Extract urs, parameters, headers and json response from pcap file

[nitanmarcel]

Hello.

I have the following code to pull and read an pcap file and sslkey from an android emulator and I noticed it doesn't show the entire http eaders (e.g) I don't get the Authentification Bearer in one of my requests from an app.

Also is it possible to get the json response recieved from the api?

import pyshark
import sys
from ppadb.client import Client as AdbClient
import tempfile
import shutil
import os

app_name = sys.argv[1]

pcap = app_name + ".pcap"
sslkey = app_name + ".txt"

client = AdbClient(host="127.0.0.1", port=5037)
devices = client.devices()

with tempfile.TemporaryDirectory() as tmp:
    for device in devices:
        device.pull("/sdcard/Download/pcap/" + pcap, os.path.join(tmp, pcap))
        device.pull("/sdcard/Download/pcap/" + sslkey, os.path.join(tmp, sslkey))

    parameters_dict = {'-o' : "ssl.keylog_file:%s" % os.path.join(tmp, sslkey)}
    filter = "json"
    cap_json = pyshark.FileCapture(os.path.join(tmp, pcap), display_filter=filter, custom_parameters=parameters_dict)

    for p in cap_json:
        if hasattr(p, "http"):
            p.http.pretty_print()
        if hasattr(p, "http2"):
            p.http2.pretty_print()