willem/inquisitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enhance FTP packet logging to include source IP and avoid empty payload prints

Browse Source
This commit is contained in:
whaffman 2025-07-11 13:24:41 +02:00
parent fb68cd0375
commit f3bc0c1ad0
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
inquisitor/src/inquisitor.py
View File

@ -41,6 +41,7 @@ def ftp_packet_callback(packet):
if packet.haslayer('IP') and packet.haslayer('TCP'): if packet.haslayer('IP') and packet.haslayer('TCP'):
if packet['TCP'].dport == 21 or packet['TCP'].sport == 21: if packet['TCP'].dport == 21 or packet['TCP'].sport == 21:
payload = bytes(packet['TCP'].payload).decode(errors='ignore') payload = bytes(packet['TCP'].payload).decode(errors='ignore')
if payload != "":
print(f"the FTP payload: {payload}") print(f"the FTP payload: {payload}")
# print(f"FTP Packet: {packet.summary()}") # print(f"FTP Packet: {packet.summary()}")
if b"RETR" in bytes(packet['TCP'].payload): if b"RETR" in bytes(packet['TCP'].payload):
@ -51,7 +52,8 @@ def ftp_packet_callback(packet):
idx = parts.index("RETR") idx = parts.index("RETR")
if idx + 1 < len(parts): if idx + 1 < len(parts):
filename = parts[idx + 1] filename = parts[idx + 1]
print(f"\033[92mFTP file download detected: {filename}\033[0m") src_ip = packet['IP'].src
print(f"\033[92mFTP file download detected: {filename} from {src_ip}\033[0m")
def start_sniffing(interface=conf.iface): def start_sniffing(interface=conf.iface):
""" """