Python黑客编程3网络数据监听和过滤

apt-get install libpcap-dev

pip install pypcap

root@kali:/home/pycharm# pip install scapy

root@kali:/home/pycharm# pip install scapy-http

1.1  技术没有黑白，网络编程的基础是协议

1.2  使用pypcap实时抓包

import pcap

pc=pcap.pcap('wlan0')  #注，参数可为网卡名，如eth0

pc.setfilter('tcp port 80')    #2.设置监听过滤器

for ptime,pdata in pc:    #ptime为收到时间，pdata为收到数据

    print ptime,pdata    #...

1.3  使用dpkt 解析数据包

1.3.1 实时解析

import pcap

import dpkt

def captData():

    pc=pcap.pcap('wlan0')  #注，参数可为网卡名，如eth0

    pc.setfilter('tcp port 80')    #设置监听过滤器

    for ptime,pdata in pc:    #ptime为收到时间，pdata为收到数据

        anlyCap(pdata);

def anlyCap(pdata):

    p=dpkt.ethernet.Ethernet(pdata)

    if p.data.__class__.__name__=='IP':

        ip='%d.%d.%d.%d'%tuple(map(ord,list(p.data.dst)))

        if p.data.data.__class__.__name__=='TCP':

            if p.data.data.dport==80:

                print p.data.data.data # http 要求的数据  

captData();

1.3.2 解析离线数据包

import dpkt

import socket

#----------------------------------------------------------------------

def printPcap(pcap):

    """"""

    for(ts,buf) in pcap:

        try:

            eth=dpkt.ethernet.Ethernet(buf);

            ip=eth.data;

            src=socket.inet_ntoa(ip.src);

            dst=socket.inet_ntoa(ip.dst);

            tcp=ip.data;#tcp.dport  tcp.sport

            print '[+]Src: '+src+ ' --->Dst: '+ dst

        except:

            pass;

#----------------------------------------------------------------------

def main():

    """"""

    f=open('/home/pcap/test.pcap');#1.open file

    pcap=dpkt.pcap.Reader(f);# init pcap obj

    printPcap(pcap);

if __name__ == '__main__':

    main();

1.4 使用Scapy进行数据监听

1.4.1 Scapy基本使用

1.4.2  sniff

sniff(count=0,store=1,offline=None,prn=None,lfilter=None,L2socket=None,timeout=None,opened_socket=None,stop_filter=None,*arg,**karg)

    Sniff packets

    sniff([count=0,] [prn=None,] [store=1,] [offline=None,] [lfilter=None,] + L2ListenSocket args) -> list of packets

      count: number of packets to capture. 0 means infinity

      store: wether to store sniffed packets or discard them

        prn: function to apply to each packet. If something is returned,

             it is displayed. Ex:

             ex: prn = lambda x: x.summary()

    lfilter: python function applied to each packet to determine

             if further action may be done

             ex: lfilter = lambda x: x.haslayer(Padding)

    offline: pcap file to read packets from,instead of sniffing them

    timeout: stop sniffing after a given time (default: None)

    L2socket: use the provided L2socket

    opened_socket: provide an object ready to use .recv() on

    stop_filter: python function applied to each packet to determine

                 if we have to stop the capture after this packet

                 ex: stop_filter = lambda x: x.haslayer(TCP)

sniff(filter="icmp and host 66.35.250.151",count=2)

sniff(iface="wifi0",prn=lambda x: x.summary())

sniff(iface="eth1",prn=lambda x: x.show())

from scapy.all import *

ap_list = []

def PacketHandler(pkt) :

    if pkt.haslayer(Dot11) :

        if pkt.type == 0 and pkt.subtype == 8 :

            if pkt.addr2 not in ap_list :

                ap_list.append(pkt.addr2)

                print "AP MAC: %s with SSID: %s " %(pkt.addr2,pkt.info)

sniff(iface="wlan0mon",prn = PacketHandler)

1.4.3 Scapy-http

import scapy_http.http as HTTP

from scapy.all import *

from scapy.error import Scapy_Exception

count=0

def pktTCP(pkt):

    global count

    count=count+1

    print count

    if HTTP.HTTPRequest or HTTP.HTTPResponse in pkt:

        src=pkt[IP].src

        srcport=pkt[IP].sport

        dst=pkt[IP].dst

        dstport=pkt[IP].dport

        test=pkt[TCP].payload

        if HTTP.HTTPRequest in pkt:

            #print "HTTP Request:"

            #print test

            print "======================================================================"

        if HTTP.HTTPResponse in pkt:

            print "HTTP Response:"

            try:

                headers,body= str(test).split("rnrn",1)

                print headers

            except Exception,e:

                print e

            print "======================================================================"

    else:

        #print pkt[IP].src,pkt[IP].sport,'->',pkt[TCP].flags

        print 'other'

sniff(filter='tcp and port 80',prn=pktTCP,iface='wlan0')

sudo python net-creds.py

sudo python net-creds.py -i eth0

sudo python net-creds.py -f 192.168.0.2

python net-creds.py -p pcapfile

    ipr = Popen(['/sbin/ip','route'],stdout=PIPE,stderr=DN)

        for line in ipr.communicate()[0].splitlines():

            if 'default' in line:

                l = line.split()

                iface = l[4]

                return iface

def telnet_logins(src_ip_port,dst_ip_port,load,ack,seq):

    '''

    Catch telnet logins and passwords

    '''

    global telnet_stream

    msg = None

    if src_ip_port in telnet_stream:

        # Do a utf decode in case the client sends telnet options before their username

        # No one would care to see that

        try:

            telnet_stream[src_ip_port] += load.decode('utf8')

        except UnicodeDecodeError:

            pass

        # r or rn or n terminate commands in telnet if my pcaps are to be believed

        if 'r' in telnet_stream[src_ip_port] or 'n' in telnet_stream[src_ip_port]:

            telnet_split = telnet_stream[src_ip_port].split(' ',1)

            cred_type = telnet_split[0]

            value = telnet_split[1].replace('rn','').replace('r','').replace('n','')

            # Create msg,the return variable

            msg = 'Telnet %s: %s' % (cred_type,value)

            printer(src_ip_port,msg)

            del telnet_stream[src_ip_port]

    # This part relies on the telnet packet ending in

    # "login:","password:",or "username:" and being <750 chars