+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [Python] Intercepting packets using man in the middle attack. (/showthread.php?tid=5323801)
Pages: Pages
1
2
Intercepting packets using man in the middle attack. - demiurge666 - Jul 1, 2016
Hello,
I'm trying to intercept and modify packets with python in a man in the middle attack. Is there a module to do that?
Thx in advance.
* - █ＢＯＲＮＥ█ - Jul 1, 2016
I think scapy is used for this kind of work
* - demiurge666 - Jul 1, 2016
Yes, i've done research for this module and i already use it for arp poisoning but apparently scapy can't modify packets on the fly or drop incoming packets to send new ones to the victim.
* - Preddy - Jul 1, 2016
Scapy is very slick and powerful packet manipulation lib. It offers lot of possibilities. As for you yes It can be done but you need to find a solution that filters packets and pass thru your recv/send app. Likely a kernel module will do the job. [iptables/netfilter]
""apt-get install build-essential python-dev libnetfilter-queue-dev""
""pip install NetfilterQueue"" --> (github.com/kti/python-netfilterqueue)
pypi.python.org/pypi/NetfilterQueue/
coresecurity.com/corelabs-research/open-source-tools/impacket
//secdev.org/projects/scapy/doc/usage.html
Now you need to code protocol structure for intercepting packets on fly. (TCP-UDP-ICMP..)
PHP Code
<?php
#! /usr/bin/env python2.7
from scapy.all import *
from netfilterqueue import NetfilterQueue
def modify(packet):
pkt = IP(packet.get_payload()) #converts the raw packet to a scapy compatible string
#modify the packet all you want here
packet.set_payload(str(pkt)) #set the packet content to our modified version
packet.accept() #accept the packet
nfqueue = NetfilterQueue()
#1 is the iptabels rule queue number, modify is the callback function
nfqueue.bind(1, modify)
try:
print "[*] waiting for data"
nfqueue.run()
except KeyboardInterrupt:
pass
* - Goodies - Jul 1, 2016
Edit: Oh shit, looks like I'm too late. I started this when I was in LA, but by the time I got back, Preddy had already answered...
Well, I was going to write it using pure SCAPY, but it turned out to be buggy as all hell and not worth posting. The NFQueue way is DEFINITELY the way to go. Keep in mind, it only runs on unix. On Kali 2, you may need to install the packages "libnetfilter-queue-dev" and "libnfnetlink-dev".
If you want me to write a POC, let me know...
* - demiurge666 - Jul 2, 2016
these solutions seems great but it's not avaible on windows (Sorry for my lack of precision in this thread). I don't want to install a linux distro or a virtual machine just for that. What i'm searching is an alternative of NFQueue for windows.
* - SIM-2015410 - Jul 2, 2016
(Jul 2, 2016 01:01 AM)demiurge666 Wrote: these solutions seems great but it's not avaible on windows (Sorry for my lack of precision in this thread). I don't want to install a linux distro or a virtual machine just for that. What i'm searching is an alternative of NFQueue for windows.
If you are serious about doing this kind of thing, you will really just need to migrate to Linux at some point. Linux has much better tools and control over things like packet management whereas Windows deals with most of it without giving the user control. There is a reason Linux is used by professionals over Windows.
* - Goodies - Jul 2, 2016
(Jul 2, 2016 04:45 PM)MeshCollider Wrote: If you are serious about doing this kind of thing, you will really just need to migrate to Linux at some point. Linux has much better tools and control over things like packet management whereas Windows deals with most of it without giving the user control. There is a reason Linux is used by professionals over Windows.
If you could condense this to about 5 words or so, this would be what I'd have on my grave stone.
* - Mr. Robot - Jul 2, 2016
(Jul 2, 2016 05:38 PM)Goodies Wrote: If you could condense this to about 5 words or so, this would be what I'd have on my grave stone.
"Just migrate to Linux"
* - SIM-2015410 - Jul 2, 2016
(Jul 2, 2016 05:40 PM)Mr. Robot Wrote: "Just migrate to Linux"
This ^
Its like that verb "defenestrate":
Remove Windows off your computer or throw your computer out the window.
* - Mr. Robot - Jul 2, 2016
(Jul 2, 2016 07:19 PM)MeshCollider Wrote: This ^
Its like that verb "defenestrate":
Remove Windows off your computer or throw your computer out the window.
I also like the expression because his avatar is a bird :)
* - Anzee - Jul 2, 2016
Try network based attacks like ARP poisoning.
* - SIM-2015410 - Jul 2, 2016
(Jul 2, 2016 08:09 PM)Anzee Wrote: Try network based attacks like ARP poisoning.
All you have done is suggested he do what he was asking lol
* - Anzee - Jul 2, 2016
(Jul 2, 2016 08:14 PM)MeshCollider Wrote: All you have done is suggested he do what he was asking lol
Not really?
He's looking to intercept and modify them and a library like pypcap could do the job but actually intercepting the packets?
* - Goodies - Jul 2, 2016
I wrote a POC code using purely SCAPY but it ended up not working right on Windows (at least not Python3 port)... I'll post it when I get home but it was nothing special... just make sure you delete BOTH the IP and TCP checksums after modifying the payload O.o that fucked me up for a cool minute...