from scapy.all import Raw
import re
import base64

def extract_http_requests(packets):
    urls = []
    for pkt in packets:
        if pkt.haslayer(Raw):
            data = pkt[Raw].load.decode(errors="ignore")
            if data.startswith(("GET", "POST")):
                urls.append(data.split("\r\n")[0])
    return urls


def extract_http_credentials(packets):
    creds = []
    for pkt in packets:
        if pkt.haslayer(Raw):
            data = pkt[Raw].load.decode(errors="ignore")

            if "Authorization: Basic" in data:
                try:
                    b64 = data.split("Authorization: Basic")[1].split()[0]
                    creds.append(base64.b64decode(b64).decode())
                except:
                    pass

            if "password=" in data.lower():
                u = re.search(r"user(name)?=([^&]+)", data, re.I)
                p = re.search(r"password=([^&]+)", data, re.I)
                if u and p:
                    creds.append(f"{u.group(2)}:{p.group(1)}")

    return list(set(creds))
