https://github.com/dethada/sni-sniffer
Extract domains visited through SNI sniffing.
https://github.com/dethada/sni-sniffer
network rust sni sniffing
Last synced: 10 months ago
JSON representation
Extract domains visited through SNI sniffing.
- Host: GitHub
- URL: https://github.com/dethada/sni-sniffer
- Owner: Dethada
- License: gpl-3.0
- Created: 2019-07-08T14:05:22.000Z (about 7 years ago)
- Default Branch: master
- Last Pushed: 2019-07-08T14:05:37.000Z (about 7 years ago)
- Last Synced: 2025-04-21T10:57:34.821Z (over 1 year ago)
- Topics: network, rust, sni, sniffing
- Language: Rust
- Homepage:
- Size: 27.3 KB
- Stars: 10
- Watchers: 2
- Forks: 4
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# SNI-Sniffer
Extract domains visited through SNI sniffing.
```
Started capturing on ens33
TCP V4(192.168.14.128):50596 -> V4(172.217.27.46):443
SNI: [
"google.com",
]
TCP V4(192.168.14.128):51262 -> V4(117.18.232.200):443
SNI: [
"az764295.vo.msecnd.net",
]
TCP V4(192.168.14.128):45508 -> V4(111.221.29.254):443
SNI: [
"vortex.data.microsoft.com",
]
TCP V4(192.168.14.128):40952 -> V4(172.217.160.10):443
SNI: [
"safebrowsing.googleapis.com",
]
TCP V4(192.168.14.128):37934 -> V4(35.166.72.120):443
SNI: [
"shavar.services.mozilla.com",
]
```
## Notes
For interface sniffing you must run the program as root.
## TO-DO
- [ ] Show Date/Time Request was made
- [ ] Output to csv/json
- [ ] Better formatted output
```
Date/Time Request was made,
Source Address,
Source Port,
SNI,
Remote Address,
Remote Port,
```
## Sources
This project is built based on the following sources.
- https://github.com/rusticata/rusticata/blob/master/src/tls.rs
- https://github.com/rusticata/pcap-parse/blob/master/src/main.rs
- https://github.com/libpnet/libpnet/blob/master/examples/packetdump.rs