
- p1.value1 = Pref.string ("Param1 Value", "123", "Param key to extract")
- p1.value2 = Pref.string ("Param2 Value", "456", "Param key to extract")
- p1.value3 = Pref.string ("Param3 Value", "789", "Param key to extract")
- -- create a function to "postdissect" each frame
- function http_query_params_proto.dissector(buffer,pinfo,tree)
- -- obtain the current values the protocol fields
- local full_uri_value = full_uri_from_request()
- if full_uri_value then
- local value = tostring(full_uri_value)
- local subtree = tree:add(http_query_params_proto,"Query Param1")
- local subtree = tree:add(http_query_params_proto,"Query Param2")
- local subtree = tree:add(http_query_params_proto,"Query Param3")
- _, _, query_param1_str = string.find(value,p1.value1 .. "=([^&]+)")
- _, _, query_param2_str = string.find(value,p1.value2 .. "=([^&]+)")
- _, _, query_param3_str = string.find(value,p1.value3 .. "=([^&]+)")
- if query_param1_str then
- subtree:add(query_param1,query_param1_str)
- end
- if query_param2_str then
- subtree:add(query_param2,query_param2_str)
- end
- if query_param3_str then
- subtree:add(query_param3,query_param3_str)
- end
- end
- end
- -- register our protocol as a postdissector
- register_postdissector(http_query_params_proto)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement