[The_R]

I was searching to modify payloads in packets. And I found a succesfull way.
This script will setup an iptable (tcp and destination port 80) to set each received packet into our QUEUE. standard --queue-num 0. After that I am replacing the GET method to TST just to test is. And it works. Got questions on how this all works? Feel free to ask them!

PHP Code


<?php 
from scapy.all import *
import nfqueue
from scapy.layers import http

os.system('iptables -I OUTPUT -p  tcp --dport 80 -j NFQUEUE')

def callback(dummy, payload):
     data = payload.get_data()
     pkt = IP(data)
     pkt[TCP].payload = str(pkt[TCP].payload).replace("GET","TST")
     print "data:" + str(pkt[TCP].payload)

     del pkt[IP].chksum
     del pkt[TCP].chksum
     payload.set_verdict_modified(nfqueue.NF_ACCEPT, str(pkt), len(pkt))
     print 'spoofed..'


q = nfqueue.queue()
q.open()
q.bind(socket.AF_INET)
q.set_callback(callback)

q.create_queue(0)
try:
    q.try_run()
except KeyboardInterrupt, e:
    print "interrupted"


print "unbind"
q.unbind(socket.AF_INET)
os.system('iptables -F')
os.system('iptables -X')
                                                                      
print "close"
q.close() 


[MR.FREE]

Your using a Linux firewall iptable rule to grab all TCP port 80 packets and then injecting GET into those packets? Am I understanding that right? You said these packets are going into a Queue and then you inject GET? If the packets are already received(in queue), whats the thought process or benefit in injecting these packets? Your using a firewall rule to do this so either way its either your firewall or your targets firewall and you already have root so why inject packets??
Or Am I totally misunderstanding this?

[The_R]

I use this to inject adds in http packets. With a mitm attack we can set a callback loop over each packet and inject arbitary code into each packet in the queue. Get me? The firewall rule is just to make sure only destination port 80 (http) Packets will get in the queue.