PyTLSSniff
PyTLSSniff - Python TLS handshake sniffer to extract domain names
Getting Started
Prerequisites for installation
This project uses the Python wrapper for tshark (pyshark). It is therefore necessary to install tshark before using PyTLSSniff.
Debian / Ubuntu / Mint
sudo apt install tshark
Install PyTLSSniff
pip3 install PyTLSSniff
Visit PyTLSSniff on PyPi: https://pypi.org/project/PyTLSSniff
Usage
Command line parameters
pytlssniff [-h] [-d] [-s] [-a] [-c] [-i INTERFACE] [-r INPUT_FILE]
[-p PACKET_COUNT] [-b BPF_FILTER] [-Y DISPLAY_FILTER]
optional arguments:
-h, --help show this help message and exit
-d, --debug enable debug mode
-s, --sni sniff SNI values from TLS handshakes
-a, --san sniff domains from certificate SAN section
-c, --cn sniff Common Name from certificate CN section
-i INTERFACE, --interface INTERFACE
name or idx of interface (default: any)
-r INPUT_FILE, --input-file INPUT_FILE
set the filename to read from (- to read from stdin)
-p PACKET_COUNT, --packet-count PACKET_COUNT
stop after n packets (def: infinite)
-b BPF_FILTER, --bpf-filter BPF_FILTER
packet filter in Berkeley Packet Filter (BPF) syntax
(for live trace only)
-Y DISPLAY_FILTER, --display-filter DISPLAY_FILTER
packet displaY filter in Wireshark display filter
Live trace example with Berkeley Packet Filter (BPF)
$ pytlssniff -s -i eth0 -p 5 -b "ip host 10.8.3.35"
client_hello(1) IPv4 10.8.3.35:60588 88.99.24.79:443 biot.com
client_hello(1) IPv4 10.8.3.35:53412 91.198.174.194:443 wikipedia.com
client_hello(1) IPv4 10.8.3.35:58990 91.198.174.192:443 www.wikipedia.org
client_hello(1) IPv4 10.8.3.35:55302 140.82.118.3:443 github.com
client_hello(1) IPv4 10.8.3.35:48082 185.199.110.154:443 github.githubassets.com
File trace example with Wireshark display filter
$ pytlssniff -s -r "~/example/trace.pcap" -Y "ip.addr == 10.8.3.35"
client_hello(1) IPv4 10.8.3.35:56670 91.198.174.192:443 www.wikipedia.org
client_hello(1) IPv4 10.8.3.35:52000 91.198.174.208:443 upload.wikimedia.org
client_hello(1) IPv4 10.8.3.35:56674 91.198.174.192:443 de.wikipedia.org
client_hello(1) IPv4 10.8.3.35:52984 140.82.118.3:443 github.com
client_hello(1) IPv4 10.8.3.35:51770 151.101.12.133:443 avatars0.githubusercontent.com
1 maintainer
Metadata
1 maintainer
Release files for PyTLSSniff 0.1.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| PyTLSSniff-0.1.3.tar.gz | 6.0 kB | Without provenance | Details for PyTLSSniff-0.1.3.tar.gz |
Release files / PyTLSSniff-0.1.3.tar.gz
| Download URL | PyTLSSniff-0.1.3.tar.gz |
|---|---|
| Size | 6.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
7e23a6df0ada610366ad928ef41858ac3490b0521f889cce4d51ef81f54ced1c
|
|
BLAKE2b-256 checksum How to use checksums |
fab06f2fbd2ff75fbfe131422b6f11716cb84ef3adcc853248f65ed82fdf42ba
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.1.1 pkginfo/1.5.0.1 requests/2.23.0 setuptools/46.1.3 requests-toolbelt/0.9.1 tqdm/4.46.0 CPython/3.6.10
|
Security for PyTLSSniff 0.1.3
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
