Threat Level: green Handler on Duty: Yee Ching Tok

SANS ISC: pcap2curl: Turning a pcap file into a set of cURL commands for "replay" SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
pcap2curl: Turning a pcap file into a set of cURL commands for "replay"

Many web browsers have the ability to quickly generate "curl" commands to replay a request. For example, in Google Chrome just open the "Network" pane in Developer Tools," right click on the URL (leftmost column) and select Copy->copy as cURL. This is a great feature when inspecting and reversing HTTP APIs. But recently I ran into an issue when inspecting traffic to a router. The browser would send a request a second, which made it hard to find the right request. To better understand what was going on, I recorded the traffic with tcpdump. But what I needed was a quick way to extract all the HTTP requests, and turn them into cURL commands for replay. The first part isn't all that hard. There are plenty of tools (tcpflow, tshark) to extract the data. The second part isn't difficult either. But the "glue" was missing.

So I turned to my old friend Scapy. Scapy can easily read a packet capture, and extract the data I need. So I used it to do just that and then printed the result.

You can find the result on GitHub [1]. It is in the "works for me" stage, so use with care. I will make some adjustments later today. If you find a problem, then please open an "Issue" via GitHub. Yes, it needs Scapy as a requirement. But if you don't already have it, then it is about time that you install it.



Johannes B. Ullrich, Ph.D., Dean of Research, SANS Technology Institute

I will be teaching next: Defending Web Applications Security Essentials - SANS Cloud Defender 2022


4312 Posts
ISC Handler
Oct 5th 2017

Sign Up for Free or Log In to start participating in the conversation!