Wireshark抓包及分析——HTTP

港控/mmm° 2023-10-11 10:14 57阅读 0赞

1、首先我们打开 Wireshark，可以看到有很多的网络，选择自己正在使用的网络，比如我现在就是使用 WLAN，双击点开就可以了。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjEwOTAxMg_size_16_color_FFFFFF_t_70]

2、然后开始抓包分析，在浏览器中输入网址  
![在这里插入图片描述][20190922221556296.png]

3、可以看到 Wireshark 已经抓到很多数据包，然后过滤，筛选出 HTTP 数据包。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjEwOTAxMg_size_16_color_FFFFFF_t_70 1]

**4、接下来才是对 HTTP 数据包的分析。**  
双击点开HTTP请求、HTTP响应（最前面——箭头向右的是请求，箭头向左的是响应）

（1）Frame
    物理层的数据帧概况。
    （2）Ethernet II
    数据链路层以太网帧头部信息，一般包含源（本机）、目的地（服务器）物理地址（MAC）。
    （3）Internet Protocol Version 4
    互联网层IP包头部信息，一般包含源（本机）、目的地（服务器）IP地址。
    （4）Transmission Control Protocol
    传输层的数据段头部信息，此处是TCP协议，一般包含源（本机）、目的地（服务器）端口和连接状态。
    （5）Hypertext Transfer Protocol
    应用层的信息，此处是HTTP协议。

我着重要解读的是HTTP协议包解读。  
**下面就是一个请求数据包**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjEwOTAxMg_size_16_color_FFFFFF_t_70 2]

> Frame 432: 536 bytes on wire (4288 bits), 536 bytes captured (4288 bits) on interface 0
    > Ethernet II, Src: Cybertan_83:22:81 (60:14:b3:83:22:81), Dst: XiaomiEl_1b:75:f7 (40:31:3c:1b:75:f7)
    > Internet Protocol Version 4, Src: 192.168.31.208, Dst: 128.119.245.12
    > Transmission Control Protocol, Src Port: 56556, Dst Port: 80, Seq: 1, Ack: 1, Len: 482
    v Hypertext Transfer Protocol
    	v GET /ethereal-labs/HTTP-ethereal-file1.html HTTP/1.1\r\n										#请求信息
    		v [Expert Info (Chat/Sequence): GET /ethereal-labs/HTTP-ethereal-file1.html HTTP/1.1\r\n]	#专家信息
    			[GET /ethereal-labs/HTTP-ethereal-file1.html HTTP/1.1\r\n]
    			[Severity level: Chat]
    			[Group: Sequence]
    		Request Method: GET																			#请求方式 GET
    		Request URI: /ethereal-labs/HTTP-ethereal-file1.html										#请求地址
    		Request Version: HTTP/1.1																	#请求版本，即本机浏览器（客服端的版本）
    	Host: gaia.cs.umass.edu\r\n																		#请求主机
    	Connection: keep-alive\r\n																		#使用持久连接
    	Cache-Control: max-age=0\r\n																	#检验是否有本地缓存，max-age>0 时 直接从游览器缓存中 提取max-age<=0 时 向server 发送http 请求确认 ,该资源是否有修改 
    	Upgrade-Insecure-Requests: 1\r\n
    	User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36\r\n	#浏览器类型
    	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\r\n	#请求的类型
    	Accept-Encoding: gzip, deflate\r\n																#请求的编码格式
    	Accept-Language: zh-CN,zh;q=0.9\r\n																#请求的语言
    	\r\n
    	[Full request URI: http://gaia.cs.umass.edu/ethereal-labs/HTTP-ethereal-file1.html]				#完整的请求 URL 路径
    	[HTTP request 1/1]																				#HTTP请求进度 1/1
    	[Response in frame: 438]																		#响应帧，编号

**下面就是一个响应数据包，可以看到一些传递数据**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjEwOTAxMg_size_16_color_FFFFFF_t_70 3]

> Frame 438: 538 bytes on wire (4304 bits), 538 bytes captured (4304 bits) on interface 0
    > Ethernet II, Src: XiaomiEl_1b:75:f7 (40:31:3c:1b:75:f7), Dst: Cybertan_83:22:81 (60:14:b3:83:22:81)
    > Internet Protocol Version 4, Src: 128.119.245.12, Dst: 192.168.31.208
    > Transmission Control Protocol, Src Port: 80, Dst Port: 56556, Seq: 1, Ack: 483, Len: 484
    v Hypertext Transfer Protocol
    	v HTTP/1.1 200 OK\r\n																			#响应信息
    		v [Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]										#专家信息
    			[HTTP/1.1 200 OK\r\n]
    			[Severity level: Chat]
    			[Group: Sequence]
    		Response Version: HTTP/1.1																	#响应版本，即服务器版本
    		Status Code: 200																			#状态码
    		[Status Code Description: OK]																#响应状态码描述
    		Response Phrase: OK																			#响应短语
    	Date: Sat, 21 Sep 2019 08:34:51 GMT\r\n															#响应时间
    	Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 mod_perl/2.0.10 Perl/v5.16.3\r\n	#服务器信息
    	Last-Modified: Sat, 21 Sep 2019 05:59:02 GMT\r\n												#上一次修改时间
    	ETag: "7e-59309e22c0357"\r\n																	#上一次修改标志
    	Accept-Ranges: bytes\r\n																		#接收范围
    	v Content-Length: 126\r\n																		#内容长度
    		[Content length: 126]
    	Keep-Alive: timeout=5, max=100\r\n																#保持响应时间,以及最大值#
    	Connection: Keep-Alive\r\n																		#持久连接
    	Content-Type: text/html; charset=UTF-8\r\n														#响应的内容类型
    	\r\n
    	[HTTP response 1/1]																				#HTTP响应进度 1/1
    	[Time since request: 0.253416000 seconds]														#响应时间
    	[Request in frame: 432]																			#请求帧，编号
    	[Request URI: http://gaia.cs.umass.edu/ethereal-labs/HTTP-ethereal-file1.html]					#完整 URL 路径
    	File Data: 126 bytes																			#文件长度
    v Line-based text data: text/html (4 lines)															#响应数据内容
    	<html>\n
    	Congratulations.  You've downloaded the file \n
    	http://gaia.cs.umass.edu/ethereal-labs/HTTP-ethereal-file1.html!\n
    	</html>\n

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjEwOTAxMg_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20190922190331944.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjEwOTAxMg==,size_16,color_FFFFFF,t_70
[20190922221556296.png]: https://img-blog.csdnimg.cn/20190922221556296.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjEwOTAxMg_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20190922191839756.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjEwOTAxMg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjEwOTAxMg_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20190922185454912.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjEwOTAxMg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjEwOTAxMg_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20190922221515781.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MjEwOTAxMg==,size_16,color_FFFFFF,t_70