Parsing HTTP Traffic

Zeek
1

Could someone point me in the right direction… I simply need to parse out usernames from HTTP packets that look like:

HTTP/1.1 200 OK
Server: nginx/1.4.2
Content-Type: application/json; charset=UTF-8
Content-Length: 104
Connection: keep-alive
Set-Cookie: si=xxxxx; Max-Age=7199; Path=/; expires=Wed, 22-Oct-2014 16:58:11 GMT; HttpOnly

{“username”: “first.last”, “name”: “first last”, “groups”: [“group name goes here”]}

2

You’ll have to reconstruct HTTP bodies and parse the json. There are a few scripts that do the body reconstruction floating around github.

-AK

3

The other option if things are always the same is to just use a couple of regular expressions to indicate where the data should be.