Introduction
Scapy
Network discovery and attacks
Packet generation and network based attacks with
Scapy
Philippe BIONDI
phil@secdev.org / philippe.biondi@eads.net
Corporate Research Center
SSI Department
Suresnes, FRANCE
CanSecWest/core05, May 4-6, 2005
Philippe BIONDI
Packet generation and network based attacks with Scapy
Introduction
Scapy
Network discovery and attacks
Outline
1
Introduction
Forewords
Learning Python in 2 slides
State of the art
Problematic
2 Scapy
Genesis
Concepts
Quick overview
3 Network discovery and attacks
One shots
Scanning
TTL tricks
4 Conclusion
Philippe BIONDI
Packet generation and network based attacks with Scapy
Introduction
Scapy
Network discovery and attacks
Forewords
Learning Python in 2 slides
State of the art
Problematic
Outline
1
Introduction
Forewords
Learning Python in 2 slides
State of the art
Problematic
2 Scapy
Genesis
Concepts
Quick overview
3 Network discovery and attacks
One shots
Scanning
TTL tricks
4 Conclusion
Philippe BIONDI
Packet generation and network based attacks with Scapy
Introduction
Scapy
Network discovery and attacks
Forewords
Learning Python in 2 slides
State of the art
Problematic
Aims of this presentation
Explain some problems present in network packet tools I tried
to overcome with Scapy
Let you discover Scapy
Give some network tricks and show you how easy it is to
perform them with Scapy
Philippe BIONDI
Packet generation and network based attacks with Scapy
Introduction
Scapy
Network discovery and attacks
Forewords
Learning Python in 2 slides
State of the art
Problematic
Outline
1
Introduction
Forewords
Learning Python in 2 slides
State of the art
Problematic
2 Scapy
Genesis
Concepts
Quick overview
3 Network discovery and attacks
One shots
Scanning
TTL tricks
4 Conclusion
Philippe BIONDI
Packet generation and network based attacks with Scapy
Introduction
Scapy
Network discovery and attacks
Forewords
Learning Python in 2 slides
State of the art
Problematic
Learning Python in 2 slides (1/2)
This is an int (signed, 32bits) : 42
This is a long (signed, infinite): 42L
This is a str : "bell\x07\n" or ’bell\x07\n’ (" ⇐⇒ ’)
This is a tuple (immutable): (1,4,"42")
This is a list (mutable): [4,2,"1"]
This is a dict (mutable): { "one":1 , "two":2 }
Philippe BIONDI
Packet generation and network based attacks with Scapy
Introduction
Scapy
Network discovery and attacks
Forewords
Learning Python in 2 slides
State of the art
Problematic
Learning Python in 2 slides (2/2)
No block delimiters. Indentation does matter.
if cond1:
instr
instr
elif cond2:
instr
else:
instr
while cond:
instr
instr
for var in set:
instr
lambda x,y: x+y
try:
instr
except exception:
else:
instr
instr
def fact(x):
if x == 0:
return 1
else:
return x*fact(x-1)
Philippe BIONDI
Packet generation and network based attacks with Scapy
Introduction
Scapy
Network discovery and attacks
Forewords
Learning Python in 2 slides
State of the art
Problematic
Outline
1
Introduction
Forewords
Learning Python in 2 slides
State of the art
Problematic
2 Scapy
Genesis
Concepts
Quick overview
3 Network discovery and attacks
One shots
Scanning
TTL tricks
4 Conclusion
Philippe BIONDI
Packet generation and network based attacks with Scapy