Building off the network programming we just discussed with sockets,
Scapy is a packet manipulation library.
Not only can it capture and read packets, it can also scan, test, and attack.
Scapy can be used for wireless testing and valid framing and injection attacks,
making it a powerful tool in the security professional's belt.
Scapy can be downloaded and ran as a standalone tool,
but we will talk through how to implement it in part of your Python code.
Tons of documentation on the subject,
the Python community has really built up this tool and supplied
it with a quality documentation to learn from.
As I mentioned, the primary use of Scapy is to dig into network packets,
sniffing them, creating them, you name it.
Scapy brings a lot of the functionality of tools like Wireshark
into the code and allows you to build custom tools for yourself
or your org to help in the fight.
Scapy is a large third‑party package and needs to be pip installed to work.
Looking at the functions, although not impactful on the Python coding itself,
the conf function provides you insight into the
configuration and setting of Scapy.
The parameters of this function allow you to make changes on the fly.
Sr and Sr1 are part of the send/receive module and send packets at layer 3.
The 1 in the sr1 is because only the first response packet is returned,
whereas all answered packets are returned with the sr.
The send function sends layer 3 packets with the parameters you set,
which is a huge win.
The parameters shown here inside the parentheses are just meant to
represent that you control the details of the packet,
the IP, UDP versus TCP, and over which port,
are there any flag set, and the DNS query,
meaning you can send a packet to a DNS server of your choice along with the DNS
QR asking for the DNS information for the specific domain.
The sniff sits on the other end of this and monitors all the
packets that pass by your various network interfaces,
or, if specified, an exact interface.
The parameters allow you to set what protocol to watch for,
is there a specific IP that you are interested in monitoring or what
traffic is coming in through the specific interface.
The show extends sniff and allows you to pick up one of
the packets you sniffed and dig deeper into it to see all
the various packet details.
The demo for Scapy will cover a couple different topics.
First we will sniff a few incoming packets and display the
full detail of one of those said packets.
We will then sniff some packets with the process function built in so
we can take action on the packets being sniffed.
Finally, packet creation.
Not only do we want to use this powerful tool for listening,
but when we run our port scanner and find an open port during a pen test,
we can use Scapy to probe that port more and send it things like
malformed packets to see how it handles it.
Scapy does need to be pulled down with a pip install to begin,
and I'm going to pull all the material into my script
available in the scapy.all package.
Looking at this first demo,
I am basically saying I want to pull in and drop the next
five packets sent to me on the screen.
The nsummary function will display the summary detail of those packets captured,
and show function with the 0 index will show me the full
detail of the first packet captured.
On the server I am running this on,
I will require some type of pcap software installed to capture packets.
I went ahead and installed Wireshark,
which comes with the Npcap and is a commercial use
application for this type of operation.
Once this demo is complete,
I want to compare the results and show you how Scapy brings the power
of Wireshark into the Python language. So let me jump into the server
and start this script. And while I run this demo, I will be sending
over some ping requests in the background from my laptop just to get
this moving along.
Okay,
it has now completed the five captures, and you see the
first packet details being displayed.
You can see the layers of the packet, the network,
the IP, the ICMP, and the raw data. Over here on the
Wireshark, a commercial packet capturing tool,
you can hopefully find the same packet. You can see here is the data,
the ICMP checksum matches, and the source and the
destination IP addresses as well.
Now, to take this a step further, in the next demo, we're going to take the
detail of the packets captured and drop it into a function to process them
on the fly. In this demo, we will print out the packet ID, the packet
source, and the destination. With the scapy2 script running, I'm going to
run a few pings, and I can see the last few are also captured in Wireshark.
Comparing them, I see the IP layer ID along with the IP address of the
servers.
The last demo for Scapy is going to flip this work and instead
of seeing the detail of captured packets,
I'm going to set the detail of the packet being sent.
When you find an open port on a network during a pen test,
you want to poke it a little and see what it is waiting for and
what kind of traffic does it handle. Looking at the code for the
third demo, the send command allows me to form a packet with each
layer separated by a slash.
I give it an IP, then the TCP layer, and I tell it to use port 80 and flag s.
Finally, the message payload. I can also create a packet with the sr1 method, as
you see here, and set the IP and packet type. So when I run this from my laptop
directed at the server, I'm going to add the 172.26.135.181 IP as the argument
so it drops it into the target.
I'm only listening to this traffic on the server in
Wireshark, but as you can see here,
when I narrow down the list to the TCP port 80 I can see
the packet and subsequent test message.