Packet generation and network based attacks with Scapy - SecDev.org

More documents

Recommendations

Info

IntroductionScapyNetwork discovery and attacksSliced Network ScanResults Interpretation : first routerOne shotsScanningTTL tricksTTL=8 2 80 113 4431.1.1.72 6408 2.2.2.62 11 6409 2.2.2.62 11 6410 RA 6411 2.2.2.62 111.1.1.73 6412 RA 6413 RA 6414 RA 6415 RA1.1.1.74 6416 2.2.2.62 11 6417 2.2.2.62 11 6418 RA 6419 2.2.2.62 111.1.1.75 6420 2.2.2.62 11 6421 2.2.2.62 11 6422 RA 6423 2.2.2.62 111.1.1.76 6424 2.2.2.62 11 6425 2.2.2.62 11 6426 RA 6427 2.2.2.62 111.1.1.77 6428 2.2.2.62 11 6429 2.2.2.62 11 6430 RA 6431 2.2.2.62 111.1.1.78 6432 2.2.2.62 11 6433 2.2.2.62 11 6434 RA 6435 2.2.2.62 111.1.1.79 6436 2.2.2.62 11 6437 2.2.2.62 11 6428 RA 6439 2.2.2.62 11The first IP to answer something is the router.The router has IP 2.2.2.62 on one side and 1.1.1.73 on theotherWe can see that the IP ID are consecutives.The router blocks ident port with Reset-Ack.Philippe BIONDIPacket generation and network based attacks with Scapy
IntroductionScapyNetwork discovery and attacksSliced Network ScanResults Interpretation : next sliceOne shotsScanningTTL tricksTTL=9 2 80 113 4431.1.1.73 6481 RA 6482 RA 6483 RA 6484 RA1.1.1.74 3943 RA 3944 SA 6485 RA 3945 RA1.1.1.75 3946 RA 3947 1.1.1.75 11 6486 RA 3948 1.1.1.75 111.1.1.76 - - 6487 RA -1.1.1.77 - - 6488 RA -1.1.1.78 6489 2.2.2.62 3 6490 2.2.2.62 3 6491 RA 6492 2.2.2.62 3Ports 80 and 443 of 1.1.1.75 are not reached but 1.1.1.75 isreached =⇒ we have a Destination NATIP ID suggest that 1.1.1.75 is NATed by 1.1.1.741.1.1.78 does not exist (did not answer to router’s ARPrequest)1.1.1.76,77 are claimed (answer to router’s ARP request) butdrop packetsPhilippe BIONDIPacket generation and network based attacks with Scapy
Page 2 and 3:
IntroductionScapyNetwork discovery
Page 5:
OutlineIntroductionScapyNetwork dis
Page 10 and 11:
Page 12 and 13:
OutlineIntroductionScapyNetwork dis
Page 14 and 15:
Page 16 and 17:
Page 18 and 19:
Page 20 and 21:
Page 22 and 23:
Page 24 and 25:
The GenesisThe spark that lit the p
Page 26 and 27:
Actual ArchitectureIntroductionScap
Page 28 and 29:
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Pretty printingIntroductionScapyNet
Page 62 and 63:
Page 64 and 65:
Page 66 and 67:
Page 68 and 69:
Page 70 and 71:
SendingIntroductionScapyNetwork dis
Page 72 and 73:
Page 74 and 75:
Page 76 and 77:
Page 78 and 79:
Page 80 and 81:
Page 82 and 83:
Page 84 and 85:
Page 86 and 87:
Page 88 and 89:
Page 90 and 91:
Page 92 and 93:
Page 94 and 95:
Page 96 and 97:
Page 98 and 99:
Page 100 and 101:
Page 102 and 103:
Page 104 and 105:
Page 106 and 107:
Page 108 and 109:
Result ManipulationIntroductionScap
Page 110 and 111: Result ManipulationIntroductionScap
Page 122 and 123: IntroductionScapyNetwork discovery
Page 130 and 131: Answering machinesIntroductionScapy
Page 132 and 133: OutlineIntroductionScapyNetwork dis
Page 136 and 137: TCP port scanIntroductionScapyNetwo
Page 138 and 139: IP protocol scanIntroductionScapyNe
Page 140 and 141: ARP pingIntroductionScapyNetwork di
Page 142 and 143: OutlineIntroductionScapyNetwork dis
Page 144 and 145: NAT findingIntroductionScapyNetwork
Page 166 and 167: ReferencesExternal scriptAppendices
Page 168 and 169: ReferencesExternal scriptReferences
show all

Packet generation and network based attacks with Scapy - SecDev.org

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?