• Revista PROGRAMAR: Já está disponível a edição #53 da revista programar. Faz já o download aqui!

teckV

Packet Ninjas - DOJOx<20>

1 mensagem neste tópico

header.jpg

entrando noutro mundo... aqui não há "explanations for idiots".. aqui é "RAW SOURCE POWER" - who understands... cool... understand... for the others... is just another closed door...  :nono: :bye2: :eek:

queria pretar uma homenagem à microsoft e a uma campanha publicitária por ela levada à unsa anos atrás "Where do you want to go today?"

hehhe e eu digo.. "Go anywhere... fly with scapy" - criação e manipulação de Raw Packets - forjar e analisar pacotes em estado bruto...

[glow=red,2,300]O PODER TOTAL NAS TUAS MÃOS[/glow]

What is Scapy

Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocolssend them on the wirecapture themmatch requests and repliesand much more. It can easily handle most classical tasks like scanningtraceroutingprobingunit testsattacks or network discovery (it can replace hping85% of nmaparpspoofarp-skarpingtcpdumptetherealp0fetc.). It also performs very well at a lot of other specific tasks that most other tools can't handlelike sending invalid framesinjecting your own 802.11 framescombining technics (VLAN hopping+ARP cache poisoningVOIP decoding on WEP encrypted channel...)etc.

What makes scapy different from most other networking tools

Firstwith most other toolsyou won't build someting the author did not imagine. These tools have been built for a specific goal and can't deviate much from it. For examplean ARP cache poisoning program won't let you use double 802.1q encapsulation. Or try to find a program that can sendsayan ICMP packet with padding (I said paddingnot payloadsee?). In facteach time you have a new needyou have to build a new tool.

Secondthey usually confuse decoding and interpreting. Machines are good at decoding and can help human beings with that. Interpretation is reserved to human beings. Some programs try to mimic this behaviour. For instance they say "this port is open" instead of "I received a SYN-ACK". Sometimes they are right. Sometimes not. It's easier for beginnersbut when you know what you're doingyou keep on trying to deduce what really happened from the program's interpretation to make your ownwhich is hard because you lost a big amount of information. And you often end up using tcpdump -xX to decode and interpret what the tool missed.

Thirdeven programs which only decode do not give you all the information they received. The network's vision they give you is the one their author thought was sufficient. But it is not completeand you have a bias. For instancedo you know a tool that reports the padding ?

Scapy tries to overcome those problems. It enables you to build exactly the packets you want. Even if I think stacking a 802.1q layer on top of TCP has no senseit may have some for somebody else working on some product I don't know. Scapy has a flexible model that tries to avoid such arbitrary limits. You're free to put any value you want in any field you wantand stack them like you want. You're an adult after all.

In factit's like building a new tool each timebut instead of dealing with a hundred line C programyou only write 2 lines of Scapy.

After a probe (scantracerouteetc.) Scapy always gives you the full decoded packets from the probebefore any interpretation. That means that you can probe once and interpret many timesask for a traceroute and look at the padding for instance.

Scapy... power on your hands

http://www.secdev.org/projects/scapy/

Packet Generation with Python - Curso muito bom

http://www.secdev.org/conf/scapy_csw05.pdf

Explore the Net with new eyes

http://www.secdev.org/conf/scapy_T2.pdf

Packet Wizardry: Ruling the Network with Pythonhttp://hackaholic.org/papers/blackmagic.txt

This doc describes the installation of Scapy under OpenBSD 3.8

http://pierre.droids-corp.org/scapy/README.openbsd

teckV on PT-DOJO WIRED

presta homenajem ao Dojo [cDc - "Cult of Dead Cow"] (masters on BBS) que tanto têm inspirado e dado força à comunidade... um ACK singelo... always ON-DOJO

:mad:

swords.jpg

0

Partilhar esta mensagem


Link para a mensagem
Partilhar noutros sites

Crie uma conta ou ligue-se para comentar

Só membros podem comentar

Criar nova conta

Registe para ter uma conta na nossa comunidade. É fácil!


Registar nova conta

Entra

Já tem conta? Inicie sessão aqui.


Entrar Agora