pcap2curl: Turning a pcap file into a set of cURL commands for "replay"

Many web browsers have the ability to quickly generate "curl" commands to replay a request. For example, in Google Chrome just open the "Network" pane in Developer Tools," right click on the URL (leftmost column) and select Copy->copy as cURL. This is a great feature when inspecting and reversing HTTP APIs. But recently I ran into an issue when inspecting traffic to a router. The browser would send a request a second, which made it hard to find the right request. To better understand what was going on, I recorded the traffic with tcpdump. But what I needed was a quick way to extract all the HTTP requests, and turn them into cURL commands for replay. The first part isn't all that hard. There are plenty of tools (tcpflow, tshark) to extract the data. The second part isn't difficult either. But the "glue" was missing.

So I turned to my old friend Scapy. Scapy can easily read a packet capture, and extract the data I need. So I used it to do just that and then printed the result.

You can find the result on GitHub [1]. It is in the "works for me" stage, so use with care. I will make some adjustments later today. If you find a problem, then please open an "Issue" via GitHub. Yes, it needs Scapy as a requirement. But if you don't already have it, then it is about time that you install it.


[1] https://github.com/jullrich/pcap2curl

Johannes B. Ullrich, Ph.D., Dean of Research, SANS Technology Institute

I will be teaching next: Application Security: Securing Web Apps, APIs, and Microservices - SANS San Francisco Winter 2022


4600 Posts
ISC Handler
Oct 5th 2017

Sign Up for Free or Log In to start participating in the conversation!