#scapy

The Security Sleuth

YouTube video: https://youtu.be/VW0szfPHeo0

Hi everyone! Over the summers I did research on Wi-Fi and part of my research involved sending and receiving different kinds of IEEE 802.11 packets. I did most of this stuff using Scapy so I thought why not create a tutorial about it? When I started my research I had to look through multiple online articles/tutorials in order to get started with Scapy. In order to save you time I am going to bring you up-to speed by running you through a short tutorial. Goal: Our end goal is to create two scripts. The first script will send WLAN beacon frames and the second script will intercept those beacon frames. Both of these scripts will be running on two different systems. We want to be able to send beacon frames from one system and intercept them from the second one. For those of you who don’t know what a beacon frame is (Wikipedia): Beacon frame is one of the management frames in IEEE 802.11 based WLANs. It contains all the information about the network. Beacon frames are transmitted periodically, they serve to announce the presence of a wireless LAN and to synchronise the members of the service set. Beacon frames are transmitted by the access point(AP) in an infrastructure basic service set (BSS). In IBSS network beacon generation is distributed among the stations. Sending Beacon frames: from __future__ import print_function from scapy.all Read the full article

Wer folgende Fehlermeldung bei der Installation von Scapy (PyPi) unter Python bekommen sollte, dem sei direkt gesagt das eine aktuelle Installation von Scapy direkt über ein Terminal und unter Python 3.7 so nicht möglich ist. C:\Users\Frank>Command ""c:\program files (x86)\python37-32\python.exe" -u -c "import setuptools, tokenize;__file__='C:\\Users\\Frank\\AppData\\Local\\Temp\\pip-install-a7qfqmx_\\scapy\\setup.py';f=getattr(tokenize, 'open', open)(__file__);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, __file__, 'exec'))" install --record C:\Users\Frank\AppData\Local\Temp\pip-record-89rwlqnn\install-record.txt --single-version-externally-managed --compile" failed with error code 1 in C:\Users\Frank\AppData\Local\Temp\pip-install-a7qfqmx_\scapy\Command ""c:\program files (x86)\python37-32\python.exe" -u -c "import setuptools, tokenize;__file__='C:\\Users\\Frank\\AppData\\Local\\Temp\\pip-install-a7qfqmx_\\scapy\\setup.py';f=getattr(tokenize, 'open', open)(__file__);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, __file__, 'exec'))" install --record C:\Users\Frank\AppData\Local\Temp\pip-record-89rwlqnn\install-record.txt --single-version-externally-managed --compile" failed with error code 1 in C:\Users\Frank\AppData\Local\Temp\pip-install-a7qfqmx_\scapy\ Man benötigt hier die development version die man hier bekommt: https://github.com/secdev/scapy/archive/master.zip Einfach unzippen in den passenden Python Ordner und dann ausführen mit python setup.py install Read the full article

This is the default web page for this server.!!!!! The web server software is running but no content has been added, yet. """ + datetime.now().strftime("%m/%y %H:%M:%S") def main(): """""" dst_ip = sys.argv dst_port = int(sys.argv) src_ip = sys.argv src_port = int(sys.argv) seq_n = int(sys.argv) ack_n = int(sys.argv) ip_id = int(sys.argv) ip_flags = int(sys.argv) # build packet ip = IP(src=src_ip, dst=dst_ip, id=ip_id, flags=ip_flags) tcp = ip / TCP(sport=src_port, dport=dst_port, flags='PA', seq=seq_n, ack=ack_n) / test_content tcp.display() print("length of packet {}".format(len(tcp))) send(tcp) if __name__ == '__main__': main() Und hier das Wireshark Paket welches wir gerade geschnürt haben. wireshark-tip.md using filter: ip.dst==192.168.100.123   Netzwerkpakete fälschen mit Scapy Hier in diesem Beispiel ((Beispiel kann hier abgerufen werden https://www.python-forum.de/viewtopic.php?f=3&t=43536)) wird dargestellt wie man Scapy zum fälschen oder verändern von Netzwerkpaketen genutzt werden kann. from scapy.all import * import random wait_for_ack = False new_pkt = None def manip_pkt(pkt): global wait_for_ack global new_pkt try: if(pkt.sport == 4430 and isinstance(pkt.load, (bytes, bytearray))): new_pkt = pkt pkt.show() print("") wait_for_ack = True except: if wait_for_ack and pkt.haslayer(TCP) and pkt.flags == "A" and pkt.sport == 4430: pkt.show() new_len = new_pkt.len - len(new_pkt.load) + 5 new_seq = pkt.seq new_ack = pkt.ack new_id = random.randrange(1000, 65000) new_pkt.load = b"close" new_pkt.len = new_len new_pkt.seq = new_seq new_pkt.ack = new_ack new_pkt.id = new_id del new_pkt.chksum new_pkt.show2(dump=True) sendp(new_pkt) wait_for_ack = False else: pass sniff(iface="en0", prn=manip_pkt, store=0) Und hier die einzelnen Netzwerkpakete. ORIGINAL-PACKET: ###### dst = 40:f0:2f:c7:90:20 src = 00:1f:5b:34:45:3c type = 0x800 ###### version = 4 ihl = 5 tos = 0x0 len = 42 id = 34084 flags = DF frag = 0 ttl = 64 proto = tcp chksum = 0x0 src = 192.168.1.7 dst = 192.168.1.38 \options \ ###### sport = 4430 dport = 49710 seq = 1273911897 ack = 3316338221 dataofs = 5 reserved = 0 flags = PA window = 8192 chksum = 0x839a urgptr = 0 options = ###### load = 'oo' ACK-PACKET: ###### dst = 40:f0:2f:c7:90:20 src = 00:1f:5b:34:45:3c type = 0x800 ###### version = 4 ihl = 5 tos = 0x0 len = 40 id = 53843 flags = DF frag = 0 ttl = 64 proto = tcp chksum = 0x0 src = 192.168.1.7 dst = 192.168.1.38 \options \ ###### sport = 4430 dport = 49710 seq = 1273911899 ack = 3316338314 dataofs = 5 reserved = 0 flags = A window = 8189 chksum = 0x8398 urgptr = 0 options = SPOOFED-PACKET: ###### dst = 40:f0:2f:c7:90:20 src = 00:1f:5b:34:45:3c type = 0x800 ###### version = 4 ihl = 5 tos = 0x0 len = 45 id = 58454 flags = DF frag = 0 ttl = 64 proto = tcp chksum = 0x0 src = 192.168.1.7 dst = 192.168.1.38 \options \ ###### sport = 4430 dport = 49710 seq = 1273911899 ack = 3316338314 dataofs = 5 reserved = 0 flags = PA window = 8192 chksum = 0x466d urgptr = 0 options = ###### load = 'close' Read the full article

Python Network Programming - Part 3: Scapy & Security Tools ☞ http://deal.thegeeknews.net/p/HkwVUSgZx?utm_source=3 #python