mushorg / buttinsky

Botnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. Our tool will provide an open source framework for automated botnet monitoring. The modular design will allow full customization of the used protocols, the monitoring clients behavior, how we log the collected information, processing of the data to analyze the botnets purpose, size and threat and how the monitoring task are distributed between dedicated nodes.
http://buttinsky.org
GNU General Public License v3.0
79 stars 27 forks source link

General HTTP protocol implementation #8

Closed glaslos closed 11 years ago

glaslos commented 11 years ago

Provide the standard HTTP methods and parsers for requests, responses, header and payloads.

adepasquale commented 11 years ago

Correct me if I am wrong, but I guess this could be done by customizing one of the many available HTTP libraries. This way we can keep separate the protocol_layer from the network_layer, as in current buttinsky code.

glaslos commented 11 years ago

Yes, that should basically do it. I think the main part for this is to provided all the options in the settings file to customize the HTTP request. E.g. user agent, HTTP version... The actual request should be in the behavior layer I'd say.

glaslos commented 11 years ago

I don't think we need a HTTP library. Just provide basic HTTP requesting and response parsing. The request and response part will be usually customized so we have to make this as open as possible.

adepasquale commented 11 years ago

Do you mean "basic" in a way that provides the following?

glaslos commented 11 years ago

Pretty much.

adepasquale commented 11 years ago

I have trouble with this code. iqueue.get() works for IRC where the server has a banner, but not for HTTP.

class Client(object):
    # ...
    def _event_loop(self):
        while True:
            line = self.conn.iqueue.get()
            if self.layer1 != None:
                self.layer1.receive(Message(line))

P.S. Sorry for the duplicate commits, I've pushed a rebased branch.

glaslos commented 11 years ago

Is that blocking your connection? You could try a iqueue.get_nowait() and catch the Empty exception. Careful, this might put you in a CPU eating loop :)

adepasquale commented 11 years ago

Maybe it's better if I do that only for the first time, before the loop. :-) I'll do some testing and let you know.

glaslos commented 11 years ago

@adepasquale do you consider this done?

glaslos commented 11 years ago

Needs some more testing but otherwise done.