4.8. Transport `scapy`

scapy is a Python framework for crafting and transmitting arbitrary packets
http://www.secdev.org/projects/scapy/
http://packetlife.net/blog/2011/may/23/introduction-scapy/

4.8.1. Installation

$ pip install scapy

4.8.2. Running

$ sudo scapy

4.8.3. Basic usage

4.8.4. Displays all available protocols

Displays all available protocols:

ls()
# ARP        : ARP
# ASN1_Packet : None
# BOOTP      : BOOTP
# CookedLinux : cooked linux
# DHCP       : DHCP options
# DHCP6      : DHCPv6 Generic Message)
# ...

4.8.5. Lists all command functions

Lists all command functions:

$ lsc()

Table 4.34. Scapy functions
Function	Description
`IPID_count`	Identify IP id values classes in a list of packets
`arpcachepoison`	Poison target's cache with (your MAC,victim's IP) couple
`arping`	Send ARP who-has requests to determine which hosts are up
`arpleak`	Exploit ARP leak flaws, like NetBSD-SA2017-002.
`bind_layers`	Bind 2 layers on some specific fields' values. It makes the packet being built
`bridge_and_sniff`	Forward traffic between interfaces if1 and if2, sniff and return
`chexdump`	Build a per byte hexadecimal representation
`computeNIGroupAddr`	Compute the NI group Address. Can take a FQDN as input parameter
`corrupt_bits`	Flip a given percentage or number of bits from a string
`corrupt_bytes`	Corrupt a given percentage or number of bytes from a string
`defrag`	defrag(plist) -> ([not fragmented], [defragmented],
`defragment`	defragment(plist) -> plist defragmented as much as possible
`dhcp_request`	Send a DHCP discover request and return the answer
`dyndns_add`	Send a DNS add message to a nameserver for 'name' to have a new 'rdata'
`dyndns_del`	Send a DNS delete message to a nameserver for 'name'
`etherleak`	Exploit Etherleak flaw
`explore`	Function used to discover the Scapy layers and protocols.
`fletcher16_checkbytes`	Calculates the Fletcher-16 checkbytes returned as 2 byte binary-string.
`fletcher16_checksum`	Calculates Fletcher-16 checksum of the given buffer.
`fragleak`	--
`fragleak2`	--
`fragment`	Fragment a big IP datagram
`fuzz`	Transform a layer into a fuzzy layer by replacing some default values by random objects
`getmacbyip`	Return MAC address corresponding to a given IP address
`getmacbyip6`	Returns the MAC address corresponding to an IPv6 address
`hexdiff`	Show differences between 2 binary strings
`hexdump`	Build a tcpdump like hexadecimal view
`hexedit`	Run hexedit on a list of packets, then return the edited packets.
`hexstr`	Build a fancy tcpdump like hex from bytes.
`import_hexcap`	Imports a tcpdump like hexadecimal view
`is_promisc`	Try to guess if target is in Promisc mode. The target is provided by its ip.
`linehexdump`	Build an equivalent view of hexdump() on a single line
`ls`	List available layers, or infos on a given layer class or name.
`neighsol`	Sends and receive an ICMPv6 Neighbor Solicitation message
`overlap_frag`	Build overlapping fragments to bypass NIPS
`promiscping`	Send ARP who-has requests to determine which hosts are in promiscuous mode
`rdpcap`	Read a pcap or pcapng file and return a packet list
`report_ports`	portscan a target and output a LaTeX table
`restart`	Restarts scapy
`send`	Send packets at layer 3
`sendp`	Send packets at layer 2
`sendpfast`	Send packets at layer 2 using tcpreplay for performance
`sniff`	Sniff packets and return a list of packets.
`split_layers`	Split 2 layers previously bound.
`sr`	Send and receive packets at layer 3
`sr1`	Send packets at layer 3 and return only the first answer
`sr1flood`	Flood and receive packets at layer 3 and return only the first answer
`srbt`	send and receive using a bluetooth socket
`srbt1`	send and receive 1 packet using a bluetooth socket
`srflood`	Flood and receive packets at layer 3
`srloop`	Send a packet at layer 3 in loop and print the answer each time
`srp`	Send and receive packets at layer 2
`srp1`	Send and receive packets at layer 2 and return only the first answer
`srp1flood`	Flood and receive packets at layer 2 and return only the first answer
`srpflood`	Flood and receive packets at layer 2
`srploop`	Send a packet at layer 2 in loop and print the answer each time
`tcpdump`	Run tcpdump or tshark on a list of packets
`traceroute`	Instant TCP traceroute
`traceroute6`	Instant TCP traceroute using IPv6
`traceroute_map`	Util function to call traceroute on multiple targets, then
`tshark`	Sniff packets and print them calling pkt.summary(), a bit like text wireshark
`wireshark`	Run wireshark on a list of packets
`wrpcap`	Write a list of packets to a pcap file

4.8.6. Reading PCAP files

Read packets from a pcap file
Write packets to a pcap file.

data = rdpcap("/spare/captures/isakmp.cap")
# <isakmp.cap: UDP:721 TCP:0 ICMP:0 Other:0>

4.8.7. Graphical dumps (PDF, PS)

Table 4.35. Graphical dumps (PDF, PS)
Command	Effect
`raw(pkt)`	assemble the packet
`hexdump(pkt)`	have a hexadecimal dump
`ls(pkt)`	have the list of fields values
`pkt.summary()`	for a one-line summary
`pkt.show()`	for a developed view of the packet
`pkt.show2()`	same as show but on the assembled packet (checksum is calculated, for instance)
`pkt.sprintf()`	fills a format string with fields values of the packet
`pkt.decode_payload_as()`	changes the way the payload is decoded
`pkt.psdump()`	draws a PostScript diagram with explained dissection
`pkt.pdfdump()`	draws a PDF with explained dissection
`pkt.command()`	return a Scapy command that can generate the packet

4.8.8. Generating sets of packets

Table 4.36. Generating sets of packets
Command	Effect
`summary()`	displays a list of summaries of each packet
`nsummary()`	same as previous, with the packet number
`conversations()`	displays a graph of conversations
`show()`	displays the preferred representation (usually nsummary())
`filter()`	returns a packet list filtered with a lambda function
`hexdump()`	returns a hexdump of all packets
`hexraw()`	returns a hexdump of the Raw layer of all packets
`padding()`	returns a hexdump of packets with padding
`nzpadding()`	returns a hexdump of packets with non-zero padding
`plot()`	plots a lambda function applied to the packet list
`make table()`	displays a table according to a lambda function

4.8.9. List of possible fields

dir(IP)

dir(TCP)

dir(ICMP)

dir(Ether)

4.8.10. IP packages

Packets are constructed as layers of protocols, loosely analogous to the OSI model, which can be manipulated independently or glued together.
IP() object represents an IPv4 header.

4.8.11. Create package

Create package:

ip = IP(src="192.168.0.1")
# <IP  src=192.168.0.1 |>

Create package:

ip = IP(src="192.168.0.1", dst="192.168.0.2")
# <IP  src=192.168.0.1 dst=192.168.0.2 |>

4.8.12. Modify package

Modify package:

ip = IP(src="192.168.0.1")
ip.dst = "192.168.0.2"
# <IP  src=192.168.0.1 dst=192.168.0.2 |>

4.8.13. Show package

Use the show() method of an object to display all of its fields:

ip = IP(src="192.168.0.1")
ip.show()
# ###[ IP ]###
#   version= 4
#   ihl= None
#   tos= 0x0
#   len= None
#   id= 1
#   flags=
#   frag= 0
#   ttl= 64
#   proto= ip
#   chksum= None
#   src= 192.168.0.1
#   dst= 127.0.0.1
#   \options\

4.8.14. TCP Package

4.8.15. Add TCP layer to IP package

Add a layer for protocol by using the division operator

Add a layer for protocol by using the division operator:

ip = IP(src="192.168.0.1", dst="192.168.0.2")
tcp = TCP(sport=1025, dport=80)

ip / tcp
# <IP  frag=0 proto=tcp src=192.168.0.1 dst=192.168.0.2 |<TCP  sport=blackjack dport=http |>>

Manipulate the TCP header fields just as IP header:

ip = IP(src="192.168.0.1", dst="192.168.0.2")
tcp = TCP(sport=1025, dport=80)

(tcp/ip).show()
# ###[ TCP ]###
#   sport= blackjack
#   dport= http
#   seq= 0
#   ack= 0
#   dataofs= None
#   reserved= 0
#   flags= S
#   window= 8192
#   chksum= None
#   urgptr= 0
#   options= []
# ###[ IP ]###
#      version= 4
#      ihl= None
#      tos= 0x0
#      len= None
#      id= 1
#      flags=
#      frag= 0
#      ttl= 64
#      proto= ip
#      chksum= None
#      src= 192.168.0.1
#      dst= 192.168.0.2
#      \options\

4.8.16. Ethernet frames

scapy also supports Ethernet and IEEE 802.11 at layer two:

Ether() / Dot1Q() / IP()
# <Ether  type=0x8100 |<Dot1Q  type=0x800 |<IP  |>>>

scapy also supports Ethernet and IEEE 802.11 at layer two:

Dot11() / IP()
# <Dot11  |<IP  |>>

4.8.17. Sending packets

4.8.18. OSI layer three

send() function if transmitting at layer three (i.e. without a layer two header)

ip = IP(src="192.168.0.1", dst="192.168.0.2")
tcp = TCP(sport=1025, dport=80)

send(ip/tcp)
# .
# Sent 1 packets.

4.8.19. OSI layer two

sendp() function if transmitting at layer two
Values for blank fields, such as the source and destination addresses in the Ethernet header, are populated automatically by scapy where possible.

ip = IP(src="192.168.0.1", dst="192.168.0.2")
tcp = TCP(sport=1025, dport=80)

sendp(Ether()/ip/tcp)
# .
# Sent 1 packets.

4.8.20. Send and Receive

scapy has the ability to listen for responses to packets it sends, such as ICMP echo requests (pings).

4.8.21. One packet

Build an IP packet carrying an ICMP header
Use the sr() (send/receive) function to transmit the packet and record any response

ip = IP(dst='python3.info')
packet = ip / ICMP()

sr(packet)
# Begin emission:
# Finished sending 1 packets.
#
# Received 4 packets, got 1 answers, remaining 0 packets
# (<Results: TCP:0 UDP:0 ICMP:1 Other:0>,
#  <Unanswered: TCP:0 UDP:0 ICMP:0 Other:0>)

4.8.22. Many packets

Send and listen for responses to multiple copies of the same packet
Use the srloop() function and specify a count of packets to send

ip = IP(dst="python3.info")
packet = ip / ICMP()

srloop(packet, count=3)
# RECV 1: IP / ICMP 104.18.227.122 > 172.20.10.2 echo-reply 0 / Padding
# RECV 1: IP / ICMP 104.18.227.122 > 172.20.10.2 echo-reply 0 / Padding
# RECV 1: IP / ICMP 104.18.227.122 > 172.20.10.2 echo-reply 0 / Padding
#
# Sent 3 packets, received 3 packets. 100.0% hits.
# (<Results: TCP:0 UDP:0 ICMP:3 Other:0>,
#  <PacketList: TCP:0 UDP:0 ICMP:0 Other:0>)

4.8.23. SYN Scans

SA or SYN-ACK flags indicating an open port.

4.8.24. Scan one port

Scan one port:

ip = IP(dst="python3.info")
tcp = TCP(dport=80, flags="S")

sr1(ip/tcp)
# Begin emission:
# Finished sending 1 packets.
#
# Received 4 packets, got 1 answers, remaining 0 packets
# <IP  version=4 ihl=5 tos=0x0 len=44 id=0 flags= frag=0 ttl=58 proto=tcp chksum=0x7e29 src=104.18.228.122 dst=172.20.10.2 |<TCP  sport=http dport=ftp_data seq=19296319 ack=1 dataofs=6 reserved=0 flags=SA window=29200 chksum=0xb1cc urgptr=0 options=[('MSS', 1408)] |<Padding  load='z*\xc2f\x87\xad\x93\xc5' |>>>