diff --git a/inquisitor/src/inquisitor.py b/inquisitor/src/inquisitor.py index 796805c..d0683b3 100755 --- a/inquisitor/src/inquisitor.py +++ b/inquisitor/src/inquisitor.py @@ -41,7 +41,7 @@ def ftp_packet_callback(packet): This function would handle FTP packets, if needed. """ if packet.haslayer('IP') and packet.haslayer('TCP'): - if packet['TCP'].dport == 21: + if packet['TCP'].dport == 21 or packet['TCP'].sport == 21: if b"RETR" in bytes(packet['TCP'].payload): # Extract filename from FTP RETR command payload = bytes(packet['TCP'].payload).decode(errors='ignore') @@ -51,6 +51,10 @@ def ftp_packet_callback(packet): if idx + 1 < len(parts): filename = parts[idx + 1] print(f"\033[92mFTP file download detected: {filename} \033[0m") + # Also print when server sends a 150 response (file status okay; about to open data connection) + payload = bytes(packet['TCP'].payload).decode(errors='ignore') + if payload.startswith("150 "): + print(f"\033[94mFTP server response: {payload.strip()} \033[0m") def start_sniffing(interface=conf.iface): """