PCAP fuckery

build-files.py

#!/usr/bin/python3

import json
import pathlib
import subprocess
import sys
from urllib import parse

file = sys.argv[1] if len(sys.argv) > 1 else '-'
out = pathlib.Path('out')

with subprocess.Popen(["/usr/bin/tshark", "-r", file, "-Y", "http.response",
        "-T", "ek", "-e", "http.response_for.uri", "-e", "http.file_data"],
        stdout=subprocess.PIPE) as tshark:
    out.mkdir(parents=True, exist_ok=True)
    for line in tshark.stdout:
        data = json.loads(line)
        if ('layers' not in data or 'http_file_data' not in data['layers'] or
                data['layers']['http_file_data'][0] == '<MISSING>'):
            continue
        path = parse.urlsplit(data['layers']['http_response_for_uri'][0]).path
        print(path)
        recoded_path = path.replace('/', '_')
        with (out / f'{data["timestamp"]}{recoded_path}').open(mode='wb') as f:
            hexdata = data['layers']['http_file_data'][0]
            f.write(bytes.fromhex(hexdata))