Sniffer

[uomosteriman]

#!/usr/bin/python
import scapy
import re

while True:
   traffic=scapy.sniff(iface="eth1", store=1, count=1)
   ip_source=traffic[0].sprintf("%IP.src%")
   ip_destination=traffic[0].sprintf("%IP.dst%")
   mac_source=traffic[0].src 
   mac_dest=traffic[0].dst 
   dest_port=traffic[0].sprintf("%TCP.dport%")
   src_port=traffic[0].sprintf("%TCP.sport%")
   raw=traffic[0].sprintf("%Raw.load%")
   payload=traffic[0].sprintf("%TCP.payload%")
   a=scapy.Ether()/scapy.IP()/scapy.TCP()/scapy.ICMP()/scapy.ARP()/scapy.DNS()/scapy.DNSQR()
   if raw != "??":
      print "\nIP source: %s \nIP destination: %s \nMAC source: %s \nMAC destination: %s \nDestination port: %s \nSource port: %s\nPayload:\n %s" % (ip_source, ip_destination, mac_source, mac_dest, dest_port, src_port, payload)
      print "Hexdump:"
      scapy.hexdump(raw)

OUTPUT:

IP source: 192.168.1.102 
IP destination: 74.125.43.147 
MAC source: 00:e1:a7:76:76:81 
MAC destination: 00:17:c2:a2:06:f5 
Destination port: www 
Source port: 47310
Payload:
 GET /csi?v=3&s=webhp&action=&tran=undefined&ei=8RPfSYbcCY-ysAbjhMWxDA&e=17259,17291,20249,20253&rt=prt.41,xjs.307,ol.576 HTTP/1.1
Host: www.google.it
User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.8.1.8) Gecko/20071021 Firefox/2.0.0.8
Accept: image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.google.it/
Cookie: NID=21=Mgh2C6JhPP6utlfAZrSW5p_xQBijgfAtpusZgSZ6xVoCm-Hj7XfATwokiWvPunlaGQHvoIShk2qrmwpDWPbN6HzLa1bPK4eoo1kKvkbWe0kS7EHgncJxJWCM-OoMuDfL; PREF=ID=85ca8c8f6e9f46e8:TM=1239300852:LM=1239300852:S=yUju2J3-ZNOjRE4j


Hexdump:
0000   27 47 45 54 20 2F 63 73  69 3F 76 3D 33 26 73 3D   'GET /csi?v=3&s=
0010   77 65 62 68 70 26 61 63  74 69 6F 6E 3D 26 74 72   webhp&action=&tr
0020   61 6E 3D 75 6E 64 65 66  69 6E 65 64 26 65 69 3D   an=undefined&ei=
0030   38 52 50 66 53 59 62 63  43 59 2D 79 73 41 62 6A   8RPfSYbcCY-ysAbj
0040   68 4D 57 78 44 41 26 65  3D 31 37 32 35 39 2C 31   hMWxDA&e=17259,1
0050   37 32 39 31 2C 32 30 32  34 39 2C 32 30 32 35 33   7291,20249,20253
0060   26 72 74 3D 70 72 74 2E  34 31 2C 78 6A 73 2E 33   &rt=prt.41,xjs.3
0070   30 37 2C 6F 6C 2E 35 37  36 20 48 54 54 50 2F 31   07,ol.576 HTTP/1
0080   2E 31 5C 72 5C 6E 48 6F  73 74 3A 20 77 77 77 2E   .1\r\nHost: www.
0090   67 6F 6F 67 6C 65 2E 69  74 5C 72 5C 6E 55 73 65   google.it\r\nUse
00a0   72 2D 41 67 65 6E 74 3A  20 4D 6F 7A 69 6C 6C 61   r-Agent: Mozilla
00b0   2F 35 2E 30 20 28 58 31  31 3B 20 55 3B 20 4C 69   /5.0 (X11; U; Li
00c0   6E 75 78 20 69 36 38 36  3B 20 69 74 2D 49 54 3B   nux i686; it-IT;
00d0   20 72 76 3A 31 2E 38 2E  31 2E 38 29 20 47 65 63    rv:1.8.1.8) Gec
00e0   6B 6F 2F 32 30 30 37 31  30 32 31 20 46 69 72 65   ko/20071021 Fire
00f0   66 6F 78 2F 32 2E 30 2E  30 2E 38 5C 72 5C 6E 41   fox/2.0.0.8\r\nA
0100   63 63 65 70 74 3A 20 69  6D 61 67 65 2F 70 6E 67   ccept: image/png
0110   2C 2A 2F 2A 3B 71 3D 30  2E 35 5C 72 5C 6E 41 63   ,*/*;q=0.5\r\nAc
0120   63 65 70 74 2D 4C 61 6E  67 75 61 67 65 3A 20 65   cept-Language: e
0130   6E 2D 75 73 2C 65 6E 3B  71 3D 30 2E 35 5C 72 5C   n-us,en;q=0.5\r\
0140   6E 41 63 63 65 70 74 2D  45 6E 63 6F 64 69 6E 67   nAccept-Encoding
0150   3A 20 67 7A 69 70 2C 64  65 66 6C 61 74 65 5C 72   : gzip,deflate\r
0160   5C 6E 41 63 63 65 70 74  2D 43 68 61 72 73 65 74   \nAccept-Charset
0170   3A 20 49 53 4F 2D 38 38  35 39 2D 31 2C 75 74 66   : ISO-8859-1,utf
0180   2D 38 3B 71 3D 30 2E 37  2C 2A 3B 71 3D 30 2E 37   -8;q=0.7,*;q=0.7
0190   5C 72 5C 6E 4B 65 65 70  2D 41 6C 69 76 65 3A 20   \r\nKeep-Alive: 
01a0   33 30 30 5C 72 5C 6E 43  6F 6E 6E 65 63 74 69 6F   300\r\nConnectio
01b0   6E 3A 20 6B 65 65 70 2D  61 6C 69 76 65 5C 72 5C   n: keep-alive\r\
01c0   6E 52 65 66 65 72 65 72  3A 20 68 74 74 70 3A 2F   nReferer: http:/
01d0   2F 77 77 77 2E 67 6F 6F  67 6C 65 2E 69 74 2F 5C   /www.google.it/\
01e0   72 5C 6E 43 6F 6F 6B 69  65 3A 20 4E 49 44 3D 32   r\nCookie: NID=2
01f0   31 3D 4D 67 68 32 43 36  4A 68 50 50 36 75 74 6C   1=Mgh2C6JhPP6utl
0200   66 41 5A 72 53 57 35 70  5F 78 51 42 69 6A 67 66   fAZrSW5p_xQBijgf
0210   41 74 70 75 73 5A 67 53  5A 36 78 56 6F 43 6D 2D   AtpusZgSZ6xVoCm-
0220   48 6A 37 58 66 41 54 77  6F 6B 69 57 76 50 75 6E   Hj7XfATwokiWvPun
0230   6C 61 47 51 48 76 6F 49  53 68 6B 32 71 72 6D 77   laGQHvoIShk2qrmw
0240   70 44 57 50 62 4E 36 48  7A 4C 61 31 62 50 4B 34   pDWPbN6HzLa1bPK4
0250   65 6F 6F 31 6B 4B 76 6B  62 57 65 30 6B 53 37 45   eoo1kKvkbWe0kS7E
0260   48 67 6E 63 4A 78 4A 57  43 4D 2D 4F 6F 4D 75 44   HgncJxJWCM-OoMuD
0270   66 4C 3B 20 50 52 45 46  3D 49 44 3D 38 35 63 61   fL; PREF=ID=85ca
0280   38 63 38 66 36 65 39 66  34 36 65 38 3A 54 4D 3D   8c8f6e9f46e8:TM=
0290   31 32 33 39 33 30 30 38  35 32 3A 4C 4D 3D 31 32   1239300852:LM=12
02a0   33 39 33 30 30 38 35 32  3A 53 3D 79 55 6A 75 32   39300852:S=yUju2
02b0   4A 33 2D 5A 4E 4F 6A 52  45 34 6A 5C 72 5C 6E 5C   J3-ZNOjRE4j\r\n\
02c0   72 5C 6E 27                                        r\n'

 

[imported_BlackLight]

Troppo facile usando scapy :O

 

[uomosteriman]

Troppo facile usando scapy :O

si è quello il bello.scapy ti permette di fare dei tool di manipolazione di ciò che vuoi senza farti scervellare.lol facendolo usando i socket ci avrei messo una vita,meglio usando scapy

 

[orakool]

bè è una questionde di sfida contro se stessi, e comunque facendo le cose a manina si ha più libertà

comunque buon lavoro.