Raw-packet project

Important information:

This project is created only for educational purposes and can not be used for law violation or personal gain.
The author of this project is not responsible for any possible harm caused by the materials of this project.

Важная информация:

Данный проект создан исключительно в образовательных целях, и не может быть использован в целях нарушающих законодательство, в корыстных целях или для получения какой-либо выгоды как для самого автора так и лиц его использующих.
Автор данного проекта не несет ответственности за любой возможный вред, причиненный материалами данного проекта.

Info

Author: Vladimir Ivanov
SubAuthors: Ilja Bulatov
Project email: raw.packet.project@gmail.com
PGP Public key: raw.packet.project@gmail.com PGP Public key
Current project version: 0.2.1
Last stable release: 0.1.1
Required OS: Linux based
Python versions: 3.7
License: MIT

Install

Debian based OS install with apt (recommended):

sudo apt update && sudo apt install -y python3 python3-pip python3-netifaces \
                                       python-ipaddress python3-netaddr \
                                       python3-psutil python3-prettytable \
                                       python3-distro python3-xmltodict \
                                       python3-paramiko python3-colorama \
                                       apache2 php lsof net-tools nmap \
                                       wireless-tools aircrack-ng tshark git
pip3 install npyscreen scapy pycryptodomex getmac
git clone https://github.com/raw-packet/raw-packet && cd ./raw-packet

Debian based OS install with pip:

sudo apt update && sudo apt install -y python3 python3-pip apache2 php \
                                       lsof net-tools wireless-tools \
                                       nmap aircrack-ng tshark git
git clone https://github.com/raw-packet/raw-packet && cd ./raw-packet
pip3 install -r requirements.txt

MacOS install:

1. Install Homebrew:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

2. Install/upgrade wireshark and python3:

if brew ls --versions wireshark; then brew upgrade wireshark; else brew install wireshark; fi
brew cask install wireshark-chmodbpf
if brew ls --versions python3; then brew upgrade python3; else brew install python3; fi

3. Reboot

4. Install Raw-packet:

git clone https://github.com/raw-packet/raw-packet && cd ./raw-packet
pip3 install -r requirements.txt

Windows install:

1. Install Wireshark

2. Install Python 3.8

3. Reboot

4. Download and unpack Raw-packet

5. Install requirements

pip3 install --upgrade pip
pip3 install ifaddr ipaddress netaddr scapy psutil
pip3 install prettytable distro xmltodict paramiko
pip3 install npyscreen pycryptodomex getmac colorama

Publications

Apple security updates: https://support.apple.com/en-us/HT209341

PHDays: https://www.phdays.com/en/program/reports/apple-all-about-mitm/

Yandex it sec pro course 2018 #0: https://events.yandex.ru/lib/talks/5519/

Xakep.ru: https://xakep.ru/2017/09/25/wifi-mitm-advanced/

Habr.com:
https://habrahabr.ru/company/dsec/blog/333978/
https://habrahabr.ru/post/338860/
https://habrahabr.ru/post/338864/
https://habrahabr.ru/post/339666/

Scapy vs. Raw-packet

Script time_test.py results:

Number of Packets	10	100	1000	10000
ARP requests in Scapy (sec)	0,0522048473358	0,0785529613495	0,302206039429	2,95294880867
ARP requests in Raw-packet (sec)	0,00202298164368	0,00270104408264	0,090922832489	1,3037519455
DHCP discover requests in Scapy (sec)	0,397399187088	4,16092181206	39,5892789364	-
DHCP discover requests in Raw-packet (sec)	0,00177597999573	0,0219049453735	0,162989854813	-
DNS requests in Scapy (sec)	0.608256101608	6.05325508118	58.4151289463	-
DNS requests in Raw-packet (sec)	0.00274395942688	0.0127770900726	0.0796978473663	-

Scripts

WiFi

Script: attack_tool.py

Cross-platform WiFi attack tool

Works on MacOS and Linux
Collects wireless AP information
Sends association packets
Sends deauthentication packets
Switch between WiFi channels
Saves WPA handshakes in formats: pcap, hccapx, 22000
Supports PMKID (AP clientless attack)
Saves WPA RSN PMKID in format for hashcat brute
Supports vulnerability CVE-2019-15126 kr00k (decryption of CCMP packet with NULL 128 bits - temporary key)

root@kali:~/raw-packet# python3 Scripts/WiFi/attack_tool.py -h
usage: attack_tool.py [-h] [-i INTERFACE] [-c CHANNEL]

Cross platform WiFi attack tool

Ctrl-E Show Wireless access point information
Ctrl-D Send IEEE 802.11 deauth packets
Ctrl-D Switch WiFi channel
Ctrl-A Send IEEE 802.11 association packet
Ctrl-R Start scanner (switch between WiFi channels)
Ctrl-H Show help information
Ctrl-C Exit

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set wireless interface name for sniff packets
  -c CHANNEL, --channel CHANNEL
                        Set WiFi channel

Sample script output:

Video demo:

Apple attacks

Script: apple_mitm.py

This script automatically finds Apple devices on the local network using an ARP, NMAP or ICMPv6 scan and implements the MiTM attack with the following techniques:

ARP Spoofing
Second DHCP ACK
Predict next DHCP transaction ID
Rogue SLAAC/DHCPv6 server
NA Spoofing (IPv6)
RA Spoofing (IPv6)

root@kali:~/raw-packet# python3 Scripts/Apple/apple_mitm.py --help
usage: apple_mitm.py [-h] [-T TECHNIQUE] [-D DISCONNECT] [-l LISTEN_IFACE]
                     [-d DEAUTH_IFACE] [-0 DEAUTH_PACKETS]
                     [-f PHISHING_DOMAIN] [-p PHISHING_DOMAIN_PATH]
                     [-t TARGET_IP] [-n NEW_IP] [-s] [--kill]
                     [--ipv6_prefix IPV6_PREFIX]

MiTM Apple devices in local network

optional arguments:
  -h, --help            show this help message and exit
  -T TECHNIQUE, --technique TECHNIQUE
                        Set MiTM technique:
                        1. ARP Spoofing
                        2. Second DHCP ACK
                        3. Predict next DHCP transaction ID
                        4. Rogue SLAAC/DHCPv6 server
                        5. NA Spoofing (IPv6)
                        6. RA Spoofing (IPv6)
  -D DISCONNECT, --disconnect DISCONNECT
                        Set device Disconnect technique:
                        1. IPv4 network conflict detection
                        2. Send WiFi deauthentication packets
                        3. Do not disconnect device after MiTM
  -l LISTEN_IFACE, --listen_iface LISTEN_IFACE
                        Set interface name for send DHCPACK packets
  -d DEAUTH_IFACE, --deauth_iface DEAUTH_IFACE
                        Set interface name for send wifi deauth packets
  -0 DEAUTH_PACKETS, --deauth_packets DEAUTH_PACKETS
                        Set number of deauth packets (default: 5)
  -f PHISHING_DOMAIN, --phishing_domain PHISHING_DOMAIN
                        Set domain name for social engineering (default="auth.apple.wi-fi.com")
  -p PHISHING_DOMAIN_PATH, --phishing_domain_path PHISHING_DOMAIN_PATH
                        Set local path to for social engineering site 
                        in directory: raw_packet/Utils/Phishing_domains 
                        or use your own directory (default="apple")
  -t TARGET_IP, --target_ip TARGET_IP
                        Set target IP address
  -n NEW_IP, --new_ip NEW_IP
                        Set new IP address for target
  -s, --nmap_scan       Use nmap for Apple device detection
  --kill                Kill all processes and threads
  --ipv6_prefix IPV6_PREFIX
                        Set IPv6 network prefix, default - fd00::/64

Sample script output:

Script: apple_arp_dos.py

Disconnect Apple device from the local network using ARP packets

root@kali:~/raw-packet# python3 Scripts/Apple/apple_arp_dos.py --help
usage: apple_arp_dos.py [-h] [-i INTERFACE] [-t TARGET_IP] [-m TARGET_MAC]
                        [-n] [-q]

Disconnect Apple device in local network with ARP packets

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set interface name for send ARP packets
  -t TARGET_IP, --target_ip TARGET_IP
                        Set target IP address
  -m TARGET_MAC, --target_mac TARGET_MAC
                        Set target MAC address
  -n, --nmap_scan       Use nmap for Apple device detection
  -q, --quit            Minimal output

Sample script output:

Traffic sample generated by this script:

Script: apple_rogue_dhcp.py

Rogue DHCP server for Apple device with predict next DHCP transaction ID

root@kali:~/raw-packet# python3 Scripts/Apple/apple_rogue_dhcp.py --help
usage: apple_rogue_dhcp.py [-h] [-i INTERFACE] -m TARGET_MAC -t TARGET_NEW_IP
                           [-b] [-q]

Rogue DHCP server for Apple devices

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set interface name for send DHCP reply packets
  -m TARGET_MAC, --target_mac TARGET_MAC
                        Set target MAC address, required!
  -t TARGET_NEW_IP, --target_new_ip TARGET_NEW_IP
                        Set new client IP address, required!
  -b, --broadcast       Send broadcast DHCPv4 responses
  -q, --quiet           Minimal output

Sample script output:

ARP

The Address Resolution Protocol (ARP) is a communication protocol used for discovering the link layer address, such as a MAC address, associated with a given internet layer address, typically an IPv4 address.

Script: arp_scan.py

This script creates and sends ARP requests (Who has?) to search for alive hosts on the local network.

root@kali:~/raw-packet# python3 Scripts/ARP/arp_scan.py --help
usage: arp_scan.py [-h] [-i INTERFACE] [-T TARGET_IP] [-t TIMEOUT] [-r RETRY]

ARP scan script

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set interface name for ARP scanner
  -T TARGET_IP, --target_ip TARGET_IP
                        Set target IP address
  -t TIMEOUT, --timeout TIMEOUT
                        Set timeout (default=3)
  -r RETRY, --retry RETRY
                        Set number of retry (default=3)

Sample script output:

Traffic sample generated by this script:

Script: arp_spoof.py

This script implement the ARP spoofing attack. ARP spoofing, ARP cache poisoning or ARP poison routing, is a technique that an attacker sends fake (spoofed) Address Resolution Protocol (ARP) messages onto a local network.

root@kali:~/raw-packet# python3 Scripts/ARP/arp_spoof.py --help
usage: arp_spoof.py [-h] [-i INTERFACE] [-t TARGET_IP] [-m TARGET_MAC]
                    [-g GATEWAY_IP] [-r] [--ipv4_multicast_requests]
                    [--ipv6_multicast_requests] [-R] [-q]

ARP spoofing script

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set interface name for send ARP packets
  -t TARGET_IP, --target_ip TARGET_IP
                        Set target IP address
  -m TARGET_MAC, --target_mac TARGET_MAC
                        Set target MAC address
  -g GATEWAY_IP, --gateway_ip GATEWAY_IP
                        Set gateway IP address
  -r, --requests        Send only ARP requests
  --ipv4_multicast_requests
                        Send only ARP IPv4 multicast requests
  --ipv6_multicast_requests
                        Send only ARP IPv6 multicast requests
  -R, --broadcast_requests
                        Send only ARP broadcast requests
  -q, --quiet           Minimal output

Sample script output:

Traffic sample generated by this script:

Video demo:

DHCP

The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on UDP/IP networks whereby a DHCP server dynamically assigns an IP address and other network configuration parameters to each device on a network so they can communicate with other IP networks.

Script: dhcp_starvation.py

This script implement the attack - DHCP starvation. DHCP starvation attack is an attack that targets DHCP servers whereby forged DHCP requests are crafted by an attacker with the intent of exhausting all available IP addresses that can be allocated by the DHCP server.

root@kali:~/raw-packet# python3 Scripts/DHCPv4/dhcp_starvation.py --help
usage: dhcp_starvation.py [-h] [-i INTERFACE] [-d DELAY] [-t TIMEOUT] [-n]
                          [-v DHCP_OPTION_VALUE] [-c DHCP_OPTION_CODE] [-f]
                          [-m]

DHCP Starvation attack script

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set interface name for send discover packets
  -d DELAY, --delay DELAY
                        Set delay time in seconds (default: 1)
  -t TIMEOUT, --timeout TIMEOUT
                        Set receiving timeout in seconds (default: 10)
  -n, --not_send_hostname
                        Do not send hostname in DHCP request
  -v DHCP_OPTION_VALUE, --dhcp_option_value DHCP_OPTION_VALUE
                        Set DHCP option value
  -c DHCP_OPTION_CODE, --dhcp_option_code DHCP_OPTION_CODE
                        Set DHCP option code (default: 12)
  -f, --find_dhcp       Only find DHCP server in your network
  -m, --mac_change      Use mac change technique

Sample script output:

Traffic sample generated by this script:

Demo video:

Script: dhcp_rogue_server.py

This script implements an attack on network clients by using fake DHCP server which answers with malicious configuration faster than legitimate DHCP server. This attack also known as Rogue DHCP Server Attack.

root@kali:~/raw-packet# python3 Scripts/DHCPv4/dhcp_rogue_server.py --help
usage: dhcp_rogue_server.py [-h] [-i INTERFACE] [-f FIRST_OFFER_IP]
                            [-l LAST_OFFER_IP] [-t TARGET_MAC] [-T TARGET_IP]
                            [-m NETMASK] [--dhcp_mac DHCP_MAC]
                            [--dhcp_ip DHCP_IP] [--router ROUTER] [--dns DNS]
                            [--tftp TFTP] [--wins WINS] [--proxy PROXY]
                            [--domain DOMAIN] [--lease_time LEASE_TIME] [-s]
                            [-r] [-d DISCOVER_DELAY]
                            [-O SHELLSHOCK_OPTION_CODE]
                            [-c SHELLSHOCK_COMMAND] [-b] [-p BIND_PORT] [-N]
                            [-E] [-R] [-e REVERSE_PORT] [-n] [-B]
                            [--ip_path IP_PATH] [--iface_name IFACE_NAME]
                            [--broadcast_response] [--dnsop] [--exit]
                            [--apple] [-q]

Rogue DHCPv4 server

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set interface name for send reply packets
  -f FIRST_OFFER_IP, --first_offer_ip FIRST_OFFER_IP
                        Set first client ip for offering
  -l LAST_OFFER_IP, --last_offer_ip LAST_OFFER_IP
                        Set last client ip for offering
  -t TARGET_MAC, --target_mac TARGET_MAC
                        Set target MAC address
  -T TARGET_IP, --target_ip TARGET_IP
                        Set client IP address with MAC in --target_mac
  -m NETMASK, --netmask NETMASK
                        Set network mask
  --dhcp_mac DHCP_MAC   Set DHCP server MAC address, if not set use your MAC
                        address
  --dhcp_ip DHCP_IP     Set DHCP server IP address, if not set use your IP
                        address
  --router ROUTER       Set router IP address, if not set use your ip address
  --dns DNS             Set DNS server IP address, if not set use your ip
                        address
  --tftp TFTP           Set TFTP server IP address
  --wins WINS           Set WINS server IP address
  --proxy PROXY         Set Proxy URL, example: 192.168.0.1:8080
  --domain DOMAIN       Set domain name for search, default=local
  --lease_time LEASE_TIME
                        Set lease time, default=172800
  -s, --send_discover   Send DHCP discover packets in the background thread
  -r, --discover_rand_mac
                        Use random MAC address for source MAC address in DHCP
                        discover packets
  -d DISCOVER_DELAY, --discover_delay DISCOVER_DELAY
                        Set delay between DHCP discover packets (default=0.5
                        sec.)
  -O SHELLSHOCK_OPTION_CODE, --shellshock_option_code SHELLSHOCK_OPTION_CODE
                        Set dhcp option code for inject shellshock payload,
                        default=114
  -c SHELLSHOCK_COMMAND, --shellshock_command SHELLSHOCK_COMMAND
                        Set shellshock command in DHCP client
  -b, --bind_shell      Use awk bind tcp shell in DHCP client
  -p BIND_PORT, --bind_port BIND_PORT
                        Set port for listen bind shell (default=1234)
  -N, --nc_reverse_shell
                        Use nc reverse tcp shell in DHCP client
  -E, --nce_reverse_shell
                        Use nc -e reverse tcp shell in DHCP client
  -R, --bash_reverse_shell
                        Use bash reverse tcp shell in DHCP client
  -e REVERSE_PORT, --reverse_port REVERSE_PORT
                        Set port for listen bind shell (default=443)
  -n, --without_network
                        Do not add network configure in payload
  -B, --without_base64  Do not use base64 encode in payload
  --ip_path IP_PATH     Set path to "ip" in shellshock payload, default =
                        /bin/
  --iface_name IFACE_NAME
                        Set iface name in shellshock payload, default = eth0
  --broadcast_response  Send broadcast response
  --dnsop               Do not send DHCP OFFER packets
  --exit                Exit on success MiTM attack
  --apple               Add delay before send DHCP ACK
  -q, --quiet           Minimal output

Sample script output:

Result:

Demo video:

DHCPv6

The Dynamic Host Configuration Protocol version 6 (DHCPv6) is a network protocol for configuring Internet Protocol version 6 (IPv6) hosts with IP addresses, IP prefixes and other configuration data required to operate in an IPv6 network. It is the IPv6 equivalent of the Dynamic Host Configuration Protocol for IPv4.

Script: dhcpv6_rogue_server.py

This script implements fake DHCPv6 server for performing SLAAC attack/Rogue DHCPv6.

root@kali:~/raw-packet# python3 Scripts/DHCPv6/dhcpv6_rogue_server.py --help
usage: dhcpv6_rogue_server.py [-h] [-i INTERFACE] [-p PREFIX]
                              [-f FIRST_SUFFIX] [-l LAST_SUFFIX]
                              [-t TARGET_MAC] [-T TARGET_IPV6] [-D] [-d DNS]
                              [-s DNS_SEARCH] [--delay DELAY] [-q]

Rogue SLAAC/DHCPv6 server

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set interface name for send reply packets
  -p PREFIX, --prefix PREFIX
                        Set network prefix
  -f FIRST_SUFFIX, --first_suffix FIRST_SUFFIX
                        Set first suffix client IPv6 for offering
  -l LAST_SUFFIX, --last_suffix LAST_SUFFIX
                        Set last suffix client IPv6 for offering
  -t TARGET_MAC, --target_mac TARGET_MAC
                        Set target MAC address
  -T TARGET_IPV6, --target_ipv6 TARGET_IPV6
                        Set client Global IPv6 address with MAC --target_mac
  -D, --disable_dhcpv6  Do not use DHCPv6 protocol
  -d DNS, --dns DNS     Set recursive DNS IPv6 address
  -s DNS_SEARCH, --dns_search DNS_SEARCH
                        Set DNS search list
  --delay DELAY         Set delay between packets
  -q, --quiet           Minimal output

Sample script output:

Result:

Demo video:

ICMPv4

Script: icmpv4_redirect.py

This script implement the ICMPv4 redirect attack.

root@kali:~/raw-packet# python3 Scripts/ICMPv4/icmpv4_redirect.py -h
usage: icmpv4_redirect.py [-h] [-i INTERFACE] [-t TARGET_IP] [-m TARGET_MAC]
                          [-g GATEWAY_IP] [-r REDIRECT_IP] [-q]

ICMPv4 redirect script

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set interface name for send ICMP redirect packets
  -t TARGET_IP, --target_ip TARGET_IP
                        Set target IP address
  -m TARGET_MAC, --target_mac TARGET_MAC
                        Set target MAC address
  -g GATEWAY_IP, --gateway_ip GATEWAY_IP
                        Set gateway IP address (default: <your_ip_address>)
  -r REDIRECT_IP, --redirect_ip REDIRECT_IP
                        Set IP addresses where to redirect (example:
                        8.8.8.8,1.1.1.1)
  -q, --quiet           Minimal output

Sample script output:

Traffic sample generated by this script:

ICMPv6

Script: icmpv6_scan.py

Search for hosts that support IPv6 in local network using ICMPv6 protocol

root@kali:~/raw-packet# python3 Scripts/ICMPv6/icmpv6_scan.py --help
usage: icmpv6_scan.py [-h] [-i INTERFACE] [-m TARGET_MAC] [-t TIMEOUT]
                      [-r RETRY] [-s]

ICMPv6 scanner script

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set interface name for ARP scanner
  -m TARGET_MAC, --target_mac TARGET_MAC
                        Set target MAC address
  -t TIMEOUT, --timeout TIMEOUT
                        Set timeout (default=3)
  -r RETRY, --retry RETRY
                        Set number of retry (default=3)
  -s, --router_search   Search router IPv6 link local address

Sample script output:

Traffic sample generated by this script:

Script: icmpv6_spoof.py

This script implements Router Advertisement and Neighbor Advertisement spoofing attack

root@kali:~/raw-packet# python3 Scripts/ICMPv6/icmpv6_spoof.py --help
usage: icmpv6_spoof.py [-h] [-T TECHNIQUE] [-i INTERFACE] [-t TARGET_IP]
                       [-m TARGET_MAC] [-g GATEWAY_IP] [-p IPV6_PREFIX]
                       [-d DNS_IP] [-n DNS_DOMAIN_SEARCH] [-q]

ICMPv6 spoofing

optional arguments:
  -h, --help            show this help message and exit
  -T TECHNIQUE, --technique TECHNIQUE
                        Set ICMPv6 MiTM technique (example: 1)
                        1. ICMPv6 RA (Router Advertisement) Spoofing
                        2. ICMPv6 NA (Neighbor Advertisement) Spoofing
  -i INTERFACE, --interface INTERFACE
                        Set interface name for send ARP packets
  -t TARGET_IP, --target_ip TARGET_IP
                        Set target IPv6 link local address
  -m TARGET_MAC, --target_mac TARGET_MAC
                        Set target MAC address
  -g GATEWAY_IP, --gateway_ip GATEWAY_IP
                        Set gateway IPv6 link local address
  -p IPV6_PREFIX, --ipv6_prefix IPV6_PREFIX
                        Set IPv6 prefix, default="fde4:8dba:82e1:ffff::/64"
  -d DNS_IP, --dns_ip DNS_IP
                        Set DNS server IPv6 link local address
  -n DNS_DOMAIN_SEARCH, --dns_domain_search DNS_DOMAIN_SEARCH
                        Set DNS domain search; default: "local"
  -q, --quiet           Minimal output

Router Advertisement spoofing

Sample script output:

Traffic sample generated by this script:

Neighbor Advertisement spoofing

Sample script output:

Traffic sample generated by this script:

DNS

Script: dns_server.py

This script implements a simple DNS server (like a dnschef), which is useful in MiTM attacks. You can setup A or AAAA records for several domains.

root@kali:~/raw-packet# python3 Scripts/DNS/dns_server.py --help
usage: dns_server.py [-h] [-i INTERFACE] [-p PORT] [-t TARGET_MAC] [--T4 T4]
                     [--T6 T6] [-c CONFIG_FILE] [--fake_domains FAKE_DOMAINS]
                     [--no_such_domains NO_SUCH_DOMAINS]
                     [--fake_ipv4 FAKE_IPV4] [--fake_ipv6 FAKE_IPV6] [--ipv6]
                     [--disable_ipv4] [--log_file_name LOG_FILE_NAME]
                     [--log_file_format LOG_FILE_FORMAT] [-f] [-q]

DNS server

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set interface name for send DNS reply packets
  -p PORT, --port PORT  Set UDP port for listen DNS request packets (default:
                        53)
  -t TARGET_MAC, --target_mac TARGET_MAC
                        Set target MAC address
  --T4 T4               Set target IPv4 address
  --T6 T6               Set target IPv6 address
  -c CONFIG_FILE, --config_file CONFIG_FILE
                        Set json config file name, example: --config_file
                        "dns_server_config.json"
  --fake_domains FAKE_DOMAINS
                        Set fake domain regexp or domains, example:
                        --fake_domains ".*apple.com,.*google.com"
  --no_such_domains NO_SUCH_DOMAINS
                        Set no such domain or domains, example:
                        --no_such_domains "apple.com,google.com"
  --fake_ipv4 FAKE_IPV4
                        Set fake IP address or addresses, example: --fake_ipv4
                        "192.168.0.1,192.168.0.2"
  --fake_ipv6 FAKE_IPV6
                        Set fake IPv6 address or addresses, example:
                        --fake_ipv6 "fd00::1,fd00::2"
  --ipv6                Enable IPv6
  --disable_ipv4        Disable IPv4
  --log_file_name LOG_FILE_NAME
                        Set file name for save DNS queries (default:
                        "dns_server_log")
  --log_file_format LOG_FILE_FORMAT
                        Set file format for save results: csv, xml, json, txt
                        (default: "json")
  -f, --fake_answer     Set your IPv4 or IPv6 address in all answers
  -q, --quiet           Minimal output

Sample script configuration:

{
  ".*google.com": {
    "A": ["192.168.0.1", "192.168.0.2"],
    "AAAA": "fd00::1",
    "NS": ["ns1.google.com", "ns2.google.com"],
    "MX": "mail.google.com"
  },
  ".*apple.com": {
    "A": "192.168.0.1",
    "AAAA": ["fd00::1", "fd00::2"],
    "NS": "ns.apple.com",
    "MX": ["mail1.apple.com", "mail2.apple.com"]
  },
  "gooogle.com": {
    "no such domain": true
  },
  "evil.com": {
    "success": true,
    "A": "my ipv4 address",
    "AAAA": "my ipv6 address"
  }
}

Sample script output (without parameters):

Sample script output (fake answer):

Exploits

Script: dnsmasploit.py

This script implements an exploit for CVE-2017-14493 and CVE-2017-14494 vulnerabilities in dnsmasq (DNS Server).

root@kali:~/raw-packet# ./dnsmasploit.py -h
usage: dnsmasploit.py [-h] [-i INTERFACE] [-e] [-l] [-f FILE_NAME] -t TARGET
                      [-p TARGET_PORT] [-a ARCHITECTURE] [-v VERSION]
                      [--interpreter INTERPRETER]
                      [--interpreter_arg INTERPRETER_ARG] [--payload PAYLOAD]
                      [--command COMMAND] [--bind_port BIND_PORT]
                      [--reverse_port REVERSE_PORT]
                      [--reverse_host REVERSE_HOST]

Exploit for dnsmasq CVE-2017-14493 and CVE-2017-14494

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set interface name for send packets
  -e, --exploit         Exploit (CVE-2017-14493) works only if Stack cookie
                        and PIE disabled
  -l, --data_leak       Data leakage (CVE-2017-14494)
  -f FILE_NAME, --file_name FILE_NAME
                        Set file name for leak data
  -t TARGET, --target TARGET
                        Set target IPv6 address
  -p TARGET_PORT, --target_port TARGET_PORT
                        Set target port, default=547
  -a ARCHITECTURE, --architecture ARCHITECTURE
                        Set architecture (i386, amd64 or arm), default=i386
  -v VERSION, --version VERSION
                        Set dnsmasq version (2.70, 2.71, 2.72, 2.73, 2.74,
                        2.75, 2.76, 2.77), default=2.77
  --interpreter INTERPRETER
                        Set path to interpreter on target, default="/bin/bash"
  --interpreter_arg INTERPRETER_ARG
                        Set interpreter argument, default="-c"
  --payload PAYLOAD     Set payload (bind_awk, reverse_awk, reverse_bash,
                        reverse_php, reverse_nc, reverse_nce),
                        default=reverse_nc
  --command COMMAND     Set command for executing on target
  --bind_port BIND_PORT
                        Set bind port, default=4444
  --reverse_port REVERSE_PORT
                        Set reverse port, default=4444
  --reverse_host REVERSE_HOST
                        Set reverse host

Demo video exploit for CVE-2017-14493:

Demo video exploit for CVE-2017-14494:

Miscellaneous scripts

Script: network_security_check.py

root@kali:~/raw-packet# python3 Scripts/Others/network_security_check.py -h
usage: network_security_check.py [-h] [-s SEND_INTERFACE]
                                 [-l LISTEN_INTERFACE]
                                 [-n TEST_HOST_INTERFACE] [-t TEST_HOST]
                                 [-m TEST_MAC] [-o TEST_OS] [-u TEST_SSH_USER]
                                 [-p TEST_SSH_PASS] [-k TEST_SSH_PKEY]
                                 [-G GATEWAY_IP] [-g GATEWAY_MAC]
                                 [-r NUMBER_OF_PACKETS]

Checking network security mechanisms

optional arguments:
  -h, --help            show this help message and exit
  -s SEND_INTERFACE, --send_interface SEND_INTERFACE
                        Set interface name for send packets
  -l LISTEN_INTERFACE, --listen_interface LISTEN_INTERFACE
                        Set interface name for listen packets
  -n TEST_HOST_INTERFACE, --test_host_interface TEST_HOST_INTERFACE
                        Set test host network interface for listen packets
  -t TEST_HOST, --test_host TEST_HOST
                        Set test host IP address for ssh connection
  -m TEST_MAC, --test_mac TEST_MAC
                        Set test host MAC address for ssh connection
  -o TEST_OS, --test_os TEST_OS
                        Set test host OS (MacOS, Linux, Windows)
  -u TEST_SSH_USER, --test_ssh_user TEST_SSH_USER
                        Set test host user name for ssh connection
  -p TEST_SSH_PASS, --test_ssh_pass TEST_SSH_PASS
                        Set test host password for ssh connection
  -k TEST_SSH_PKEY, --test_ssh_pkey TEST_SSH_PKEY
                        Set test host private key for ssh connection
  -G GATEWAY_IP, --gateway_ip GATEWAY_IP
                        Set gateway IP address
  -g GATEWAY_MAC, --gateway_mac GATEWAY_MAC
                        Set gateway MAC address
  -r NUMBER_OF_PACKETS, --number_of_packets NUMBER_OF_PACKETS
                        Set number of network packets for each test

Sample script output on Kali:

Sample script output on Windows:

Traffic sample generated by this script:

Pcap file: network_security_check.pcapng

Script: network_conflict_creator.py

Script for creating network conflicts for various testing.

root@kali:~/raw-packet# python3 Scripts/Others/network_conflict_creator.py --help
usage: network_conflict_creator.py [-h] [-i INTERFACE] [-t TARGET_IP]
                                   [-m TARGET_MAC] [--replies] [--requests]
                                   [--broadcast] [-p PACKETS] [-q] [-e]

Network conflict creator script

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Set interface name for listen and send packets
  -t TARGET_IP, --target_ip TARGET_IP
                        Set target IP address
  -m TARGET_MAC, --target_mac TARGET_MAC
                        Set target MAC address
  --replies             Send only ARP replies
  --requests            Send only ARP requests
  --broadcast           Send broadcast ARP requests
  -p PACKETS, --packets PACKETS
                        Number of ARP packets (default: 10)
  -q, --quiet           Minimal output
  -e, --exit            Exit on success

Name		Name	Last commit message	Last commit date
Latest commit History 922 Commits
Scripts		Scripts
raw_packet		raw_packet
.gitattributes		.gitattributes
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
requirements.txt		requirements.txt

License

4ekin/raw-packet

Folders and files

Latest commit

History

Repository files navigation

Raw-packet project

Important information:

Важная информация:

Info

Install

Debian based OS install with apt (recommended):

Debian based OS install with pip:

MacOS install:

1. Install Homebrew:

2. Install/upgrade wireshark and python3:

3. Reboot

4. Install Raw-packet:

Windows install:

1. Install Wireshark

2. Install Python 3.8

3. Reboot

4. Download and unpack Raw-packet

5. Install requirements

Publications

Scapy vs. Raw-packet

Scripts

WiFi

Script: attack_tool.py

Cross-platform WiFi attack tool

Sample script output:

Video demo:

Apple attacks

Script: apple_mitm.py

Sample script output:

Script: apple_arp_dos.py

Sample script output:

Traffic sample generated by this script:

Script: apple_rogue_dhcp.py

Sample script output:

ARP

Script: arp_scan.py

Sample script output:

Traffic sample generated by this script:

Script: arp_spoof.py

Sample script output:

Traffic sample generated by this script:

Video demo:

DHCP

Script: dhcp_starvation.py

Sample script output:

Traffic sample generated by this script:

Demo video:

Script: dhcp_rogue_server.py

Sample script output:

Result:

Demo video:

DHCPv6

Script: dhcpv6_rogue_server.py

Sample script output:

Result:

Demo video:

ICMPv4

Script: icmpv4_redirect.py

Sample script output:

Traffic sample generated by this script:

ICMPv6

Script: icmpv6_scan.py

Sample script output:

Traffic sample generated by this script:

Script: icmpv6_spoof.py

Router Advertisement spoofing

Sample script output:

Traffic sample generated by this script:

Neighbor Advertisement spoofing

Sample script output:

Traffic sample generated by this script:

DNS

Script: dns_server.py

Sample script configuration: