The Network Program Log Two (Scapy)

​
【Scapy】
【使用scapy處理資料包】

scapy的使用

from scapy.all import *
from scapy.layers.inet import *

pac = dir(scapy.layers)
print(pac) #執行程式碼後，會輸出Scapy中的各層

['builtins', 'cached', 'doc', 'file', 'loader', 'name', 'package', 'path', 'spec', 'all', 'bluetooth', 'bluetooth4LE', 'dcerpc', 'dhcp', 'dhcp6', 'dns', 'dot11', 'dot15d4', 'eap', 'gprs', 'gssapi', 'hsrp', 'inet', 'inet6', 'ipsec', 'ir', 'isakmp', 'kerberos', 'l2', 'l2tp', 'ldap', 'llmnr', 'lltd', 'mgcp', 'mobileip', 'mspac', 'netbios', 'netflow', 'ntlm', 'ntp', 'ppi', 'ppp', 'pptp', 'radius', 'rip', 'rtp', 'sctp', 'sixlowpan', 'skinny', 'smb', 'smb2', 'smbclient', 'smbserver', 'snmp', 'tftp', 'tls', 'vrrp', 'vxlan', 'x509', 'zigbee']

print(explore(scapy.layers.l2)) #檢視各種二層協議

檢視協議類的屬性

在使用Scapy構造資料包時，需要填入資料包的欄位，這些欄位就是類的屬性。Scapy目前使用頻率比較高的類是Ether類、IP類、TCP類和UDP類。

可以使用 ls(類名) 函式來檢視類擁有的屬性，如果不帶引數顯示的是Scapy支援的協議類。

print(explore(scapy.packet.ls(Ether)))

print(explore(scapy.packet.ls(IP)))

print(explore(scapy.packet.ls(TCP)))

print(explore(scapy.packet.ls(UDP)))

構造資料包

Scapy具有強大的資料包構造功能，利用Scapy可以直觀、靈活地構造各種資料包，甚至可以根據需要自定義網路協議。在構造資料包的時候，它遵循網路協議分層的思想，以引數化賦值的方式進行。

簡單構造：

pkt = IP()/TCP() #該包的結構包含IP部分和TCP部分

構造資料包：

pkt = IP(src="192.168.56.1",dst="192.168.56.100") /TCP()

Scapy 中的分層結構

OSI 模型中的下層協議在前，以/隔開

Ether()/IP()/TCP()

Ether 類用於設定傳送方和接收方的 MAC 地址

構造 HTTP、ICMP 包

資料包的檢視：

資料包傳送：

---

WARNING: WinPcap is now deprecated (not maintained). Please use Npcap instead

Begin emission:

Finished sending 1 packets.

...*

Received 4 packets, got 1 answers, remaining 0 packets

IP / ICMP 192.168.56.1 > 192.168.56.100 echo-request 0 ==> IP / ICMP 192.168.56.100 > 192.168.56.1 echo-reply 0

資料包的接收：

響應狀態:

常用函式：

過濾的語句：

host 192.168.1.1

dst host 192.168.1.1

src port 8080

乙太網（MAC 地址）源地址或者目的地址為 11：22：33：44：55：66

ether host 11:22:33:44:55:66

源 MAC 為 11:22:33:44:55:66 的資料包

ether src 11:22:33:44:55:66

源地址在 192.168.1.0/24 網段的資料包

src net 192.168.1.0/24

還可以使用 and、or、not 組合過濾

host 192.168.1.1 and port 8080

在IP地址為192.168.56.1的主機上ping 192.168.56.100，抓取ICMP的報文並輸出10個ICMP的報文：

from scapy.all import *
from scapy.layers.inet import *

from scapy.layers.inet6 import *

from scapy.all import sniff

print(dir(scapy.layers))

print(explore(scapy.packet.ls(Ether)))

print(explore(scapy.packet.ls(UDP)))

構造資料包，必須/分層

pkt = Ether(src="00:80:c2:00:00:14",dst="ff:ff:ff:ff:ff:ff")/IP(src="192.168.56.1",dst="192.168.56.100")/TCP()

pkt.show()

res = sr1(pkt)

res.show()

ls(pkt)

print(pkt.summary())

wrpcap("text.cap",pkt)

textcap = rdpcap("text.cap")

textcap.show()

print(conf.ifaces)

print(conf.route)

i = traceroute(["202.96.134.133"])

print(i)

pkt = IP(src="192.168.56.1",dst="192.168.56.100")/ICMP()

wrpcap("text2.cap",sr1(pkt))

def callback(pkt):
print(pkt.summary)
wrpcap("test.cap",pkt)

sniff(filter="icmp and 192.168.56.100",iface="VirtualBox Host-Only Ethernet Adapter #2",prn=callback,count=100)

匯入 二三四 層方法

from scapy.all import *
from scapy.layers.inet6 import *

應用層

from scapy.layers.inet import *
print(dir(scapy.layers))

['builtins', 'cached', 'doc', 'file', 'loader', 'name', 'package', 'path', 'spec',

'all', 'bluetooth', 'bluetooth4LE', 'dcerpc', 'dhcp', 'dhcp6', 'dns', 'dot11', 'dot15d4', 'eap', 'gprs', 'gssapi',

'hsrp', 'inet', 'inet6', 'ipsec', 'ir', 'isakmp', 'kerberos', 'l2', 'l2tp', 'ldap', 'llmnr', 'lltd', 'mgcp', 'mobileip',

'mspac', 'netbios', 'netflow', 'ntlm', 'ntp', 'ppi', 'ppp', 'pptp', 'radius', 'rip', 'rtp', 'sctp', 'sixlowpan', 'skinny',

'smb', 'smb2', 'smbclient', 'smbserver', 'snmp', 'tftp', 'tls', 'vrrp', 'vxlan', 'x509', 'zigbee']

構造包時檢視支援的報文(ipv4)：

print(explore(scapy.layers.inet))

Class |Name

--------------------------|-------------------------------------------

ICMP |ICMP

ICMPerror |ICMP in ICMP

IP |IP

IPOption |IP Option

IPOption_Address_Extension|IP Option Address Extension

IPOption_EOL |IP Option End of Options List

IPOption_LSRR |IP Option Loose Source and Record Route

IPOption_MTU_Probe |IP Option MTU Probe

IPOption_MTU_Reply |IP Option MTU Reply

IPOption_NOP |IP Option No Operation

IPOption_RR |IP Option Record Route

IPOption_Router_Alert |IP Option Router Alert

IPOption_SDBM |IP Option Selective Directed Broadcast Mode

IPOption_SSRR |IP Option Strict Source and Record Route

IPOption_Security |IP Option Security

IPOption_Stream_Id |IP Option Stream ID

IPOption_Timestamp |IP Option Timestamp

IPOption_Traceroute |IP Option Traceroute

IPerror |IP in ICMP

TCP |TCP

TCPAOValue |

TCPerror |TCP in ICMP

UDP |UDP

UDPerror |UDP in ICMP

None

檢視報頭 Ether：二層，IP：三層,IPv6,IPv4，

print(ls(Ether))

print(ls(IPv6))

print(ls(IP))

version : BitField (4 bits) = ('4')

ihl : BitField (4 bits) = ('None')

tos : XByteField = ('0')

len : ShortField = ('None')

id : ShortField = ('1')

flags : FlagsField = ('<Flag 0 ()>')

frag : BitField (13 bits) = ('0')

ttl : ByteField = ('64')

proto : ByteEnumField = ('0')

chksum : XShortField = ('None')

src : SourceIPField = ('None')

dst : DestIPField = ('None')

options : PacketListField = ('[]')

None

print('-----------------------------------------------')

構造資料包(鬆散模式，無MAC，遍歷網路卡)，無提示：

packet_instance = IP(src='192.168.56.1', dst='192.168.56.10') / ICMP()

Send packets at layer 3 and return only the first answer

res = sr1(packet_instance)

多行列印

print('sr1 func:', res.summary())

print('-----------------------------------------------')
print(ls(ICMP))

type +code 就是80，預設為request包

IP / ICMP 192.168.56.10 > 192.168.56.1 echo-reply 0

-----------------------------------------------

type : ByteEnumField = ('8')

code : MultiEnumField (Depends on 8) = ('0')

print('-----------------------------------------------')
pkt = IP(src='192.168.56.1', dst='192.168.56.10') / ICMP()

Send and receive packets at layer 3

包含通的和不通的。

res = sr(pkt)
print('sr func:', res)

(<Results: TCP:0 UDP:0 ICMP:1 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:0 Other:0>)

檢視pkt：

print(pkt.summary)
print(pkt.show())

資料包儲存在檔案中（寫）

wrpcap('icmp1.cap', pkt)
print(rdpcap('icmp1.cap'))

trace檢視路由,注意是列表。

a = traceroute(['www.huawei.com'])

print('intfaces:', conf.ifaces)

intfaces: Source Index Name MAC IPv4 IPv6

libpcap 11 Realtek Gaming GbE Family Controller c8:5a:cf:b2:cf:b9 169.254.71.47 fe80::1d46:113a:7d0a:32d4

192.168.31.92

libpcap 16 Bluetooth Device (Personal Area Network) 4c:d5:77:2f:f1:7a 169.254.196.2 fe80::228a:9928:1d88:26cc

libpcap 18 VirtualBox Host-Only Ethernet Adapter 0a:00:27:00:00:12 192.168.56.1 fe80::1417:553d:3311:fb5

def callback(pkt):
print(pkt.summary())

路由過濾：

pkt = sniff(filter='udp',prn=callback, count=9)
wrpcap('icmp2.cap',pkt)

PcapWriter

sniff(filter='udp and src host 192.168.56.10')

print(get_if_list())
print(conf.ifaces)

​