public object applyOn(SpotterFRPC spotter) { var msg = new MailMsg(); foreach (var item in spotter.Items) { var methodCall = item as FRPCparser.FRPCMethodCall; if (methodCall == null || !methodCall.Name.Equals("user.message.send")) { continue; } foreach (var param in methodCall.Parameters) { var email = param as FRPCparser.FRPCStruct; if (email == null) { continue; } foreach (var it in email.Items) { if (it.Key.Equals("subject")) { var itSubj = it.Value as FRPCparser.FRPCString; msg.Subject = itSubj?.Value; } else if (it.Key.Equals("body")) { var itBody = it.Value as FRPCparser.FRPCString; msg.Body = itBody?.Value; } else if (it.Key.Equals("to")) { var recips = it.Value as FRPCparser.FRPCArray; if (recips != null) { msg.To = GetAddresses(recips); } } else if (it.Key.Equals("from")) { var senders = it.Value as FRPCparser.FRPCArray; if (senders != null) { msg.From = GetAddresses(senders); } } } } } return(msg); }
public void TestSpotterFRPC() { this.FrameworkController.ProcessCapture(this.PrepareCaptureForProcessing(SnoopersPcaps.Default.webmail_webmail_seznam_pcapng)); var conversations = this.L7Conversations.ToArray(); var pk = File.ReadAllText(PrivateKeys.Default.pk_pem); foreach (var conversation in conversations) { conversation.Key = new CypherKey(); conversation.Key.ServerPrivateKey = pk; } this.FrameworkController.ExportData(this.AvailableSnoopers.Where(x => x is SnooperHTTP.SnooperHTTP), conversations, this.CurrentTestBaseDirectory, true); var msgObject = this.SnooperExports.ToArray()[0].ExportObjects[14] as SnooperExportedDataObjectHTTP; Assert.AreNotEqual(null, msgObject); var msg = msgObject.Message; var spotter = new SpotterFRPC(); spotter.Init(msg); /* verify true states */ Assert.AreEqual(true, spotter.IsSpottable()); Assert.AreEqual(true, spotter.ContainsOneOf(new[] { "nieco", "subject" }, SpotterBase.SpotterContext.ContentKey)); Assert.AreEqual(true, spotter.Contains("user.message.send", SpotterBase.SpotterContext.AllKey)); Assert.AreEqual(true, spotter.ContainsKeyValuePair("subject", "Re: test opera", SpotterBase.SpotterContext.ContentPair)); /* verify false states */ Assert.AreEqual(false, spotter.ContainsOneOf(new[] { "nieco", "ine" }, SpotterBase.SpotterContext.ContentKey)); Assert.AreEqual(false, spotter.Contains("hocico", SpotterBase.SpotterContext.AllKey)); Assert.AreEqual(false, spotter.ContainsKeyValuePair("subject", "Confidentioal", SpotterBase.SpotterContext.AllPair)); }
public object applyOn(SpotterFRPC spotter) { var list = new List <MailMsg>(); foreach (var item in spotter.Items) { var methodResponse = item as FRPCparser.FRPCMethodRespone; if (methodResponse == null) { continue; } foreach (var data in methodResponse.Data) { var msgStruct = data as FRPCparser.FRPCStruct; if (msgStruct == null) { continue; } foreach (var msgItem in msgStruct.Items) { if (!msgItem.Key.Equals("messages")) { continue; } var msgArray = msgItem.Value as FRPCparser.FRPCArray; if (msgArray == null) { continue; } foreach (var msg in msgArray.Items) { var mailMsg = new MailMsg(); var email = msg as FRPCparser.FRPCStruct; if (email == null) { continue; } foreach (var it in email.Items) { if (it.Key.Equals("subject")) { var itSubj = it.Value as FRPCparser.FRPCString; mailMsg.Subject = itSubj?.Value; } else if (it.Key.Equals("abstract")) { var itBody = it.Value as FRPCparser.FRPCString; mailMsg.Body = itBody?.Value; } else if (it.Key.Equals("to")) { var recips = it.Value as FRPCparser.FRPCArray; if (recips != null) { mailMsg.To = SeznamGetNewMessage.GetAddresses(recips); } } else if (it.Key.Equals("from")) { var senders = it.Value as FRPCparser.FRPCArray; if (senders != null) { mailMsg.From = SeznamGetNewMessage.GetAddresses(senders); } } else if (it.Key.Equals("folder")) { var folder = it.Value as FRPCparser.FRPCInteger8; if (folder != null) { mailMsg.SourceFolder = folder.Value.ToString(); } } } list.Add(mailMsg); } } } } return(list); }
public object applyOn(SpotterFRPC spotter) { throw new NotImplementedException(); }