farsightsec / nmsg

network message encapsulation library

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

nmsgtool incomplete json output?

xkrt opened this issue · comments

Hi,

I have nmsg file with vendor base and type dnsqr.
When I use 'pres' output (nmsgtool -r file.nmsg -o -) I have full output with all sections (ANSWER, AUTHORITY, etc).

But when I use 'json' output format (nmsgtool -r file.nmsg -J -) I didnt see any answer, authority section data.

Can I get same data in 'json' output as in 'pres' somehow? It will be very convinient for later processing.

Greetings,

The data you are looking for is actually present in the JSON output, however it is in packet format and Base64 Encoded under the response_packet/response fields. We'll look into making the output more directly addressable.

Thanks

You can decode the packet using python-wdns like this. I have removed the extra fields from the message for brevity.

import base64
import json

import wdns

m = json.loads('''
{
    "message": {
        "response": "53eEEAABAAEAAgAHB2RlYmlhbjEHZG5zbm9kZQNuZXQAABwAAcAMABwAAQAAHCAAECABBnwQEAAyAAAAAAAAAFPAFAACAAEAABwgABUFc2xhdmUDc3RoBm5ldG5vZAJzZQDAFAACAAEAABwgAAwFc2xhdmUDZ2JnwFfAbgABAAEAABwgAATAJIV0wE0AAQABAAAcIAAEwCSQdMBNABwAAQAAHCAAECoBA/AAAAMAAAAAAAAAAFPAbgAuAAEAABwgAJ0AAQgEAAAcIFdZO21XMbiL97AGbmV0bm9kAnNlAB2GX8ibvch5t0NnIWKsWkP1qHKtxnVe+BjQQf3O9W6TP/kxU1yF0ulvgAbBrM7tTJL4aUzWXV0P6eT8qJrhpgDHTL/KDQv/hZyG0olRDl7FyNQrQtGuiKqJ4sp1WHw5OXTmKat2AHiBhDgylUU3gYaheFNUdttRppu8yN/bqNFTwE0ALgABAAAcIACdAAEIBAAAHCBXWTz0VzG4i/ewBm5ldG5vZAJzZQCajAeYlyBhR+ZVNa4OGCRLDl7i5R02ZVaQqZ2Ht2h6NjwiuMJG53CqHK+pfV4oYZcJHFLW8fKanYbwTUlZlM5t+596hzUBs6hrS320brd8CCDHOhdce4Fl+8E9eqFGGzOCi4o5a9zT8eu66lVH15DnbsZq5vLx+v5kXS6uhpll+8BNAC4AAQAAHCAAnQAcCAQAABwgV1lBWFcxuIv3sAZuZXRub2QCc2UAi/614TpZyin1hWX7rVe5nV9nH6i1J5/dlpRRRpYCGyrCtZyzLbNn10Sg8O5d33L8W6QzSy6sxuVQCe6b6b5djOy6f5r82ThAA2iR8srbUgXSHMLMQEnib6z5Ia4ZUbBisp6KnjTHgNLFRIGYjeraZCIQzWJGyWTDcONifw84MQsAACkQAAAAgAAAAA=="
    }
}
''')

print str(wdns.parse_message(base64.b64decode(m['message']['response'])))