In this video we're going to learn how to work with escapee which is a highly versatile python module
for all things network traffic analysis sniffing back ad manipulation and much more so to kick things
off if you don't have it installed open up a command prompt if you're in Windows or terminal if you're
in Linux and type that or 3 install escapee and that's it.
Oh and if I failed to mention in previous videos I'm using Python 3 in Windows 10.
Now one of the best ways to learn about KP is by visiting the official documentation at escaping that
net.
And of course there are many entire books written on this module so you can check that yourself if you're
interested and I need to point out that most of what I'm doing here and in the rest of the videos does
not come from my stellar or original thinking.
I'm also getting inspiration from many books courses websites and over here I'm going to specify the
best of them in the resources that may accompany this video or this course.
All right so escape.
Now you can work with escapee in multiple ways.
Once you have it installed and added to your bath environment variable you can use it directly in the
command line or in the terminal by typing escapee and it's gonna pop up escapee shell or you can simply
use it in scripts such as importing it in Python and using it accordingly.
Now let's start with the first one and look into a few basic commands.
So in terminal I'm simply going to type escapee hit enter and we're going to see a scabies shell popping
up.
And like I said escaping lets you craft manipulate and forge your network packets.
Not only that but it also allows us to sniff and dissect packets from all over the network across multiple
layers of the OSA model.
Therefore you can use KP for both good and malicious purposes and my intention is to encourage you to
find only good uses to it.
Now what are some of the commands that are mostly used in escape.
So first we have the less which gives us a huge amount of the protocols supported by escapee.
There is no reason for me to actually go through all of them and there is also the less C which is a
list of commands we can run interactively in this shell.
There is also the conf to display and also to modify the current configuration and if you're ever in
trouble you can type help and give it as parameter or whatever you want to find more information about.
For example RTP cap.
OK now let's get practical so let's actually craft a simple packet at the IP layer we'll say back underscore
IP we'll give it a destination.
Equals the GTD SEC dot com which is one of my web sites TTL time to lift done and that's basically all
you need to do to create a packet hit enter and we can look into it with back on their sport but show
we can see the protocol the IP the source destination check some length and other stuff.
And remember I told you about the configuration over here.
Let's make this back and display more nicely by modifying the configuration.
So in the Com over here we can see a variable call or theme black and white to have a nicer display
of the output escape you can modify this color theme color underscore theme so we'll do conf dot color
underscore theme.
This is gonna be color so color on black theme.
Hit enter.
No color on black color on black theme so theme.
All right.
Yeah you can get a sneak preview of it already being modified.
Now we can repeat the command with back on their scoreboard show.
And as you can see this looks much much better.
I said that this KP also lets us deeply analyze and sniff network traffic similar to wire in DCP dump.
Let's just do that on my Wi-Fi network.
So what do we need first is to provide KP with the network interface and the number of packets we want
to sniff.
You could sniff continuously and break the sniff for whenever you want and then you'd be analyzing the
packets you sniffed up until the break point but we'll just do the first version and so let's actually
get the name of my Wi-Fi which I faces from interfaces and my Wi-Fi.
In this case is Intel wireless AC this ninety five sixty two will actually copy this name and then create
a sniffer.
So let's say sniff for underscore equals sniff on my face so interface and then paste my interface name
and the number of bankers we want to snuff.
Let's say 15.
Now this might take a little while to collect 15 packets.
And it's done.
Then we can simply sniff or underscored that show and we get a nice summary overview of each back such
as the tie.
Put the layer the source the destination port etc. We can get deeper into each back and using in the
indexes so we can say sniff or underscore index 5 that show we can see that sixth back at 0 0 1 2 3
4 5.
This back it from 1 72 so we have the destination 1 Ninety five 1 0 8.
The source the destination and all the information with respect to this packet.
If we want to access the load of the packet we could simply say sniffer underscored that so without
the DOT five dot load.
And this is the raw load of the packet but we can do a hex dump with a hex dump and therefore underscore
5 of the load and we get the hex dump of the load or we can go ahead a hex dump of the entire back at
itself and we can see the hex none of the entire packet itself okay.
There are thousands of interesting things you can do with all of these and the rest of the methods you
could for example sniff continuously and the only filter into the output the back is that contains certain
information such as usernames passwords hacking attempts etc. And in this case the sniffer method has
a lot of parameters it can take including I face for the interface and count as we saw beforehand which
allows us to specify a function to run on each back it time time out to stop the sniffer after a given
time filters etc.
Now let's also take the example of sniffing with filters for a specific host.
One of my current Web sites DG dissect dot com so we'll say sniff for sniff and then we'll specify a
filter equals.
But first we need to get the IP of digital sacked dot com so we'll do that with a bang.
Or simply thing digital SAC dot com and get the IP 160 to copy this and then let's specify a filter
for port for 4 and 3 and host the IP and then let's sniff for 15 packets and specify of lambda functions
so now and BDA packs we're gonna look at the summary of each packet.
All right.
And now if I do a refresh on DG D SAC dot com we can see it populated the sniffer.
It actually took the first 15 packets and gathered their summary using the lambda function with defined.
Now I could write this snuff session to file with W R P cap level you are p caps or write back it.
The file is going to be DG t that cap and we want to write this enough for it to file okay and then
we can read it with our DP camp.
We specify the file.
Did you see that cap and that's it.
And it tells us that it has 15 packets.
If I do RTP gap I can do the entire thing in a variable so let's call it read underscored a cap or DP
Cap Digital cap.
We have it instantiated in a variable and then we'll say read cap let's say look at index 5.
And once again we have all the information there.
Okay.
Now let's take the example of sending a simple packet and receiving its response.
We can send back it's a different layers but let's just create and send one at layer 3.
Let's call it back and underscore t IP destination once again DG D SEC dot com over ICMP
and then let's say you are not secured and then we send this packet with the s method methods or we'll
say Assad back it underscored that t this actually sends the packet
we can see the output finish sending one packet.
Or we could write a variable for example let's say rasp from response and SA packet which is basically
the same thing.
And but since this is a variable we can look into it with rest 0.
That summary
and we get its details now to give you an idea of what you can further do is that with escapee You can
also do port scans and trace routes using some of the methods I specified here.
You could for example spoof IP and you could do some flooding and these two actually often come in a
combination.
Now in terms of scripting would escape in Python let's actually take an example of a script for sin
flooding and this is an example inspired by T.J. O'Connor.
Is this book Violent python.
So for that let's actually go into the code editor here.
Visual Basic and type from escapee dot all import everything.
This is how it's usually done instead of just importing scape.
We're just from escapee dot all import everything.
Now let's define a function called floods.
So floods which is going to take two parameters a source and a target and then for let's say source
underscored P in range one hundred one hundred.
Or I could say zero to 50.
What we want to do is to have an IP layer IP so we define it back and here with the source being the
source the destination being the target and then we also need to specify a DCP layer which is going
to be DCP source port.
So as port which is source forth it's going to be source P which with defined over here and then the
port which is the destination for let's say we want to send this chain of backwards to port 600.
And then we create the back end using IP layer over DC b not connecting but layer and ultimately we
will say send B 18.
All right.
Now exiting the loop would define a source which is local host.
So I'm going to flood myself 0 0 1 and then target is gonna be it's not actually that I'm going to flood
myself because this is the source the source is myself and I'm going to send the targets to let's say
what was the IP of the g d dissect dot com.
One more time I think it's this one.
Let's see.
So again we take the IP of DG D SAC dot com and send like safe feet D the inoffensive packets which
is low.
We can consider that a flood.
And finally what do we want to do is to run the floods from source to the target.
And that's it.
Control asked to save this.
And then in a command prompt over here we navigate to the desktop where we have the script the floods
that why and we can simply fire fine floods.
Why.
And we can see it sent.
Actually it sent 50 packets.
However as you can imagine if I modify the range instead of 50 packets I wouldn't be sending a couple
of thousands.
That means that I would be sending DCP send to the target and fill up their connection queue meaning
that I would be actually flooding and empowering them and sending reset packets.
And this is just a sneak preview of what the escaping is actually capable of.
I've only shown you here a very small part of its capacity and there is more to that such as Back at
the injection and deep back at analysis for example and network scanning network filtering advanced
back at grafting and much much more.
Again I highly encourage you to look into the official documentation and into the books written on escape
before a more in-depth understanding of this amazing Python tool.
It's like I always say the only limit is your imagination.