search

spq / pkappa2

Network traffic analysis tool for Attack & Defense CTF's
Apache License 2.0
42 stars 11 forks source link

Highlight query matches in stream data #73

Closed peace-maker closed 1 day ago

peace-maker commented 10 months ago

When looking for "AAAA" highlight all occurences of "AAA" in the stream data view. Maybe allow to skip/scroll to the next occurence would be useful too.

peace-maker commented 1 week ago

One way to implement this would be to send the [cs]data query parts in the response separately as well and match the data again using RegExp objects in javascript.

This might highlight more than just the data that was actually causing the stream to be selected due to queries like cdata:"do handshake" then sdata:"hi bob" where we check if the client sent something before matching the server data. If the server sent "hi bob" before the client sent anything, the naive approach to just highlight all [cs]data patterns would highlight that too even though it wasn't what caused the stream to match the query.

Similarly, queries using variables would need special treatment to get the real values for the match cdata:"(?P<flag>ENO[A-Za-z0-9+\/=]{48})" then cdata:"@flag@".

I think those complex query use cases can be left as a TODO in the first implementation since the majority of queries don't use those query features [citation needed]™️