技術標籤：pythonCTFpythonpysharkwireshark

使用pyshark獲取對應欄位的值需要逐級檢視

In [1]: from pyshark import FileCapture

In [2]: cap = FileCapture('test.pcapng', display_filter="http.content_length")

In [3]: cap[0]
Out[3]: <TCP/DATA-TEXT-LINES Packet>

In [4]: cap[0].http
Out[4]: <HTTP Layer>

In [5]: dir(cap[0].http)
Out[5]:
['',
 'DATA_LAYER',
 '__class__',
 '__delattr__',
 '__dict__',
 '__dir__',
 '__doc__',
 '__eq__',
 '__format__',
 '__ge__',
 '__getattr__',
 '__getattribute__',
 '__getstate__',
 '__gt__',
 '__hash__',
 '__init__',
 '__init_subclass__',
 '__le__',
 '__lt__',
 '__module__',
 '__ne__',
 '__new__',
 '__reduce__',
 '__reduce_ex__',
 '__repr__',
 '__setattr__',
 '__setstate__',
 '__sizeof__',
 '__str__',
 '__subclasshook__',
 '__weakref__',
 '_all_fields',
 '_field_prefix',
 '_get_all_field_lines',
 '_get_all_fields_with_alternates',
 '_get_field_or_layer_repr',
 '_get_field_repr',
 '_layer_name',
 '_sanitize_field_name',
 '_ws_expert',
 '_ws_expert_group',
 '_ws_expert_message',
 '_ws_expert_severity',
 'chat',
 'connection',
 'content_length',
 'content_length_header',
 'content_type',
 'date',
 'field_names',
 'file_data',
 'get',
 'get_field',
 'get_field_by_showname',
 'get_field_value',
 'last_modified',
 'layer_name',
 'pretty_print',
 'raw_mode',
 'request_in',
 'response',
 'response_code',
 'response_code_desc',
 'response_for_uri',
 'response_line',
 'response_number',
 'response_phrase',
 'response_version',
 'server',
 'time']
 

到這就可以看出，想要取出data部分的值，用file_data就可以

In [7]: cap[0].http.file_data
Out[7]: 'fl

實際檢測一下

發現結果與想要讀取的值一樣