0

I have a HTTP application running on a server. I cannot modify the application, but I would like to trigger an event when a specific POST request is sent to the application.

I would like to run a bash script and pass it arguments such as the IP of the client making the request and the headers of the HTTP request.

What tools can I use to achieve this? I would like it to be as lightweight as possible and it needs to run on a headless machine.

3 Answers 3

0

In my opinion a good option for these scenarios is using httpry (on Github). It's targeted at HTTP traffic. The output is pretty straightforward to parse and you don't have to care about the filter rules as you'd have to for tcpdump. httpry is based on libpcap just like most other related tools.

Building it was the usual easy make one is used to from other source-only tools (no ./configure the last time I tried it).

0

One way to do this (assuming you are using Apache web server, which is not stated but I imply based on that you are using bash), would be to modify apache to log post data using mod_security or mod_dumpio. (See http://www.cyberciti.biz/faq/apache-mod_dumpio-log-post-data/ and https://modsecurity.org/documentation/modsecurity-apache/1.9.3/html-multipage/07-logging.html).

Then use something to monitor the output and feed that to bash. (Off the top of my head, fail2ban might be able to be configured to do this, but I've not tried it). Alternatively you could try parse the log stream through bash and pick out what you need, or there may be other tools to do it. A crude but easyish approach, depending on how tight your timeframes are might be to regularly rotate the log file (say every minute) with a bash script as part of the log rotation.

3
  • Unfortunately it is not an apache application, I am looking for a solution that works at a network level and is agnostic to the HTTP server implementation.
    – Magnus
    Feb 11, 2013 at 21:23
  • What about setting up an apache proxy in front of it and capturing the data like that ? If something like that does not work you might want to resort to looking a getting information through snort or i7-filter (I have not played much with either of these though)
    – davidgo
    Feb 12, 2013 at 0:19
  • The proxy method should work, but I was really looking for something less obtrusive.
    – Magnus
    Feb 13, 2013 at 0:00
0

I found a way to do this using node.js and the node_pcap module.

You can install it as described here.

It comes with an example of a http listener that can be invoked like so.
sudo node_modules/pcap/examples/http_trace -f "tcp port 80"

It generates an output like

12:11:53.131 undefined:35748 -> 127.0.0.1:80 #2 HTTP 1.1 request: GET /example/css.css
12:11:53.131 127.0.0.1:80 -> undefined:35748 #2 HTTP 1.1 response: 304 Not Modified
12:11:53.131 127.0.0.1:80 -> undefined:35748 #2 HTTP 1.1 response complete 6.08KB

This example was sufficient for my purposes. It provides the Method, URL and IP address.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .