7.02 Packet manipulation with Scapy.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "8b691cbf",
   "metadata": {},
   "source": [
    "# Scapy\n",
    "\n",
    "Scapy is a powerful Python-based interactive packet manipulation program and library.\n",
    "\n",
    "\n",
    "- source: https://github.com/secdev/scapy\n",
    "- based on: https://github.com/secdev/scapy/blob/master/doc/notebooks/Scapy%20in%2015%20minutes.ipynb\n",
    "\n",
    "\n",
    "## Contents\n",
    "0. Install packages\n",
    "1. My first scapy\n",
    "2. Packet inspection"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c57ddb65",
   "metadata": {},
   "source": [
    "## 0. Install packages"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "c9a478d1",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Collecting scapy\n",
      "  Using cached scapy-2.5.0.tar.gz (1.3 MB)\n",
      "  Preparing metadata (setup.py) ... \u001b[?25ldone\n",
      "\u001b[?25hBuilding wheels for collected packages: scapy\n",
      "  Building wheel for scapy (setup.py) ... \u001b[?25ldone\n",
      "\u001b[?25h  Created wheel for scapy: filename=scapy-2.5.0-py2.py3-none-any.whl size=1444326 sha256=7e22234137abb41427ef97c00777d891873487172713614a56e15e36001a4ad0\n",
      "  Stored in directory: /Users/michielbontenbal/Library/Caches/pip/wheels/62/14/01/370c0063b5c1482143836c55f39233ec898ec2b01c251771cd\n",
      "Successfully built scapy\n",
      "Installing collected packages: scapy\n",
      "Successfully installed scapy-2.5.0\n",
      "Note: you may need to restart the kernel to use updated packages.\n"
     ]
    }
   ],
   "source": [
    "pip install --pre scapy"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2688b0f8",
   "metadata": {},
   "source": [
    "## 1. My first scapy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "004ef922",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'2.5.0'"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "import scapy\n",
    "scapy.__version__"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "32112759",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'Ether / IP / TCP 192.168.178.59:ftp_data > Net(\"www.hva.nl/32\"):http S'"
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#getting ip of a given website\n",
    "from scapy.all import *\n",
    "packet = Ether()/IP(dst=\"www.hva.nl\")/TCP()\n",
    "packet.summary()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "026e2f19",
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "WARNING: getmacbyip failed on Permission denied: could not open /dev/bpf0. Make sure to be running Scapy as root ! (sudo)\n",
      "WARNING: Mac address to reach destination not found. Using broadcast.\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "###[ Ethernet ]### \n",
      "  dst       = ff:ff:ff:ff:ff:ff\n",
      "  src       = 3c:22:fb:ec:87:f0\n",
      "  type      = IPv4\n",
      "###[ IP ]### \n",
      "     version   = 4\n",
      "     ihl       = None\n",
      "     tos       = 0x0\n",
      "     len       = None\n",
      "     id        = 1\n",
      "     flags     = \n",
      "     frag      = 0\n",
      "     ttl       = 64\n",
      "     proto     = tcp\n",
      "     chksum    = None\n",
      "     src       = 192.168.178.59\n",
      "     dst       = Net(\"www.hva.nl/32\")\n",
      "     \\options   \\\n",
      "###[ TCP ]### \n",
      "        sport     = ftp_data\n",
      "        dport     = http\n",
      "        seq       = 0\n",
      "        ack       = 0\n",
      "        dataofs   = None\n",
      "        reserved  = 0\n",
      "        flags     = S\n",
      "        window    = 8192\n",
      "        chksum    = None\n",
      "        urgptr    = 0\n",
      "        options   = ''\n",
      "\n"
     ]
    }
   ],
   "source": [
    "packet.show()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "fea516e4",
   "metadata": {},
   "source": [
    "## 2. Packet inspection"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "id": "7afba046",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "b'E\\x00\\x00=\\x00\\x01\\x00\\x00@\\x11k\"\\xc0\\xa8\\xb2;\\x91\\x12\\x0b\\x97\\x005\\x005\\x00)\\xa5H\\x00\\x00\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x03www\\x07example\\x03com\\x00\\x00\\x01\\x00\\x01'\n"
     ]
    }
   ],
   "source": [
    "pkt = IP() / UDP() / DNS(qd=DNSQR())\n",
    "print(repr(raw(pkt)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "39080fb5",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "IP / UDP / DNS Qry \"b'www.example.com.'\" \n"
     ]
    }
   ],
   "source": [
    "print(pkt.summary())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "d5d609e5",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0000  45 00 00 3D 00 01 00 00 40 11 7C AD 7F 00 00 01  E..=....@.|.....\n",
      "0010  7F 00 00 01 00 35 00 35 00 29 B6 D3 00 00 01 00  .....5.5.)......\n",
      "0020  00 01 00 00 00 00 00 00 03 77 77 77 07 65 78 61  .........www.exa\n",
      "0030  6D 70 6C 65 03 63 6F 6D 00 00 01 00 01           mple.com.....\n"
     ]
    }
   ],
   "source": [
    "hexdump(pkt)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "fe18d3d8",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "###[ IP ]### \n",
      "  version   = 4\n",
      "  ihl       = None\n",
      "  tos       = 0x0\n",
      "  len       = None\n",
      "  id        = 1\n",
      "  flags     = \n",
      "  frag      = 0\n",
      "  ttl       = 64\n",
      "  proto     = udp\n",
      "  chksum    = None\n",
      "  src       = 127.0.0.1\n",
      "  dst       = 127.0.0.1\n",
      "  \\options   \\\n",
      "###[ UDP ]### \n",
      "     sport     = domain\n",
      "     dport     = domain\n",
      "     len       = None\n",
      "     chksum    = None\n",
      "###[ DNS ]### \n",
      "        id        = 0\n",
      "        qr        = 0\n",
      "        opcode    = QUERY\n",
      "        aa        = 0\n",
      "        tc        = 0\n",
      "        rd        = 1\n",
      "        ra        = 0\n",
      "        z         = 0\n",
      "        ad        = 0\n",
      "        cd        = 0\n",
      "        rcode     = ok\n",
      "        qdcount   = 1\n",
      "        ancount   = 0\n",
      "        nscount   = 0\n",
      "        arcount   = 0\n",
      "        \\qd        \\\n",
      "         |###[ DNS Question Record ]### \n",
      "         |  qname     = 'www.example.com.'\n",
      "         |  qtype     = A\n",
      "         |  qclass    = IN\n",
      "        an        = None\n",
      "        ns        = None\n",
      "        ar        = None\n",
      "\n"
     ]
    }
   ],
   "source": [
    "pkt.show()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d72007d4",
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "9284ae6d",
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e5338654",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.9"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}