如果您曾经想知道电报和WhatsApp之类的消息传递应用程序如何在您的对话幕后工作,那么本文适合您。我们将使用强大的网络流量分析工具Wireshark探索一种方法,以发现我们在电报上与之交互的用户的IP地址。
。步骤1:下载Wireshark
我们开始之前,您需要在计算机上下载并安装Wireshark。您可以在官方Wireshark网站上找到下载。
确保选择与操作系统兼容的版本。
步骤2:滤波流量
打开Wireshark后,您会看到一个接口捕获实时网络流量。让我们过滤电击流量,这是电报用于通信的协议。
在过滤器栏中,单击搜索图标以打开搜索选项。然后在搜索行中选择“字符串”选项,然后在搜索行中键入“ xor-mapped-address”。
步骤3:启动数据捕获
现在,我们准备开始捕获数据。确保Wireshark正在运行,并通过电报致电您要发现的IP地址的用户。
用户接听电话后,Wireshark将开始显示捕获的数据。浏览列表中的信息与Stun协议有关的信息,您会找到接收了通话的用户的IP地址。
步骤4:识别IP地址
要轻松识别所需的IP地址,请使用Wireshark搜索功能。在搜索行中单击“查找”选项,然后在搜索行中键入“ XOR-MAPPED-ADDRESS”。用户的IP地址将立即出现在该字符串之后。
与golang自动
使用Golang编程语言,我们可以自动化上述整个过程。以下是Golang代码,可有效可靠地执行此任务:
package main
import (
"fmt"
"log"
"os"
"os/exec"
"strings"
)
func main() {
const CAP_PATH = "/tmp/tg_cap.pcap" // Temporary path for pcap capture file
const CAP_TEXT = "/tmp/tg_text.txt" // Temporary path for text file with information
const CAP_DURATION = "5" // Capture duration in seconds
// Get the external IP address of the device
ipCmd := exec.Command("curl", "-s", "icanhazip.com")
ipOutput, err := ipCmd.Output()
if err != nil {
log.Fatal("Failed to get IP address:", err)
}
MY_IP := strings.TrimSpace(string(ipOutput))
// Check if Wireshark is installed
_, err = exec.LookPath("tshark")
if err != nil {
log.Println("[-] Wireshark not found. Try installing Wireshark first.")
log.Println("[+] Debian-based: sudo apt-get install -y tshark")
log.Println("[+] RedHat-based: sudo yum install -y tshark")
os.Exit(1)
}
fmt.Println("[+] Discovering User's IP Address on Telegram using Golang")
fmt.Println("[+] Starting traffic capture. Please wait for", CAP_DURATION, "seconds...")
// Start traffic capture with Wireshark
captureCmd := exec.Command("tshark", "-w", CAP_PATH, "-a", "duration:"+CAP_DURATION)
captureOutput, err := captureCmd.CombinedOutput()
if err != nil {
log.Fatal("Traffic capture error:", err)
}
fmt.Println("[+] Traffic captured.")
// Convert pcap file to readable text file
convertCmd := exec.Command("tshark", "-r", CAP_PATH)
convertOutput, err := convertCmd.Output()
if err != nil {
log.Fatal("Error converting pcap file to text:", err)
}
err = os.WriteFile(CAP_TEXT, convertOutput, 0644)
if err != nil {
log.Fatal("Error writing text file:", err)
}
fmt.Println("[+] Pcap file successfully converted to text.")
// Check if Telegram traffic is present in the text file
if strings.Contains(string(convertOutput), "STUN 106") {
fmt.Println("[+] Telegram traffic found.")
// Extract the IP address from the text
extractCmd := exec.Command("cat", CAP_TEXT, "|", "grep", "STUN 106", "|", "sed", "'s/^.*XOR-MAPPED-ADDRESS: //'", "|", "awk", "'{match($0,/[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+/); ip = substr($0,RSTART,RLENGTH); print ip}' | awk '!seen[$0]++'")
extractOutput, err := extractCmd.Output()
if err != nil {
log.Fatal("Error extracting IP address:", err)
}
TG_OUT := strings.TrimSpace(string(extractOutput))
IP_1 := strings.Fields(TG_OUT)[0]
IP_2 := strings.Fields(TG_OUT)[1]
var IP string
// Check if the IP address is ours or the recipient's
if MY_IP == IP_1 {
IP = IP_2
} else if MY_IP == IP_2 {
IP = IP_1
} else {
IP = "[-] Sorry. IP address not found."
os.Exit(1)
}
// Get host information for the IP address
hostCmd := exec.Command("host", IP)
hostOutput, err := hostCmd.Output()
if err != nil {
log.Fatal("Error getting host information:", err)
}
fmt.Println("[+]")
fmt.Println("[+] IP Address:", IP)
fmt.Println("[+] Host:", strings.TrimSpace(string(hostOutput)))
fmt.Println("[+]")
// Clean up temporary files
err = os.Remove(CAP_PATH)
if err != nil {
log.Fatal("Cleanup error:", err)
}
err = os.Remove(CAP_TEXT)
if err != nil {
log.Fatal("Cleanup error:", err)
}
fmt.Println("[+] Cleanup completed.")
} else {
fmt.Println("[-] Telegram traffic not found.")
fmt.Println("[!]")
fmt.Println("[!] Run this script only >>>AFTER<<< the response.")
fmt.Println("[!]")
os.Exit(1)
}
fmt.Println("[?]")
fmt.Print("[?] Run whois", IP, "? (Y/N): ")
// Check if the user wants to run the whois command
var answer string
fmt.Scanln(&answer)
if strings.ToUpper(answer) == "Y" {
whoisCmd := exec.Command("whois", IP)
whoisOutput, err := whoisCmd.Output()
if err != nil {
log.Fatal("Error running whois command:", err)
}
fmt.Println(string(whoisOutput))
} else {
fmt.Println("[+] Goodbye!")
os.Exit(0)
}
}
结论
通过使用Wireshark并分析电报上的昏迷流量,我们可以发现与之交互的用户的IP地址。此信息可用于各种目的,例如检查用户的地理位置或确定潜在的网络问题。
但是,重要的是要记住,应始终尊重用户隐私。这些技术的使用应在道德和法律范围内进行。
参考:
https://medium.com/@ibederov_en/find-out-the-ip-address-through-a-call-to-telegram-a899441b1bac