bool urlparse(const u_char* data,u_int len)
{
ip_header *ih;
udp_header *uh;
tcp_header *th;
u_short sport,dport;
int ip_len = 0;
ih = (ip_header *)(data+0xE);
ip_len = (ih->ver_ihl & 0xf) * sizeof(unsigned long);
th = (tcp_header *) ((u_char*)ih + ip_len);
sport = ntohs( th->th_sport );
dport = ntohs( th->th_dport );
if ((ih->proto != IPPROTO_TCP))
return false;
std::string strdata((char*)th + sizeof(tcp_header),len - ip_len - sizeof(tcp_header)+1);
static char szTag0[] = "HTTP/1.1 302 Moved Temporarily\r\n";
static char szTag1[] = "Location: ";
static char szTag2[] = "\r\n\r\n";
size_t nP0 = strdata.find(szTag0);
if (nP0 == std::string::npos)
return false;
size_t nP1 = strdata.find(szTag1,nP0+strlen(szTag0));
if (nP1 == std::string::npos)
return false;
size_t nP2 = strdata.find(szTag2,nP1+strlen(szTag1));
if (nP2 == std::string::npos)
return false;
std::string strUrl = strdata.substr(nP1+strlen(szTag1),nP2-nP1-strlen(szTag1));
printf("url>%s\n",strUrl.c_str());
return true;
}
{
ip_header *ih;
udp_header *uh;
tcp_header *th;
u_short sport,dport;
int ip_len = 0;
ih = (ip_header *)(data+0xE);
ip_len = (ih->ver_ihl & 0xf) * sizeof(unsigned long);
th = (tcp_header *) ((u_char*)ih + ip_len);
sport = ntohs( th->th_sport );
dport = ntohs( th->th_dport );
if ((ih->proto != IPPROTO_TCP))
return false;
std::string strdata((char*)th + sizeof(tcp_header),len - ip_len - sizeof(tcp_header)+1);
static char szTag0[] = "HTTP/1.1 302 Moved Temporarily\r\n";
static char szTag1[] = "Location: ";
static char szTag2[] = "\r\n\r\n";
size_t nP0 = strdata.find(szTag0);
if (nP0 == std::string::npos)
return false;
size_t nP1 = strdata.find(szTag1,nP0+strlen(szTag0));
if (nP1 == std::string::npos)
return false;
size_t nP2 = strdata.find(szTag2,nP1+strlen(szTag1));
if (nP2 == std::string::npos)
return false;
std::string strUrl = strdata.substr(nP1+strlen(szTag1),nP2-nP1-strlen(szTag1));
printf("url>%s\n",strUrl.c_str());
return true;
}

本文介绍了一种通过解析网络数据包来识别HTTP 302重定向并从中提取目标URL的方法。该方法主要关注TCP协议的数据部分,并使用字符串匹配技术来定位特定的HTTP响应消息,从而实现对重定向URL的捕获。
2698

被折叠的 条评论
为什么被折叠?



