Application Layer Covert Channel Analysis and ... - Bill Buchanan

More documents

Recommendations

Info

Z. Kwecka, BSc (Hons) Network Computing, 2006 124lock(sigSyncArray.SyncRoot){System.Collections.IEnumerator myEnumerator = sigSyncArray.GetEnumerator();while ( myEnumerator.MoveNext() ){connection = (ConTrackingColl)myEnumerator.Current;if( connection.CheckSignature(cntIP,srvIP,cntPort,srvPort)){key = i;break;}//end if signature matchesi++;}//end while}//end lockif (key < 0 ){connection = new ConTrackingColl(cntIP,srvIP,cntPort,srvPort);connection.Add(aPacket);sigSyncArray.Add(connection);ListViewItem aItem = new ListViewItem();key = sigSyncArray.Count-1;aItem.SubItems[0].Text = System.Convert.ToString(key.ToString());aItem.SubItems.Add(System.Convert.ToString(cntIP));aItem.SubItems.Add(System.Convert.ToString(srvIP));aItem.SubItems.Add(System.Convert.ToString(cntPort));aItem.SubItems.Add(System.Convert.ToString(srvPort));lvCon.Items.Add(aItem);}//end if connection does not existelse{connection = (ConTrackingColl) sigSyncArray[key];}if(tcp.DestinationPort == 80){if(connection.getLastDataSize() 10){connection.Add(aPacket);if(device.PcapDumpOpened){device.PcapDump(aPacket);}connection.setRequestedAck(tcp.AcknowledgmentNumber);}connection.setLastDataSize(tcp.Data.Length);}else if(tcp.SourcePort == 80&& tcp.SequenceNumber == connection.getRequestedACK()&& tcp.Data.Length > 10){connection.Add(aPacket);if(device.PcapDumpOpened){device.PcapDump(aPacket);}//sets lastDataSize to 0 if response is 3xx classstring response_line = format.GetString(tcp.Data,0,10);int index = response_line.IndexOf(' ');//MessageBox.Show(response_line.Substring(index+1,1));if(response_line.Substring(index+1,1)=="3"){connection.setLastDataSize(0);}}}//end if source or destination port 80}//end of is TCP}/// /// Application closing event handler - ensures reading from the adapter isstoppedprior closure
Z. Kwecka, BSc (Hons) Network Computing, 2006 125/// /// /// private void HTTPAnalyser_Form1_Closing(object sender,System.ComponentModel.CancelEventArgs e){if(mcStop.Enabled == true){//axPacketXCtrl1.Stop();device.PcapStopCapture();device.PcapClose();}}/// /// Shows About messagebox/// /// /// private void mhAbout_Click(object sender, System.EventArgs e){MessageBox.Show("Author: Zbigniew Kwecka\nSupervisor: Dr William Buchanan");}/// /// cbAdapters selected handler - Changes active adapter/// /// /// private void cbAdapters_SelectedIndexChanged(object sender, System.EventArgs e){if(mcStop.Enabled == true){//axPacketXCtrl1.Stop();device.PcapStopCapture();device.PcapClose();mcStop.Enabled = false;}if(cbAdapters.SelectedIndex >-1){if(getNetConnections[cbAdapters.SelectedIndex] is NetworkDevice){mcStart.Enabled = true;NetworkDevice netConn =(NetworkDevice)getNetConnections[cbAdapters.SelectedIndex];device = netConn;device.PcapOnPacketArrival +=new SharpPcap.PacketArrivalEvent(device_PcapOnPacketArrival);}else{MessageBox.Show("Selected adapter \nis not suitable \nfor packet sniffing");cbAdapters.SelectedIndex = -1;}}}/// /// Menu File Exit - Terminates the application/// /// /// private void menuItem3_Click(object sender, System.EventArgs e){if(mcStop.Enabled == true){//axPacketXCtrl1.Stop();device.PcapStopCapture();device.PcapClose();}Application.Exit();}///
Page 1 and 2:
Application Layer Covert ChannelAna
Page 3 and 4:
Z. Kwecka, BSc (Hons) Network Compu
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11:
Page 14:
Page 17 and 18:
Page 19 and 20:
Page 21 and 22:
Page 23 and 24:
Page 25:
Page 28 and 29:
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56:
Page 60 and 61:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74: Z. Kwecka, BSc (Hons) Network Compu
Page 113: Z. Kwecka, BSc (Hons) Network Compu
Page 138: Z. Kwecka, BSc (Hons) Network Compu
show all

Application Layer Covert Channel Analysis and ... - Bill Buchanan

Create successful ePaper yourself

Delete template?

Save as template?