USArmyResearchLab / Dshell

Dshell is a network forensic analysis framework.
Other
5.45k stars 1.14k forks source link

Reverse HTTP Support #70

Closed amm3 closed 8 years ago

amm3 commented 8 years ago

Updated httpdecoder to be less picky about directionality of HTTP REQUEST on the C->S and RESPONSE on the converse. I've seen anomalies where the opposite occurs, sometimes due to packet loss, but also intentionally by way of proxy or tcp relay.

Here is some sample traffic that I crafted of a reverse GET request to Google: https://www.dropbox.com/s/hprypg075r4rddl/reverse_http.pcap

I'll keep the dropbox link active long enough to support any discussion around this pull request. Unfortunately Github doesn't support pcap file attachments.