Scapy

Roadmap

• Review of python fundamentals
• Opening a capture file
• Browsing through the packets
• Modifying the packets
• Writing our changes
• Behind the scenes
• What comes next...

Review of python fundamentals

Everything is an object...

• Object oriented programming
• Syntax my_object.my_function(my_arguments)
• Usage of OOP paradigm for entity definition

Importing modules

• Using the dir() function to locate functions
• The __doc__ property
• Adding our directory to the sys.path

Classes and instances

• A simple def class(object)
• A simple def function(self)

Beware of the references

• What to look for when things go south
• Copy.deepcopy() and other goodies
• Is this over already?

Now this just doesn't seem right...

• Your best friend: the Pdb module
• Setting a breakpoint
• Traversing the code
• Printing variables

Opening a capture

The terminal

• Autocompletion
• Including our own modules
• Using it like python
• Watch for the hidden exception

The basics

• rdpcap("name_of_my_capture.pcap")
• Be sure to pass a pcap/cap file.
• The result can be viewed as a set of packets:

The basics II

• It can also be shown as a list with the show() method:>>> mycapture.show() 0000 Ether / IP / TCP 192.168.1.104:47096 > 192.168.1.102:8080 S 0001 Ether / IP / TCP 192.168.1.102:8080 > 192.168.1.104:47096 SA 0002 Ether / IP / TCP 192.168.1.104:47096 > 192.168.1.102:8080 A 0003 Ether / IP / TCP 192.168.1.104:47096 > 192.168.1.102:8080 PA / HTTP / Raw

The structure of a capture

• The capture: appending and slicing
• The packet: creating packets from raw bytes vs creating a base packet and populating
• The field: types of fields
• The field: "what if I want to add a new field?"
• The value: The three representations of values

Browsing through the capture

When things get boring, automate!

• Looping through
• Finding a specific something in the something that matches the something
• Layers: stacking and using constructors
• Example - Merging captures: appending and checking timestamps, sequence numbers and ack's

Modifying packets

I can do that, hold my beer!

• Changing the value of the tcp timestamp
• Regenerating the checksum on tcp
• Regenerating the checksum on IP

Writing our changes

Creating our first capture

• Saving with wrpcap()
• Checking how are we doing on wireshark
• A glimpse on how the sinergy between scapy and tshark works

Behind the scenes

Capture dissection

• The packet class
• The dissect() method
• The guess_payload_class() method
• The field class
• The getfield() method
• The addfield() method
• THe i2m() method

What comes next

End of the trial version...

• Creating a new protocol
• Sniffing traffic
• Injecting traffic
• Creating a traffic generator