Urlsnarf

[mratner]

Ok, thank you.

[7ncubane]

Hi.

I made a slight modification to the command line code and made a script out of it. May be someone may find it useful. It's for logging to usb.

#!/bin/bash
cd /usb/data/urlsnarf/log
now=$(date "+%Y_%m_%d_%H%M.log")
touch $now
urlsnarf -i wlan0 | cut -d " " -f 1,8 | tee $now[/CODE]

The log will have YYYY_MM_DD_HHMM.log format. It will log while you can also keep an eye on it in real time.

One question, though:

Whether I use this script, use firmware, or use urlsnarf module, it seems that only http sites are logged. Are URL's of https sites protected with SSL (not just the content, forms, etc.)?

Another question: when urlsnarf is enabled through the main page (172.16.42.1/pineapple), the log files you get are urlsnarf.log and urlsnarf_clean.log. The output in the "clean" log has everything concise. Anyone know how the output is being filtered and cleaned up? I can't get it as nice with the cut command from the above code. The modules log looks closer to mine. Also, anyone know how to get rid of all the url's from the banner ads? When I run the above code or the module and I go to yahoo.com for example, I wind up with something like 20 to 30 url's, most of which are ad links. Is there a way to get rid of all the extra stuff?

Edited August 9, 2012 by 7ncubane
Added code tags.

[chaosengine]

Is it me, or does urlsnarf only logs sometimes? - I mean, in my testing lab, i have connected up some clients. and enabled urlsnarf from the service, (not from the 'home' page) of the pineapple control centre.

Press enable, logs on USB, and start surfing from the clients. Sometimes it logs like it should, and works perfect.

Other times, it just sits idle on 'urlsnarf output_xxxx.log'

Normally after a couple of restarts of the pineapple and it will start working again.

Im on firmware 2.6.4, urlsnarf v2.3

When it works, its brilliant, I just haven't had it working constantly, after every reboot etc. Is there something im not doing correctly?

[chaosengine]

Hi ther, i still have an issue i think. I have used the latest firmware and now back on 2.5.0 stable. After installing everything one by one and activating urlsnarf and karma urlsnarf worked first time. Then the pineapple restarted on its own. (that happens quite often I must admit, on both 2.5.0 and 2.6.4)

After the restart, URLsnarf would not log. Then i clicked restore factory defaults and rebooted the pineapple. Urlsnarf working as it should again.

I have a feeling the pineapple will restart on its own again tho. The only thing I have done after a flash is plug a USB stick in

config global automount
		 option from_fstab 1
		 option anon_mount 1
config global autoswap
		 option from_fstab 1
		 option anon_swap 1
config mount
		 option target /usb
		 option device /dev/sda1
		 option fstype ext4
		 option options rw,sync
		 option enabled 1
		 option enabled_fsck 0
config swap
		 option device /dev/sda2
		 option enabled 1
[/CODE]

[CODE]
mkswap /dev/sda2
[/CODE]

Using this to enable the USB drive, two partitions both formatted in ext4. Urlsnarf, sslstrip installed to usb and logs on usb.

Edited October 13, 2012 by chaosengine

[thewood]

url snarf seems to not be styling correctly with 2.7?

i just did a fresh install to 2.7

installed the module

clicked it and the picture was the result...while the others are working/styling fine

-because i really was just trying to click enable logs to usb and run the autostart but can't click the options

(minus reaver telling me reaver isn't installed but thats a different thread ;) )

[gsuberland]

Yeah, I get the same problem. Looks like the CSS files don't get installed when 2.7 firmware is used.

[Whistle Master]

version 2.5 is available and should fix the issue :)

[lester]

I'm noticing with using 2.7.0 and activating Urlsnarf on status page and activating Urls snarf module, and tell the Mark IV to install logs on usb that indeed a file is being created in the

usb/data/urlsnarf/log directory but the log directory has permissions set at:

501:20 and the log file has permissions set at root:root

It is always empty, I don't see any urls in the module window whilst surfing yet a file is created with a name such as:

output_13432453.log

it is always empty.

Any suggestions on what might be happening here and why this file is always empty and I don't see any urls passing through the module window?

Thank you.

[PineDominator]

I'm noticing with using 2.7.0 and activating Urlsnarf on status page and activating Urls snarf module, and tell the Mark IV to install logs on usb that indeed a file is being created in the

usb/data/urlsnarf/log directory but the log directory has permissions set at:

501:20 and the log file has permissions set at root:root

It is always empty, I don't see any urls in the module window whilst surfing yet a file is created with a name such as:

output_13432453.log

it is always empty.

Any suggestions on what might be happening here and why this file is always empty and I don't see any urls passing through the module window?

Thank you.

Issue is the urlsnarf module has nothing to do with starting from status page. Reboot pineapple and control urlsnarf only through the module.

[lester]

I will try this suggestion. But I have a question: without the module, where would someone see the urlsnarf data? Prior to importing the module I tried running Urlsnarf from the status page -- it would start but I could find nowhere on any of the tabs to actually see the results.

Thank you.

[PineDominator]

I will try this suggestion. But I have a question: without the module, where would someone see the urlsnarf data? Prior to importing the module I tried running Urlsnarf from the status page -- it would start but I could find nowhere on any of the tabs to actually see the results.

Thank you.

Last I checked it was the last log in the log tab

Something like(/pineapple/logs/urlsnarfclean. log)

[lester]

Hmmm... I removed the module, activated url snarf from the status page and cannot find anything resembling a url snar log in the log tab. I've also noticed this from previous versions -- no place to find the urlsnarf logs. That's why I installed the module. . . because at least it has a tab where one can see the logs.

So I'm back to step 1: no place to view the snarf logs

[lester]

Just did a fresh install 2.7.0 with the latest URL snarf module. here is some weirdness:

within the the /usb/data/urlsnarf/log directory there is a soft link to:

log -> /usb/data/urlsnarf/log

how can there be a soft link to itself?

[Whistle Master]

Hmmm... I removed the module, activated url snarf from the status page and cannot find anything resembling a url snar log in the log tab. I've also noticed this from previous versions -- no place to find the urlsnarf logs. That's why I installed the module. . . because at least it has a tab where one can see the logs.

So I'm back to step 1: no place to view the snarf logs

Start urlsnarf FROM the module, then you will be able to view the logs from the module.

how can there be a soft link to itself?

Could be a bug. I will have a look at it.

Edited December 27, 2012 by Whistle Master

[lester]

thanks Pirate for the information. Problem is, when I start urlsnarf FROM the module indeed it does start. It also will show it has started from the Status page. In any event, starting it from either place does not work -- no logs being created. I get a file with a log name but no data contained therein.

Thank you for your help.

[WallE]

In the history is it possible to see from which IP each URL come from?

I mean if you are on a LAN with multiple device. Can you know who's going where separatly?

[jetpilot]

What interface are we supposed to be monitoring? Is it br-lan?

[Whistle Master]

Depends on your configuration but most of the time, yes, it is br-lan

[jetpilot]

Thanks!