public void TestSpotterJson() { this.FrameworkController.ProcessCapture(this.PrepareCaptureForProcessing(SnoopersPcaps.Default.webmail_webmail_yahoo_rc4_pcapng)); var conversations = this.L7Conversations.ToArray(); var pk = File.ReadAllText(PrivateKeys.Default.pk_pem); foreach (var conversation in conversations) { conversation.Key = new CypherKey(); conversation.Key.ServerPrivateKey = pk; } this.FrameworkController.ExportData(this.AvailableSnoopers.Where(x => x is SnooperHTTP.SnooperHTTP), conversations, this.CurrentTestBaseDirectory, true); var msgObject = this.SnooperExports.ToArray()[0].ExportObjects[41] as SnooperExportedDataObjectHTTP; Assert.AreNotEqual(null, msgObject); var msg = msgObject.Message; var spotter = new SpotterJson(); spotter.Init(msg); /* verify true states */ Assert.AreEqual(true, spotter.IsSpottable()); Assert.AreEqual(true, spotter.ContainsOneOf(new[] { "nieco", "Test Netfox" }, SpotterBase.SpotterContext.ContentValue)); Assert.AreEqual(true, spotter.Contains("message", SpotterBase.SpotterContext.AllKey)); Assert.AreEqual(true, spotter.ContainsKeyValuePair("subject", "nova sprava", SpotterBase.SpotterContext.ContentPair)); /* verify false states */ Assert.AreEqual(false, spotter.ContainsOneOf(new[] { "nieco", "ine" }, SpotterBase.SpotterContext.ContentKey)); Assert.AreEqual(false, spotter.Contains("hocico", SpotterBase.SpotterContext.AllKey)); Assert.AreEqual(false, spotter.ContainsKeyValuePair("subject", "Confidentioal", SpotterBase.SpotterContext.AllPair)); }