Improved (a lot) target hostname resolution and coloring.

nunomcruz · Dec 23, 2016 · 07251e1 · 07251e1
1 parent 46c6890
commit 07251e1
Show file tree

Hide file tree

Showing 4 changed files with 49 additions and 39 deletions.
diff --git a/lib/bettercap/network/network.rb b/lib/bettercap/network/network.rb
@@ -85,6 +85,30 @@ def get_hw_address( ctx, ip )
     hw
   end
 
+  def ip2name( address )
+    begin
+      names = Resolv.getnames(address)
+      hostname = names[0]
+      names.each do |name|
+        unless name.nil? or name.end_with?('.') or name.strip.empty?
+          hostname = name
+        end
+      end
+      unless hostname.empty?
+        return hostname
+      end
+    rescue; end
+
+    begin
+      hostname = Resolv.getname(address)
+      unless hostname.empty?
+        return hostname
+      end
+    rescue; end
+
+    address.to_s
+  end
+
   private
 
   # Start discovery agents and wait for +ctx.timeout+ seconds for them to

diff --git a/lib/bettercap/network/target.rb b/lib/bettercap/network/target.rb
@@ -97,7 +97,7 @@ def to_s(padding=true)
 
   # Return a compact string representation of this object.
   def to_s_compact
-    return "#{@name}/#{@ip}" if @name
+    return "#{@name.light_blue}/#{@ip}" if @name
     @ip
   end
 
@@ -122,21 +122,31 @@ def self.normalized_mac(v)
 
   # Attempt to perform a NBNS name resolution for this target.
   def resolve!
-    resp, sock = nil, nil
-    begin
-      sock = UDPSocket.open
-      sock.send( NBNS_REQUEST, 0, @ip, NBNS_PORT )
-      resp = if select([sock], nil, nil, NBNS_TIMEOUT)
-        sock.recvfrom(NBNS_BUFSIZE)
+    hostname = Network.ip2name(@ip)
+    if hostname == @ip
+      resp, sock = nil, nil
+      begin
+        sock = UDPSocket.open
+        sock.send( NBNS_REQUEST, 0, @ip, NBNS_PORT )
+        resp = if select([sock], nil, nil, NBNS_TIMEOUT)
+          sock.recvfrom(NBNS_BUFSIZE)
+        end
+        if resp
+          @name = parse_nbns_response resp
+          Logger.info "Found NetBIOS name '#{@name}' for address #{@ip}"
+        end
+      rescue Exception => e
+        Logger.debug e
+      ensure
+        sock.close if sock
       end
-      if resp
-        @name = parse_nbns_response resp
-        Logger.info "Found NetBIOS name '#{@name}' for address #{@ip}"
+    else
+      if hostname.include?('.')
+        @name = hostname.split('.')[0]
+      else
+        @name = hostname
       end
-    rescue Exception => e
-      Logger.debug e
-    ensure
-      sock.close if sock
+      Logger.info "Found hostname #{@name.green} for address #{@ip}"
     end
   end
 

diff --git a/lib/bettercap/sniffer/parsers/base.rb b/lib/bettercap/sniffer/parsers/base.rb
@@ -100,30 +100,6 @@ def match_port?( pkt )
     false
   end
 
-  def ip2name( address )
-    begin
-      names = Resolv.getnames(address)
-      hostname = names[0]
-      names.each do |name|
-        unless name.nil? or name.end_with?('.') or name.strip.empty?
-          hostname = name
-        end
-      end
-      unless hostname.empty?
-        return hostname
-      end
-    rescue; end
-
-    begin
-      hostname = Resolv.getname(address)
-      unless hostname.empty?
-        return hostname
-      end
-    rescue; end
-
-    address.to_s
-  end
-
   # This method will be called from the BetterCap::Sniffer for each
   # incoming packet ( +pkt ) and will apply the parser filter to it.
   def on_packet( pkt )

diff --git a/lib/bettercap/sniffer/parsers/https.rb b/lib/bettercap/sniffer/parsers/https.rb
@@ -21,7 +21,7 @@ def on_packet( pkt )
     begin
       if pkt.respond_to?(:tcp_dst) and pkt.tcp_dst == 443
         Thread.new do
-          hostname = self.ip2name( pkt.ip_daddr )
+          hostname = BetterCap::Network.ip2name( pkt.ip_daddr )
           if @@prev.nil? or @@prev != hostname
             StreamLogger.log_raw( pkt, 'HTTPS', "https://#{hostname}/" )
             @@prev = hostname