[demiurge666]

Hello,
I'm trying to intercept and modify packets with python in a man in the middle attack. Is there a module to do that?

Thx in advance.

[█ＢＯＲＮＥ█]

I think scapy is used for this kind of work

[demiurge666]

Yes, i've done research for this module and i already use it for arp poisoning but apparently scapy can't modify packets on the fly or drop incoming packets to send new ones to the victim.

[Preddy]

Scapy is very slick and powerful packet manipulation lib. It offers lot of possibilities. As for you yes It can be done but you need to find a solution that filters packets and pass thru your recv/send app. Likely a kernel module will do the job. [iptables/netfilter]

""apt-get install build-essential python-dev libnetfilter-queue-dev""
""pip install NetfilterQueue"" --> (github.com/kti/python-netfilterqueue)

pypi.python.org/pypi/NetfilterQueue/
coresecurity.com/corelabs-research/open-source-tools/impacket
//secdev.org/projects/scapy/doc/usage.html

Now you need to code protocol structure for intercepting packets on fly. (TCP-UDP-ICMP..)

PHP Code


<?php 
#! /usr/bin/env python2.7

from scapy.all import *
from netfilterqueue import NetfilterQueue

def modify(packet):
  pkt = IP(packet.get_payload()) #converts the raw packet to a scapy compatible string

  #modify the packet all you want here

  packet.set_payload(str(pkt)) #set the packet content to our modified version

  packet.accept() #accept the packet 



nfqueue = NetfilterQueue()
#1 is the iptabels rule queue number, modify is the callback function
nfqueue.bind(1, modify) 
try:
  print "[*] waiting for data"
  nfqueue.run()
except KeyboardInterrupt:
  pass 


[Goodies]

Edit: Oh shit, looks like I'm too late. I started this when I was in LA, but by the time I got back, Preddy had already answered...

Well, I was going to write it using pure SCAPY, but it turned out to be buggy as all hell and not worth posting. The NFQueue way is DEFINITELY the way to go. Keep in mind, it only runs on unix. On Kali 2, you may need to install the packages "libnetfilter-queue-dev" and "libnfnetlink-dev".

If you want me to write a POC, let me know...

[demiurge666]

these solutions seems great but it's not avaible on windows (Sorry for my lack of precision in this thread). I don't want to install a linux distro or a virtual machine just for that. What i'm searching is an alternative of NFQueue for windows.

[SIM-2015410]

these solutions seems great but it's not avaible on windows (Sorry for my lack of precision in this thread). I don't want to install a linux distro or a virtual machine just for that. What i'm searching is an alternative of NFQueue for windows.

If you are serious about doing this kind of thing, you will really just need to migrate to Linux at some point. Linux has much better tools and control over things like packet management whereas Windows deals with most of it without giving the user control. There is a reason Linux is used by professionals over Windows.

[Goodies]

If you are serious about doing this kind of thing, you will really just need to migrate to Linux at some point. Linux has much better tools and control over things like packet management whereas Windows deals with most of it without giving the user control. There is a reason Linux is used by professionals over Windows.

If you could condense this to about 5 words or so, this would be what I'd have on my grave stone.

[Mr. Robot]

If you could condense this to about 5 words or so, this would be what I'd have on my grave stone.

"Just migrate to Linux"

[SIM-2015410]

"Just migrate to Linux"

This ^
Its like that verb "defenestrate":
Remove Windows off your computer or throw your computer out the window.

[Mr. Robot]

This ^
Its like that verb "defenestrate":
Remove Windows off your computer or throw your computer out the window.

I also like the expression because his avatar is a bird :)

[Anzee]

Try network based attacks like ARP poisoning.

[SIM-2015410]

Try network based attacks like ARP poisoning.

All you have done is suggested he do what he was asking lol

[Anzee]

All you have done is suggested he do what he was asking lol

Not really?

He's looking to intercept and modify them and a library like pypcap could do the job but actually intercepting the packets?

[Goodies]

I wrote a POC code using purely SCAPY but it ended up not working right on Windows (at least not Python3 port)... I'll post it when I get home but it was nothing special... just make sure you delete BOTH the IP and TCP checksums after modifying the payload O.o that fucked me up for a cool minute...