View unanswered posts | View active topics It is currently Sun Aug 25, 2019 9:44 am



Post new topic Reply to topic  [ 6 posts ] 
 Web page reconstruction 
Author Message

Joined: Thu Jan 14, 2010 4:14 pm
Posts: 4
Reply with quote
Post Web page reconstruction
Two YouTube videos appear to show Xplico reconstructing a page with pictures - however - I have not managed to get this working. Otherwise, the suite is very good.

I am using the VirtualBox images - I see text, place holders for the images and some but not most of the formatting - this is using both my .pcap data and the samples. I have set the proxy on Firefox to localhost port 9876 - stopping Firefox accessing the images online and cleared all the Firefox cache.

I appreciate web page reconstruction is tricky and the suite is being developed heavily.


paulw


Thu Jan 14, 2010 4:24 pm
Profile
Site Admin

Joined: Wed Sep 16, 2009 10:09 pm
Posts: 394
Reply with quote
Post Re: Web page reconstruction
Hi paulw,
inside XI (PHP interface) there is a Proxy (written in PHP, the C implementation -proxplico- is in development) that search requested url inside DB and replay with original content (simulating the cache).

To be able to see the page, the following conditions must be verified:
  • the pcap must contain all the data (all contents of the page)
  • you must choose, from the page of the XI, the URL of the page container
  • you must use the same browser used by the user sniffed (otherwise the page may not be successfully regenerated)
  • set the browser proxy to localhost and port 9876

With version 0.5.4, we switched to the 1.2.x version of CakePHP and we have reimplemented the proxy, so there may be bugs.
If you post your pcap we can understand the problem and find the bug.

Ciao.
Gianluca


Thu Jan 14, 2010 5:00 pm
Profile WWW

Joined: Thu Jan 14, 2010 4:14 pm
Posts: 4
Reply with quote
Post Re: Web page reconstruction
Reverted back to version 0.5.2 and the reconstruction works well; version 0.5.4 not - when you select the proxy as localhost, the user interface stops working - blank display on browser when trying to navigate.

If you remove the proxy, find the web page url list for a session, then apply the proxy, you can get it working - but then as soon as you navigate away to another part of of the UI, it fails again.

I am using the VirtualBox images always. I hope that helps you.

For my previous post, I had not realized the Firefox proxy defaults of excluding localhost and 127.0.0.1 - my bad.


paulw


Fri Jan 15, 2010 4:22 pm
Profile

Joined: Thu Jan 14, 2010 4:14 pm
Posts: 4
Reply with quote
Post Re: Web page reconstruction
I am using the samples supplied in the VirtualBox images, so nothing to post. I forgot to mention that.


paulw


Fri Jan 15, 2010 4:24 pm
Profile

Joined: Wed Sep 16, 2009 10:45 pm
Posts: 128
Reply with quote
Post Re: Web page reconstruction
Thanks for your feedback. Exactly, in which capture and URL is it failing?


Sat Jan 16, 2010 1:20 pm
Profile

Joined: Thu Jan 14, 2010 4:14 pm
Posts: 4
Reply with quote
Post Re: Web page reconstruction
It doesn't matter which samples - the problem I am finding is switching on the localhost proxy on Firefox breaks the user interface on version 0.5.4. On Version 0.5.2 - everything worked. I am using the VirtualBox images.


paulw


Mon Jan 18, 2010 11:01 am
Profile
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group.
Designed by Vjacheslav Trushkin for Free Forums/DivisionCore.