Examples/TLSFingerprinting/main.cpp
/**
 * Handle an intercepted packet: identify if it's a ClientHello or ServerHello packets, extract the TLS fingerprint and write it to the output file
 */
Handle an intercepted packet: identify if it's a ClientHello or ServerHello packets, extract the TLS fingerprint and write it to the output file
Handle an intercepted packet : identify if it ' s a ClientHello or ServerHello packets extract the TLS fingerprint and write it to the output file
void handlePacket(pcpp::RawPacket* rawPacket, const HandlePacketData* data)
{
	pcpp::Packet parsedPacket(rawPacket);
	data->stats->numOfPacketsTotal++;
	if (parsedPacket.isPacketOfType(pcpp::SSL))
	{
		pcpp::SSLHandshakeLayer* sslHandshakeLayer = parsedPacket.getLayerOfType<pcpp::SSLHandshakeLayer>();
		if (sslHandshakeLayer != NULL)
		{
			if (data->chFP)
			{
				pcpp::SSLClientHelloMessage* clientHelloMessage = sslHandshakeLayer->getHandshakeMessageOfType<pcpp::SSLClientHelloMessage>();
				if (clientHelloMessage != NULL)
				{
					data->stats->numOfCHPackets++;
					pcpp::SSLClientHelloMessage::ClientHelloTLSFingerprint tlsFingerprint = clientHelloMessage->generateTLSFingerprint();
					std::pair<std::string, std::string> tlsFingerprintStringAndMD5 = tlsFingerprint.toStringAndMD5();
					data->stats->chFingerprints[tlsFingerprintStringAndMD5.second]++;
					writeToOutputFile(data->outputFile, parsedPacket, tlsFingerprintStringAndMD5.first, tlsFingerprintStringAndMD5.second, "ClientHello", data->separator);
					return;
				}
			}
			if (data->shFP)
			{
				pcpp::SSLServerHelloMessage* servertHelloMessage = sslHandshakeLayer->getHandshakeMessageOfType<pcpp::SSLServerHelloMessage>();
				if (servertHelloMessage != NULL)
				{
					data->stats->numOfSHPackets++;
					pcpp::SSLServerHelloMessage::ServerHelloTLSFingerprint tlsFingerprint = servertHelloMessage->generateTLSFingerprint();
					std::pair<std::string, std::string> tlsFingerprintStringAndMD5 = tlsFingerprint.toStringAndMD5();
					data->stats->shFingerprints[tlsFingerprintStringAndMD5.second]++;
					writeToOutputFile(data->outputFile, parsedPacket, tlsFingerprintStringAndMD5.first, tlsFingerprintStringAndMD5.second, "ServerHello", data->separator);
				}
			}
		}
	}
}
void handlePacket ( pcpp :: RawPacket * rawPacket , const HandlePacketData * data ) { pcpp :: Packet parsedPacket ( rawPacket ) ; data -> stats -> numOfPacketsTotal ++ ; if ( parsedPacket . isPacketOfType ( pcpp :: SSL ) ) { pcpp :: SSLHandshakeLayer * sslHandshakeLayer = parsedPacket . getLayerOfType < pcpp :: SSLHandshakeLayer > ( ) ; if ( sslHandshakeLayer != NULL ) { if ( data -> chFP ) { pcpp :: SSLClientHelloMessage * clientHelloMessage = sslHandshakeLayer -> getHandshakeMessageOfType < pcpp :: SSLClientHelloMessage > ( ) ; if ( clientHelloMessage != NULL ) { data -> stats -> numOfCHPackets ++ ; pcpp :: SSLClientHelloMessage :: ClientHelloTLSFingerprint tlsFingerprint = clientHelloMessage -> generateTLSFingerprint ( ) ; std :: pair < std :: string , std :: string > tlsFingerprintStringAndMD5 = tlsFingerprint . toStringAndMD5 ( ) ; data -> stats -> chFingerprints [ tlsFingerprintStringAndMD5 . second ] ++ ; writeToOutputFile ( data -> outputFile , parsedPacket , tlsFingerprintStringAndMD5 . first , tlsFingerprintStringAndMD5 . second , " " , data -> separator ) ; return ; } } if ( data -> shFP ) { pcpp :: SSLServerHelloMessage * servertHelloMessage = sslHandshakeLayer -> getHandshakeMessageOfType < pcpp :: SSLServerHelloMessage > ( ) ; if ( servertHelloMessage != NULL ) { data -> stats -> numOfSHPackets ++ ; pcpp :: SSLServerHelloMessage :: ServerHelloTLSFingerprint tlsFingerprint = servertHelloMessage -> generateTLSFingerprint ( ) ; std :: pair < std :: string , std :: string > tlsFingerprintStringAndMD5 = tlsFingerprint . toStringAndMD5 ( ) ; data -> stats -> shFingerprints [ tlsFingerprintStringAndMD5 . second ] ++ ; writeToOutputFile ( data -> outputFile , parsedPacket , tlsFingerprintStringAndMD5 . first , tlsFingerprintStringAndMD5 . second , " " , data -> separator ) ; } } } } }
Handle an intercepted packet: identify if it's a ClientHello or ServerHello packets, extract the TLS fingerprint and write it to the output file
Handle an intercepted packet : identify if it ' s a ClientHello or ServerHello packets extract the TLS fingerprint and write it to the output file
// extract the SSL/TLS handhsake layer // if user requested to extract ClientHello TLS fingerprint // check if the SSL/TLS handhsake layer contains a ClientHello message // extract the TLS fingerprint // write data to output file // if user requested to extract ServerHello TLS fingerprint // check if the SSL/TLS handhsake layer contains a ServerHello message // extract the TLS fingerprint // write data to output file