slides.md

customTheme	transition	highlightTheme	slideNumber	title	enableTitleFooter	logoImg
custom_night	slide	monokai	false	Hacking with Python	false	false

Hacking networks

with


---

What's Scapy


"Is a Python program that enables the user to send, sniff, dissect and forge network packets"

"In other words, is a powerful interactive packet manipulation program"

---

Let's forge some packets

--

Do you Remember OSI?

--

Show me the code

pkg = IP(dst="8.8.8.8")/ICMP(type=8)/"Payload Data"
pkg.show()

###[ IP ]### 
    version= 4
    ihl= None
    tos= 0x0
    len= None
    id= 1
    flags= 
    frag= 0
    ttl= 64
    proto= icmp
    chksum= None
    src= 192.168.177.131
    dst= 8.8.8.8
    \options\
    ###[ ICMP ]### 
        type= echo-request
        code= 0
        chksum= None
        id= 0x0
        seq= 0x0
        ###[ Raw ]### 
            load= 'Payload Data'

---

Let's send some packets

--

Some types of send

By layer

• Send in layer 3: send, sr, sr1, srloop...
• Sendp in layer 2: sendp, srp, srp1, srploop...

--

Some types of send

By behavior

• Just send some packages: send, sendp...
• Send some receive some: sr srp, srloop, srploop...
• Send some receive first: sr1, srp1...

--

Now, show the code

pkg = IP(dst="8.8.8.8")/ICMP(type=8)/"Payload Data"
rec = sr1(pkg)
rec.show()

###[ IP ]###
    version= 4
    ihl= 5
    tos= 0x0
    len= 40
    id= 25657
    flags= 
    frag= 0
    ttl= 128
    proto= icmp
    chksum= 0x5460
    src= 8.8.8.8
    dst= 192.168.177.131
    \options\
    ###[ ICMP ]###
        type= echo-reply
        code= 0
        chksum= 0xa9ed
        id= 0x0
        seq= 0x0
    ###[ Raw ]###
            load= 'Payload Data'
    ###[ Padding ]###
                load= '\x00\x00\x00\x00\x00\x00'

---

What about sniff and dissect

--

def arp_monitor_callback(pkt):
    # Dissect
    if ARP in pkt and pkt[ARP].op in (1,2): #who-has or is-at
        return print(f"{pkt[ARP].hwsrc} {pkt[ARP].psrc}")

# And sniff
sniff(prn=arp_monitor_callback, filter="arp", store=0)

00:0c:29:ff:ff:ff 192.168.177.131
00:50:56:ff:ff:ff 192.168.177.2

--

Little break for some code reading

• sendp - write packages at layer 2
• sniff and AsyncSniffer - for package reading from interface

---

Did you said powerful???


--

ping -c1 8.8.8.8

tcpdump arp

---

DEMO 1

--


---

DEMO 2

Pinecone - deauth module

--

---

DEMO 3

Pinecone - recon module