[Python] How to Get the payload Bytes from a packet in scapy along with the parsed HTTP layer...

I need some help in accomplishing 2 things with scapy:

1. extract the payload bytes as integers from the TCP layer
2. Also get access to the HTTP components like the Host , path , Cookies , Headers , User Agent ( which is only possible if an HTTPRequest layer is present )

I guess my questionally finally boils down to . "How to get the payload bytes of TCP instead of returning the < HTTP | HTTPRequest > layer as the payload of TCP layer

But I cant seem to do it with the following code :

from scapy.all import sniff , IP ,TCP , Packet , Raw
from scapy.layers.http import HTTPRequest

def filter_requests(pkt):
return pkt.haslayer(HTTPRequest)

s = sniff(lfilter=filter_requests,count=1)
print(s[0].show())


Output:

###[ Ethernet ]###
dst = 02:42:ac:1c:00:0c
src = 02:42:c9:6c:4e:53
type = IPv4
###[ IP ]###
version = 4
ihl = 5
tos = 0x0
len = 826
id = 38291
flags = DF
frag = 0
ttl = 64
proto = 6
chksum = 0x49e5
src = 172.28.0.1
dst = 172.28.0.12
\options \
###[ TCP ]###
sport = 42858
dport = 8080
seq = 1555050919
ack = 2924584409
dataofs = 8
reserved = 0
flags = PA
window = 251
chksum = 0x5b72
urgptr = 0
options = [('NOP', None), ('NOP', None), ('Timestamp', (3400305181, 2031184976))]
###[ HTTP 1 ]###
###[ HTTP Request ]###
Method = GET
Path = /api/colab/resources?authuser=0
Http_Version= HTTP/1.1
A_IM = None
Accept = */*
Accept_Charset= None
Accept_Datetime= None
Accept_Encoding= gzip, deflate, br, zstd
Accept_Language= en-US,en;q=0.9
Access_Control_Request_Headers= None
Access_Control_Request_Method= None
Authorization= None
Cache_Control= None
Connection= None
Content_Length= None
Content_MD5= None
Content_Type= None
Cookie = None
DNT = None
Date = None
Expect = None
Forwarded = None
From = None
Front_End_Https= None
HTTP2_Settings= None
Host = m-s-23at20h49alz3.us-west1-c.c.codatalab-user-runtimes.internal:8007
If_Match = None
If_Modified_Since= None
If_None_Match= None
If_Range = None
If_Unmodified_Since= None
Keep_Alive= None
Max_Forwards= None
Origin = https://colab.research.google.com
Permanent = None
Pragma = None
Proxy_Authorization= None
Proxy_Connection= None
Range = None
Referer = https://colab.research.google.com/
Save_Data = None
TE = None
Upgrade = None
Upgrade_Insecure_Requests= None
User_Agent= Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Via = 1.1 google
Warning = None
X_ATT_DeviceId= None
X_Correlation_ID= None
X_Csrf_Token= None
X_Forwarded_For= None
X_Forwarded_Host= None
X_Forwarded_Proto= None
X_Http_Method_Override= None
X_Request_ID= None
X_Requested_With= None
X_UIDH = None
X_Wap_Profile= None
Unknown_Headers= {b'Priority': b'u=1, i', b'Sec-Ch-Ua': b'"Google Chrome";v="135", "Not-A.Brand";v="8", "Chromium";v="135"', b'Sec-Ch-Ua-Mobile': b'?0', b'Sec-Ch-Ua-Platform': b'"Windows"', b'Sec-Fetch-Dest': b'empty', b'Sec-Fetch-Mode': b'cors', b'Sec-Fetch-Site': b'cross-site', b'Sec-Fetch-Storage-Access': b'active', b'X-Cloud-Trace-Context': b'b11908db5a9aee242e1e37f7dbcd1d7a/7695440153314682456'}

None


But I also need access to the following things accessed in the below code , how do I get this done :

from scapy.all import sniff , IP ,TCP , Packet
from scapy.config import conf

conf.debug_dissector = 2

def packet_handler(pkt):
if TCP in pkt and IP in pkt and pkt[TCP].payload:
tcp_sport=pkt[TCP].sport
tcp_dport=pkt[TCP].dport
payload_len=len(pkt[TCP].payload)
tcp_dataofs=pkt[TCP].dataofs
tcp_flags=pkt[TCP].flags.value
payload_bytes=list(pkt[TCP].payload.load) ## this seems not accessible with HTTP requests
ip_len=pkt[IP].len
ip_ttl=pkt[IP].ttl
ip_tos=pkt[IP].tos
print(ip_len , ip_tos , ip_ttl , tcp_sport , tcp_dport , payload_len , tcp_dataofs , tcp_flags , payload_bytes)




p=sniff(prn=packet_handler, count=4)
print(p)

Continue reading...