Sniffing HTTP with httpry 0.1.6

I was skeptical when I first saw this come across Packetstorm, but I gave it a shot, like most tools that come rifling through there. I believe that if you make a security tool intended for UNIX it had better have a version compatible with Debian, the most popular OS for quick security testing.

It is easy to install and ran great the very first time with no problems. I was hesitant before because this kind of task can already be done with tools provided by UNIX already and I am not sure what kind of use this tool has for security when other tools are out there. If the project keeps moving forward it could be a seriously handy tool.

In the description it says it doesn't handle the analysis of the HTTP traffic it has logged, maybe that is something to mess with, or maybe I will make a parser. However, anything logged to files can be easily pulled with Regular Expressions. Here are the steps to install httpry 0.1.6 from Packetstorm.

1. wget http://packetstorm.igor.onlinedirect.bg/sniffers/httpry-0.1.6.tar.gz
2. tar -xvf httpry-0.1.6.tar.gz
3. cd httpry-0.1.6
4. make
5. ./httpry

You can run httpry by typing ./httpry and just wait for the traffic to roll in. Below I ran httpry while downloading lynx (a command line http browser) via apt-get repositories.

to stop capturing I simply issued a ctrl+c and it closed it for me and told me how many packets were logged. There is an extensive README file which can help you discover more. I think this is and will continue to be a good tool for securing yourself against http infections. Here are some command line switches for reference:

1. -b FILE
2. -d
3. -f FORMAT
4. -F
5. -h
6. -i
7. -m METHODS
8. -n COUNT
9. -o FILE
10. -p
11. -q
12. -r FILE
13. -t SECONDS
14. -u USER

Wireshark 1.4.6

Ever since Wireshark come on the scene it was adopted as the #1 LAN sniffer for security demonstrations, says me. You don't have to believe all the hype and can go back to your console screen logging hours at the page down key. Wireshark for Windows is the best choice for capturing LAN traffic. Download Wireshark Here.

Wireshark is extremely easy to use and even a novice can start capturing data on the network. Wireshark features a very rich system to let you edit and resend packets over the network. You can set it to stop capturing after 'x' amount of packets which can be VERY handy for testing application bugs. You can control the size of capture log files and even use multiple files to log your captures too.