wireshark tls

今天药忘吃喽~ 2021-11-11 15:32 352阅读 0赞

想抓一下openfire的包看看，首先要选loopback接口，如果是在本地测试的话。

然后需要搞到rsa私钥，设置好就可以了。

keytool -importkeystore -srckeystore keystore.jks \ -destkeystore intermediate.p12 -deststoretype PKCS12

Next, use OpenSSL to do the extraction to PEM:

openssl pkcs12 -in intermediate.p12 -out extracted.pem -nodes
    
    http://support.citrix.com/article/CTX135121
    http://stackoverflow.com/questions/150167/how-do-i-list-export-private-keys-from-a-keystore
    http://alvinalexander.com/java/java-using-keytool-list-query
    https://isc.sans.edu/forums/diary/Psst+Your+Browser+Knows+All+Your+Secrets+/16415
    http://www.cloudshield.com/blog/advanced-malware/how-to-decrypt-openssl-sessions-using-wireshark-and-ssl-session-identifiers/

<table>  Psst. Your Browser Knows All Your Secrets.  
 <tbody> 
  <tr> 
   <td> 
    <div> 
     <blockquote> 
      <cite>Quoting <a href="https://isc.sans.edu/diary/Psst+Your+Browser+Knows+All+Your+Secrets/16415" rel="nofollow">Diary</a>:</cite> 
      <div> 
       <a href="http://www.sans.edu" rel="nofollow"><img style="width:20px;" src="https://isc.sans.edu/images/sti.png" alt=""></a> 
       <p>&nbsp;</p> 
       <p style="border:1px;">This is a "guest diary" submitted by Sally Vandeven. We will gladly forward any responses or please use our comment/forum section to comment publically. Sally is currently enrolled in the <a href="http://www.sans.edu" rel="nofollow">SANS Masters Program</a>.</p> 
      </div> 
      <p>I got to wondering one day how difficult it would be to find the crypto keys used by my browser and a web server for TLS sessions.&nbsp; I figured it would involve a memory dump, volatility, trial and error and maybe a little bit of luck.&nbsp; So I started looking around and like so many things in life….all you have to do is ask.&nbsp; Really.&nbsp; Just ask your browser to give you the secrets and it will!&nbsp; As icing on the cake, Wireshark will read in those secrets and decrypt the data for you.&nbsp;&nbsp; Here’s a quick rundown of the steps:</p> 
      <p>Set up an environment variable called SSLKEYLOGFILE that points to a writable flat text file.&nbsp; Both Firefox and Chrome (relatively current versions) will look for the variable when they start up.&nbsp; If it exists, the browser will write the values used to generate TLS session keys out to that file. &nbsp;</p> 
      <p>The file contents looks like this:</p> 
      <p><img style="width:421px;" src="https://isc.sans.edu/diaryimages/images/SallySSLFigure1.png" alt="SSL Key File"></p> 
      <p>&nbsp;</p> 
      <p style="margin-left:.5in;"> <span style="color:#0000ff;">64 byte Client Random Values<br><span style="color:#ff8c00;">96 byte Master Secret<br><span style="color:#00ff00;">16 byte encrypted pre-master secret<br><span style="color:#ee82ee;">96 bytes pre-master secret</span></span></span></span></p> 
      <p> The Client_Random entry is for Diffie-Hellman negotiated sessions and the RSA entry is for sessions using RSA or DSA key exchange.&nbsp; If you have the captured TLS encrypted network traffic, these provide the missing pieces needed for decryption.&nbsp; Wireshark can take care of that for you.&nbsp; Again, all you have to do is ask.</p> 
      <p> <img style="width:433px;" src="https://isc.sans.edu/diaryimages/images/SallySSLFigure2.png" alt="Wireshark SSL Session"></p> 
      <p> &nbsp;</p> 
      <p> This is an encrypted TLS session, before giving Wireshark the secrets.</p> 
      <p> Point Wireshark at your file $SSLKEYLOGFILE.&nbsp; Select Edit -&gt; Preferences -&gt; Protocols -&gt; SSL&nbsp; and then OK.</p> 
      <p> <img style="width:432px;" src="https://isc.sans.edu/diaryimages/images/SallySSLFigure3.png" alt="Wireshark SSL Configuration"></p> 
      <p> &nbsp;</p> 
      <p> To see the decrypted data, use the display filter “ssl &amp;&amp; http”.&nbsp; To look at a particular TCP session, right click on any of the entries and choose to “Follow&nbsp; SSL Stream”.&nbsp; This really means “Follow Decrypted SSL Stream”.&nbsp;&nbsp; Notice the new tab at the bottom labeled “Decrypted SSL data”.&nbsp; Incidentally, if you “Follow TCP Stream” you get the encrypted TCP stream.</p> 
      <p> <img style="width:412px;" src="https://isc.sans.edu/diaryimages/images/SallySSLFigure4.png" alt="wireshark decrypted session"></p> 
      <p> &nbsp;</p> 
      <p> Wireshark’s awesome decryption feature.</p> 
      <p> Below is a sample of a decrypted SSL Stream.&nbsp; It contains a login attempt with username and password, some cookies and other goodies that web servers and browsers commonly exchange. &nbsp;</p> 
      <p> <img style="width:354px;" src="https://isc.sans.edu/diaryimages/images/SallySSLFigure5.png" alt="Reassembled SSL Sesion"></p> 
      <p> &nbsp;</p> 
      <p> Remember: if you have a file with keys in it and the captured data on your system then anyone that can get their hands on these can decrypt too.&nbsp; Hey, if you are a pen-tester you might <span style="text-decoration:line-through;">try setting</span> be on the lookout for an $SSLKEYLOG variable on your targets.&nbsp; Interesting.</p> 
      <p> Give it a try but, as always, get written permission from yourself before you begin. Thanks for reading.</p> 
      <p> &nbsp;</p> 
      <p> This exploration turned into a full blown paper that you can find here:<br><a href="http://www.sans.org/reading-room/whitepapers/authentication/ssl-tls-whats-hood-34297" rel="nofollow">http://www.sans.org/reading-room/whitepapers/authentication/ssl-tls-whats-hood-34297</a></p> 
      <p> &nbsp;</p> 
     </blockquote> 
    </div> </td> 
   <td> Alex Stanford<br><img src="https://isc.sans.edu/gravatar_cache/cache/isc/42e2dc528838eed4aae8a5fa6b4a322f" alt=""><br> 66 Posts<br>ISC Handler </td> 
  </tr> 
  <tr> 
   <td> <a href="https://isc.sans.edu/forums/diary/reply/16415/" rel="nofollow">Reply</a> <a href="https://isc.sans.edu/forums/diary/subscribe/16415/" rel="nofollow">Subscribe</a> </td> 
   <td> 1 year ago </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      To see traffic, you can use Firefox LiveHttpHeaders plugin. 
    </div> </td> 
   <td> Paul Szabo<br><img src="https://isc.sans.edu/gravatar_cache/cache/isc/a6f7401e9e48c852f898cf6189e4396d" alt=""><br> 7 Posts </td> 
  </tr> 
  <tr> 
   <td> <a href="https://isc.sans.edu/forums/diary/reply/16415/" rel="nofollow">Reply</a> <a href="https://isc.sans.edu/forums/diary/quote/27086" rel="nofollow">Quote</a> </td> 
   <td> 1 year ago </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      Nice post Alex 
     <br> 
     <br> I just tried to set the environment variable in windows 8 system. Then i ran firefox 23.0 and started browsing in webpages as facebook, or email that uses SSL. Nevertheless no file with SSLKEYLOGFILE data was created... 
    </div> </td> 
   <td> hecky<br><img src="https://isc.sans.edu/gravatar_cache/cache/isc/67ef65aae74d0a8df21a15d5de203cae" alt=""><br> 2 Posts </td> 
  </tr> 
  <tr> 
   <td> <a href="https://isc.sans.edu/forums/diary/reply/16415/" rel="nofollow">Reply</a> <a href="https://isc.sans.edu/forums/diary/quote/27179" rel="nofollow">Quote</a> </td> 
   <td> 1 year ago </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      Alex, 
     <br> I just installed FF 23 on a Windows 8 VM and tried it. It seems to work fine. I tried both user environment variable and system environment variable. If you set the variable from the command line only the command shell will see it, not the browser. To set my variable, I brought up Control Panel and searched for "environment". Here you can add a user variable and it takes effect immediately and can be accessed by the browser. It also writes it to the registry in HKCU\Environment. 
     <br> 
     <br> Sally 
    </div> </td> 
   <td> sallyvdv<br><img src="https://isc.sans.edu/gravatar_cache/cache/isc/671720473b82bfdfafbcfe1f3f96de40" alt=""><br> 2 Posts </td> 
  </tr> 
  <tr> 
   <td> <a href="https://isc.sans.edu/forums/diary/reply/16415/" rel="nofollow">Reply</a> <a href="https://isc.sans.edu/forums/diary/quote/27188" rel="nofollow">Quote</a> </td> 
   <td> 1 year ago </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      Hey anonymous, thanks. 
     <br> 
     <br> You are right, i just had to set the system enviroment variable frome the control panel and not just in the command prompt. 
     <br> 
     <br> Now it works fine. 
    </div> </td> 
   <td> hecky<br><img src="https://isc.sans.edu/gravatar_cache/cache/isc/67ef65aae74d0a8df21a15d5de203cae" alt=""><br> 2 Posts </td> 
  </tr> 
  <tr> 
   <td> <a href="https://isc.sans.edu/forums/diary/reply/16415/" rel="nofollow">Reply</a> <a href="https://isc.sans.edu/forums/diary/quote/27227" rel="nofollow">Quote</a> </td> 
   <td> 1 year ago </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      This worked perfectly for me. Too bad it only works with browsers. Would be cool to be able to capture the e-mail traffic from my workstation to the Exchange server. It uses TLS, as well. 
    </div> </td> 
   <td> Anonymous<br><img src="https://isc.sans.edu/gravatar_cache/cache/isc/242ba8bb28e05984846d9b160f02a967" alt=""><br> 1 Posts </td> 
  </tr> 
  <tr> 
   <td> <a href="https://isc.sans.edu/forums/diary/reply/16415/" rel="nofollow">Reply</a> <a href="https://isc.sans.edu/forums/diary/quote/27353" rel="nofollow">Quote</a> </td> 
   <td> 1 year ago </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      I was playing with some of this last year in Apache, using the known private key on my server. 
     <br> There's a good discussion in http://sharkfest.wireshark.org/sharkfest.12/presentations/MB-1_SSL_Troubleshooting_with%20_Wireshark_Software.pdf 
     <br> 
     <br> When I tried with Apache, only certain ciphers were decryptable. The SSLv2 ones, and "EXP-*" ciphers in TLS1 and SSLv3, were not. In order to ensure that only decryptable ciphers (or vice-versa) are used, you can set options in Apache or preferences in Firefox. 
     <br> 
     <br> Sorry for being vague, it's been a while. Thanks for the tip re. the environment variable. 
    </div> </td> 
   <td> Anonymous<br><img src="https://isc.sans.edu/gravatar_cache/cache/isc/15e8cc4271eec8d4c25ac13dfd5192db" alt=""><br> 5 Posts </td> 
  </tr> 
  <tr> 
   <td> <a href="https://isc.sans.edu/forums/diary/reply/16415/" rel="nofollow">Reply</a> <a href="https://isc.sans.edu/forums/diary/quote/27509" rel="nofollow">Quote</a> </td> 
   <td> 1 year ago </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      Hi 
     <br> I am a newbie and I don't know how to set up an environment variable called SSLKEYLOGFILE that points to a writable flat text file on a windows 8.1 machine. Could you please show me step by step how to do it? Thanks in advance 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

但是spark客户端没有使用xep-0138流压缩，没找到选项可以设置。
    <stream:stream to="127.0.0.1" xmlns="jabber:client"
        xmlns:stream="http://etherx.jabber.org/streams" version="1.0">
        
    <?xml version='1.0' encoding='UTF-8'?>
    <stream:stream xmlns:stream="http://etherx.jabber.org/streams"
        xmlns="jabber:client" from="of.eff.com" id="ee080a0b" xml:lang="en"
        version="1.0">
        <stream:features>
            <starttls xmlns="urn:ietf:params:xml:ns:xmpp-tls"></starttls>
            <mechanisms xmlns="urn:ietf:params:xml:ns:xmpp-sasl">
                <mechanism>DIGEST-MD5</mechanism>
                <mechanism>PLAIN</mechanism>
                <mechanism>ANONYMOUS</mechanism>
                <mechanism>CRAM-MD5</mechanism>
            </mechanisms>
            <compression xmlns="http://jabber.org/features/compress">
                <method>zlib</method>
            </compression>
            <auth xmlns="http://jabber.org/features/iq-auth" />
            <register xmlns="http://jabber.org/features/iq-register" />
        </stream:features>
    
    <starttls xmlns="urn:ietf:params:xml:ns:xmpp-tls" />
    
    <proceed xmlns="urn:ietf:params:xml:ns:xmpp-tls" />
    
    <stream:stream to="of.eff.com" xmlns="jabber:client"
        xmlns:stream="http://etherx.jabber.org/streams" version="1.0"><?xml version='1.0' encoding='UTF-8'?>
    
    <stream:stream xmlns:stream="http://etherx.jabber.org/streams"
        xmlns="jabber:client" from="of.eff.com" id="ee080a0b" xml:lang="en"
        version="1.0">
        <stream:features>
            <mechanisms xmlns="urn:ietf:params:xml:ns:xmpp-sasl">
                <mechanism>DIGEST-MD5</mechanism>
                <mechanism>PLAIN</mechanism>
                <mechanism>ANONYMOUS</mechanism>
                <mechanism>CRAM-MD5</mechanism>
            </mechanisms>
            <compression xmlns="http://jabber.org/features/compress">
                <method>zlib</method>
            </compression>
            <auth xmlns="http://jabber.org/features/iq-auth" />
            <register xmlns="http://jabber.org/features/iq-register" />
        </stream:features>
    
    <auth mechanism="DIGEST-MD5" xmlns="urn:ietf:params:xml:ns:xmpp-sasl"></auth>
    
    <challenge xmlns="urn:ietf:params:xml:ns:xmpp-sasl">cmVhbG09Im9mLmVmZi5jb20iLG5vbmNlPSJuWWpuZEJ1bEUwVTBNbHhRbjRnTVB4MjdxMVl6T0owUDZ0TlcyVDBWIixxb3A9ImF1dGgiLGNoYXJzZXQ9dXRmLTgsYWxnb3JpdGhtPW1kNS1zZXNz
    </challenge>
    
    <response xmlns="urn:ietf:params:xml:ns:xmpp-sasl">Y2hhcnNldD11dGYtOCx1c2VybmFtZT0iYWRtaW4iLHJlYWxtPSJvZi5lZmYuY29tIixub25jZT0ibllqbmRCdWxFMFUwTWx4UW40Z01QeDI3cTFZek9KMFA2dE5XMlQwViIsbmM9MDAwMDAwMDEsY25vbmNlPSJQVC82dkxPT0Jqc0MwWGl2NGsyWFVYMTlPOGFVenB6NlRLT0N2ZnNUIixkaWdlc3QtdXJpPSJ4bXBwL29mLmVmZi5jb20iLG1heGJ1Zj02NTUzNixyZXNwb25zZT0wNjE3MjU2YTdhZDliYTE0OTViNGYwNjI5YzczYTM1Nyxxb3A9YXV0aCxhdXRoemlkPSJhZG1pbiI=
    </response>
    
    <success xmlns="urn:ietf:params:xml:ns:xmpp-sasl">cnNwYXV0aD0wZmFhNzQ0MzhhYjEyYTA2OWEyNDhmZjU3NWU1MWQwYQ==
    </success>
    
    <stream:stream to="of.eff.com" xmlns="jabber:client"
        xmlns:stream="http://etherx.jabber.org/streams" version="1.0"><?xml version='1.0' encoding='UTF-8'?>
    
    <stream:stream xmlns:stream="http://etherx.jabber.org/streams"
        xmlns="jabber:client" from="of.eff.com" id="ee080a0b" xml:lang="en"
        version="1.0">
        <stream:features>
            <compression xmlns="http://jabber.org/features/compress">
                <method>zlib</method>
            </compression>
            <bind xmlns="urn:ietf:params:xml:ns:xmpp-bind" />
            <session xmlns="urn:ietf:params:xml:ns:xmpp-session" />
        </stream:features>
    
    <iq id="S87zn-0" type="set">
        <bind xmlns="urn:ietf:params:xml:ns:xmpp-bind">
            <resource>Spark 2.6.3</resource>
        </bind>
    </iq>
    
    <iq type="result" id="S87zn-0" to="of.eff.com/ee080a0b">
        <bind xmlns="urn:ietf:params:xml:ns:xmpp-bind">
            <jid>admin@of.eff.com/Spark 2.6.3</jid>
        </bind>
    </iq>
    
    <iq id="S87zn-1" type="set">
        <session xmlns="urn:ietf:params:xml:ns:xmpp-session" />
    </iq>
    
    <iq type="result" id="S87zn-1" to="admin@of.eff.com/Spark 2.6.3" />
    
    <iq id="S87zn-2" type="get">
        <query xmlns="jabber:iq:roster"></query>
    </iq>
    
    <iq type="result" id="S87zn-2" to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="jabber:iq:roster" />
    </iq>
    
    <iq id="S87zn-3" to="of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#items"></query>
    </iq>
    
    <iq type="result" id="S87zn-3" from="of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#items">
            <item jid="pubsub.of.eff.com" name="Publish-Subscribe service" />
            <item jid="proxy.of.eff.com" name="Socks 5 Bytestreams Proxy" />
            <item jid="conference.of.eff.com" name="Public Chatrooms" />
            <item jid="whatisservice.of.eff.com" name="asdf" />
            <item jid="search.of.eff.com" name="User Search" />
        </query>
    </iq>
    
    <iq id="S87zn-4" from="admin@of.eff.com/Spark 2.6.3" type="get">
        <vCard xmlns='vcard-temp' />
    </iq>
    
    <iq type="result" id="S87zn-4" to="admin@of.eff.com/Spark 2.6.3">
        <vCard xmlns="vcard-temp" />
    </iq>
    
    <iq id="S87zn-5" type="get">
        <sharedgroup xmlns="http://www.jivesoftware.org/protocol/sharedgroup"></sharedgroup>
    </iq>
    
    <iq type="result" id="S87zn-5" to="admin@of.eff.com/Spark 2.6.3">
        <sharedgroup xmlns="http://www.jivesoftware.org/protocol/sharedgroup" />
    </iq>
    
    <presence id="S87zn-6">
        <status>Online</status>
        <priority>1</priority>
    </presence>
    
    <presence id="S87zn-6" from="admin@of.eff.com/Spark 2.6.3"
        to="admin@of.eff.com/Spark 2.6.3">
        <status>Online</status>
        <priority>1</priority>
    </presence>
    
    <iq id="S87zn-7" type="get">
        <query xmlns="jabber:iq:private">
            <storage xmlns="storage:bookmarks" />
        </query>
    </iq>
    
    <iq type="result" id="S87zn-7" to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="jabber:iq:private">
            <storage xmlns="storage:bookmarks" />
        </query>
    </iq>
    
    <iq id="S87zn-8" to="pubsub.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-8" from="pubsub.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="pubsub" name="Publish-Subscribe service"
                type="service" />
            <feature var="http://jabber.org/protocol/pubsub" />
            <feature var="http://jabber.org/protocol/pubsub#collections" />
            <feature var="http://jabber.org/protocol/pubsub#config-node" />
            <feature
                var="http://jabber.org/protocol/pubsub#create-and-configure" />
            <feature var="http://jabber.org/protocol/pubsub#create-nodes" />
            <feature var="http://jabber.org/protocol/pubsub#delete-nodes" />
            <feature var="http://jabber.org/protocol/pubsub#get-pending" />
            <feature var="http://jabber.org/protocol/pubsub#instant-nodes" />
            <feature var="http://jabber.org/protocol/pubsub#item-ids" />
            <feature var="http://jabber.org/protocol/pubsub#meta-data" />
            <feature var="http://jabber.org/protocol/pubsub#modify-affiliations" />
            <feature
                var="http://jabber.org/protocol/pubsub#manage-subscriptions" />
            <feature var="http://jabber.org/protocol/pubsub#multi-subscribe" />
            <feature var="http://jabber.org/protocol/pubsub#outcast-affiliation" />
            <feature var="http://jabber.org/protocol/pubsub#persistent-items" />
            <feature
                var="http://jabber.org/protocol/pubsub#presence-notifications" />
            <feature var="http://jabber.org/protocol/pubsub#publish" />
            <feature
                var="http://jabber.org/protocol/pubsub#publisher-affiliation" />
            <feature var="http://jabber.org/protocol/pubsub#purge-nodes" />
            <feature var="http://jabber.org/protocol/pubsub#retract-items" />
            <feature
                var="http://jabber.org/protocol/pubsub#retrieve-affiliations" />
            <feature var="http://jabber.org/protocol/pubsub#retrieve-default" />
            <feature var="http://jabber.org/protocol/pubsub#retrieve-items" />
            <feature
                var="http://jabber.org/protocol/pubsub#retrieve-subscriptions" />
            <feature var="http://jabber.org/protocol/pubsub#subscribe" />
            <feature
                var="http://jabber.org/protocol/pubsub#subscription-options" />
            <feature
                var="http://jabber.org/protocol/pubsub#default_access_model_open" />
            <feature var="http://jabber.org/protocol/disco#info" />
        </query>
    </iq>
        
    <iq id="S87zn-9" to="proxy.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-9" from="proxy.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="proxy" name="SOCKS5 Bytestreams Service"
                type="bytestreams" />
            <feature var="http://jabber.org/protocol/bytestreams" />
            <feature var="http://jabber.org/protocol/disco#info" />
        </query>
    </iq>
    
    <iq id="S87zn-10" to="conference.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-10" from="conference.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="conference" name="Public Chatrooms"
                type="text" />
            <identity category="directory" name="Public Chatroom Search"
                type="chatroom" />
            <feature var="http://jabber.org/protocol/muc" />
            <feature var="http://jabber.org/protocol/disco#info" />
            <feature var="http://jabber.org/protocol/disco#items" />
            <feature var="jabber:iq:search" />
            <feature var="http://jabber.org/protocol/rsm" />
        </query>
    </iq>
    
    <iq id="S87zn-11" to="whatisservice.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-11" from="whatisservice.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="conference" name="asdf" type="text" />
            <identity category="directory" name="Public Chatroom Search"
                type="chatroom" />
            <feature var="http://jabber.org/protocol/muc" />
            <feature var="http://jabber.org/protocol/disco#info" />
            <feature var="http://jabber.org/protocol/disco#items" />
            <feature var="jabber:iq:search" />
            <feature var="http://jabber.org/protocol/rsm" />
        </query>
    </iq>
    
    <iq id="S87zn-12" to="search.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-12" from="search.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="directory" type="user" name="User Search" />
            <feature var="jabber:iq:search" />
            <feature var="http://jabber.org/protocol/disco#info" />
            <feature var="http://jabber.org/protocol/rsm" />
        </query>
    </iq>
    
    <iq id="S87zn-13" to="of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#items"></query>
    </iq>
    
    <iq type="result" id="S87zn-13" from="of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#items">
            <item jid="pubsub.of.eff.com" name="Publish-Subscribe service" />
            <item jid="proxy.of.eff.com" name="Socks 5 Bytestreams Proxy" />
            <item jid="conference.of.eff.com" name="Public Chatrooms" />
            <item jid="whatisservice.of.eff.com" name="asdf" />
            <item jid="search.of.eff.com" name="User Search" />
        </query>
    </iq>
    
    <iq id="S87zn-14" to="pubsub.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-14" from="pubsub.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="pubsub" name="Publish-Subscribe service"
                type="service" />
            <feature var="http://jabber.org/protocol/pubsub" />
            <feature var="http://jabber.org/protocol/pubsub#collections" />
            <feature var="http://jabber.org/protocol/pubsub#config-node" />
            <feature
                var="http://jabber.org/protocol/pubsub#create-and-configure" />
            <feature var="http://jabber.org/protocol/pubsub#create-nodes" />
            <feature var="http://jabber.org/protocol/pubsub#delete-nodes" />
            <feature var="http://jabber.org/protocol/pubsub#get-pending" />
            <feature var="http://jabber.org/protocol/pubsub#instant-nodes" />
            <feature var="http://jabber.org/protocol/pubsub#item-ids" />
            <feature var="http://jabber.org/protocol/pubsub#meta-data" />
            <feature var="http://jabber.org/protocol/pubsub#modify-affiliations" />
            <feature
                var="http://jabber.org/protocol/pubsub#manage-subscriptions" />
            <feature var="http://jabber.org/protocol/pubsub#multi-subscribe" />
            <feature var="http://jabber.org/protocol/pubsub#outcast-affiliation" />
            <feature var="http://jabber.org/protocol/pubsub#persistent-items" />
            <feature
                var="http://jabber.org/protocol/pubsub#presence-notifications" />
            <feature var="http://jabber.org/protocol/pubsub#publish" />
            <feature
                var="http://jabber.org/protocol/pubsub#publisher-affiliation" />
            <feature var="http://jabber.org/protocol/pubsub#purge-nodes" />
            <feature var="http://jabber.org/protocol/pubsub#retract-items" />
            <feature
                var="http://jabber.org/protocol/pubsub#retrieve-affiliations" />
            <feature var="http://jabber.org/protocol/pubsub#retrieve-default" />
            <feature var="http://jabber.org/protocol/pubsub#retrieve-items" />
            <feature
                var="http://jabber.org/protocol/pubsub#retrieve-subscriptions" />
            <feature var="http://jabber.org/protocol/pubsub#subscribe" />
            <feature
                var="http://jabber.org/protocol/pubsub#subscription-options" />
            <feature
                var="http://jabber.org/protocol/pubsub#default_access_model_open" />
            <feature var="http://jabber.org/protocol/disco#info" />
        </query>
    </iq>
    
    <iq id="S87zn-15" to="proxy.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-15" from="proxy.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="proxy" name="SOCKS5 Bytestreams Service"
                type="bytestreams" />
            <feature var="http://jabber.org/protocol/bytestreams" />
            <feature var="http://jabber.org/protocol/disco#info" />
        </query>
    </iq>
    
    <iq id="S87zn-16" to="conference.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-16" from="conference.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="conference" name="Public Chatrooms"
                type="text" />
            <identity category="directory" name="Public Chatroom Search"
                type="chatroom" />
            <feature var="http://jabber.org/protocol/muc" />
            <feature var="http://jabber.org/protocol/disco#info" />
            <feature var="http://jabber.org/protocol/disco#items" />
            <feature var="jabber:iq:search" />
            <feature var="http://jabber.org/protocol/rsm" />
        </query>
    </iq>
    
    <iq id="S87zn-17" to="whatisservice.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-17" from="whatisservice.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="conference" name="asdf" type="text" />
            <identity category="directory" name="Public Chatroom Search"
                type="chatroom" />
            <feature var="http://jabber.org/protocol/muc" />
            <feature var="http://jabber.org/protocol/disco#info" />
            <feature var="http://jabber.org/protocol/disco#items" />
            <feature var="jabber:iq:search" />
            <feature var="http://jabber.org/protocol/rsm" />
        </query>
    </iq>
    
    <iq id="S87zn-18" to="search.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-18" from="search.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="directory" type="user" name="User Search" />
            <feature var="jabber:iq:search" />
            <feature var="http://jabber.org/protocol/disco#info" />
            <feature var="http://jabber.org/protocol/rsm" />
        </query>
    </iq>
    
    <iq id="S87zn-19" to="of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#items"></query>
    </iq>
    
    <iq type="result" id="S87zn-19" from="of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#items">
            <item jid="pubsub.of.eff.com" name="Publish-Subscribe service" />
            <item jid="proxy.of.eff.com" name="Socks 5 Bytestreams Proxy" />
            <item jid="conference.of.eff.com" name="Public Chatrooms" />
            <item jid="whatisservice.of.eff.com" name="asdf" />
            <item jid="search.of.eff.com" name="User Search" />
        </query>
    </iq>
    
    <iq id="S87zn-20" to="of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#items"></query>
    </iq>
    
    <iq type="result" id="S87zn-20" from="of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#items">
            <item jid="pubsub.of.eff.com" name="Publish-Subscribe service" />
            <item jid="proxy.of.eff.com" name="Socks 5 Bytestreams Proxy" />
            <item jid="conference.of.eff.com" name="Public Chatrooms" />
            <item jid="whatisservice.of.eff.com" name="asdf" />
            <item jid="search.of.eff.com" name="User Search" />
        </query>
    </iq>
    
    <iq id="S87zn-21" to="pubsub.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-21" from="pubsub.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="pubsub" name="Publish-Subscribe service"
                type="service" />
            <feature var="http://jabber.org/protocol/pubsub" />
            <feature var="http://jabber.org/protocol/pubsub#collections" />
            <feature var="http://jabber.org/protocol/pubsub#config-node" />
            <feature
                var="http://jabber.org/protocol/pubsub#create-and-configure" />
            <feature var="http://jabber.org/protocol/pubsub#create-nodes" />
            <feature var="http://jabber.org/protocol/pubsub#delete-nodes" />
            <feature var="http://jabber.org/protocol/pubsub#get-pending" />
            <feature var="http://jabber.org/protocol/pubsub#instant-nodes" />
            <feature var="http://jabber.org/protocol/pubsub#item-ids" />
            <feature var="http://jabber.org/protocol/pubsub#meta-data" />
            <feature var="http://jabber.org/protocol/pubsub#modify-affiliations" />
            <feature
                var="http://jabber.org/protocol/pubsub#manage-subscriptions" />
            <feature var="http://jabber.org/protocol/pubsub#multi-subscribe" />
            <feature var="http://jabber.org/protocol/pubsub#outcast-affiliation" />
            <feature var="http://jabber.org/protocol/pubsub#persistent-items" />
            <feature
                var="http://jabber.org/protocol/pubsub#presence-notifications" />
            <feature var="http://jabber.org/protocol/pubsub#publish" />
            <feature
                var="http://jabber.org/protocol/pubsub#publisher-affiliation" />
            <feature var="http://jabber.org/protocol/pubsub#purge-nodes" />
            <feature var="http://jabber.org/protocol/pubsub#retract-items" />
            <feature
                var="http://jabber.org/protocol/pubsub#retrieve-affiliations" />
            <feature var="http://jabber.org/protocol/pubsub#retrieve-default" />
            <feature var="http://jabber.org/protocol/pubsub#retrieve-items" />
            <feature
                var="http://jabber.org/protocol/pubsub#retrieve-subscriptions" />
            <feature var="http://jabber.org/protocol/pubsub#subscribe" />
            <feature
                var="http://jabber.org/protocol/pubsub#subscription-options" />
            <feature
                var="http://jabber.org/protocol/pubsub#default_access_model_open" />
            <feature var="http://jabber.org/protocol/disco#info" />
        </query>
    </iq>
    
    <iq id="S87zn-22" to="proxy.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-22" from="proxy.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="proxy" name="SOCKS5 Bytestreams Service"
                type="bytestreams" />
            <feature var="http://jabber.org/protocol/bytestreams" />
            <feature var="http://jabber.org/protocol/disco#info" />
        </query>
    </iq>
    
    <iq id="S87zn-23" to="conference.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-23" from="conference.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="conference" name="Public Chatrooms"
                type="text" />
            <identity category="directory" name="Public Chatroom Search"
                type="chatroom" />
            <feature var="http://jabber.org/protocol/muc" />
            <feature var="http://jabber.org/protocol/disco#info" />
            <feature var="http://jabber.org/protocol/disco#items" />
            <feature var="jabber:iq:search" />
            <feature var="http://jabber.org/protocol/rsm" />
        </query>
    </iq>
    
    <iq id="S87zn-24" to="whatisservice.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-24" from="whatisservice.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="conference" name="asdf" type="text" />
            <identity category="directory" name="Public Chatroom Search"
                type="chatroom" />
            <feature var="http://jabber.org/protocol/muc" />
            <feature var="http://jabber.org/protocol/disco#info" />
            <feature var="http://jabber.org/protocol/disco#items" />
            <feature var="jabber:iq:search" />
            <feature var="http://jabber.org/protocol/rsm" />
        </query>
    </iq>
    
    <iq id="S87zn-25" to="search.of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="result" id="S87zn-25" from="search.of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#info">
            <identity category="directory" type="user" name="User Search" />
            <feature var="jabber:iq:search" />
            <feature var="http://jabber.org/protocol/disco#info" />
            <feature var="http://jabber.org/protocol/rsm" />
        </query>
    </iq>
    
    <iq id="S87zn-26" to="127.0.0.1" type="get">
        <query xmlns="http://jabber.org/protocol/disco#info"></query>
    </iq>
    
    <iq type="error" id="S87zn-26" to="admin@of.eff.com/Spark 2.6.3"
        from="127.0.0.1">
        <query xmlns="http://jabber.org/protocol/disco#info" />
        <error code="404" type="cancel">
            <remote-server-not-found xmlns="urn:ietf:params:xml:ns:xmpp-stanzas" />
        </error>
    </iq>
    
    <iq id="S87zn-27" to="of.eff.com" type="get">
        <query xmlns="http://jabber.org/protocol/disco#items"></query>
    </iq>
    
    <iq type="result" id="S87zn-27" from="of.eff.com"
        to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="http://jabber.org/protocol/disco#items">
            <item jid="pubsub.of.eff.com" name="Publish-Subscribe service" />
            <item jid="proxy.of.eff.com" name="Socks 5 Bytestreams Proxy" />
            <item jid="conference.of.eff.com" name="Public Chatrooms" />
            <item jid="whatisservice.of.eff.com" name="asdf" />
            <item jid="search.of.eff.com" name="User Search" />
        </query>
    </iq>
    
    <iq id="S87zn-28" type="get">
        <query xmlns="jabber:iq:private">
            <gateway-settings xmlns="http://www.jivesoftware.org/spark" />
        </query>
    </iq>
    
    <iq type="result" id="S87zn-28" to="admin@of.eff.com/Spark 2.6.3">
        <query xmlns="jabber:iq:private">
            <gateway-settings xmlns="http://www.jivesoftware.org/spark" />
        </query>
    </iq>

转载于:https://www.cnblogs.com/jvava/p/4080766.html