Web page reconstruction
Page 1 of 1

Author:  paulw [ Thu Jan 14, 2010 4:24 pm ]
Post subject:  Web page reconstruction

Two YouTube videos appear to show Xplico reconstructing a page with pictures - however - I have not managed to get this working. Otherwise, the suite is very good.

I am using the VirtualBox images - I see text, place holders for the images and some but not most of the formatting - this is using both my .pcap data and the samples. I have set the proxy on Firefox to localhost port 9876 - stopping Firefox accessing the images online and cleared all the Firefox cache.

I appreciate web page reconstruction is tricky and the suite is being developed heavily.


Author:  gianluca.costa [ Thu Jan 14, 2010 5:00 pm ]
Post subject:  Re: Web page reconstruction

Hi paulw,
inside XI (PHP interface) there is a Proxy (written in PHP, the C implementation -proxplico- is in development) that search requested url inside DB and replay with original content (simulating the cache).

To be able to see the page, the following conditions must be verified:
  • the pcap must contain all the data (all contents of the page)
  • you must choose, from the page of the XI, the URL of the page container
  • you must use the same browser used by the user sniffed (otherwise the page may not be successfully regenerated)
  • set the browser proxy to localhost and port 9876

With version 0.5.4, we switched to the 1.2.x version of CakePHP and we have reimplemented the proxy, so there may be bugs.
If you post your pcap we can understand the problem and find the bug.


Author:  paulw [ Fri Jan 15, 2010 4:22 pm ]
Post subject:  Re: Web page reconstruction

Reverted back to version 0.5.2 and the reconstruction works well; version 0.5.4 not - when you select the proxy as localhost, the user interface stops working - blank display on browser when trying to navigate.

If you remove the proxy, find the web page url list for a session, then apply the proxy, you can get it working - but then as soon as you navigate away to another part of of the UI, it fails again.

I am using the VirtualBox images always. I hope that helps you.

For my previous post, I had not realized the Firefox proxy defaults of excluding localhost and - my bad.


Author:  paulw [ Fri Jan 15, 2010 4:24 pm ]
Post subject:  Re: Web page reconstruction

I am using the samples supplied in the VirtualBox images, so nothing to post. I forgot to mention that.


Author:  carlos.gacimartin [ Sat Jan 16, 2010 1:20 pm ]
Post subject:  Re: Web page reconstruction

Thanks for your feedback. Exactly, in which capture and URL is it failing?

Author:  paulw [ Mon Jan 18, 2010 11:01 am ]
Post subject:  Re: Web page reconstruction

It doesn't matter which samples - the problem I am finding is switching on the localhost proxy on Firefox breaks the user interface on version 0.5.4. On Version 0.5.2 - everything worked. I am using the VirtualBox images.


Page 1 of 1 All times are UTC
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group