Analisando pcap com Scapy
Depois de ficar de saco cheio de abrir o wireshark ou ettercap para ver .pcaps, eu lembrei que o scapy faz o mesmo, porem de forma muito mais leve. Para quem nao conhece scapy, é um canivete suiço de tcp/ip em forma de modulo python. Possui uma quantidade imensa de features(como sniffer, flooder, analise de pacotes…) e ainda é extensível. Na minha opinião é a ferramente principal de análise e interação de redes. É muito facil usá-lo para analisar pcap. Nos exemplos a seguir, usarei o pcap de um sniff em uma vm windows xp sp3 depois de infectada por um malware.
$ python
Python 2.7 (r27:82500, Sep 16 2010, 18:03:06) [GCC 4.5.1 20100907 (Red Hat 4.5.1-3)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> from scapy.all import * >>> b=rdpcap('./traffic1.pcap') # carregar o arquivo na variavel b >>> b <traffic1.pcap: TCP:9 UDP:0 ICMP:0 Other:0> # 9 frames TCP >>> b.nsummary() # mostra uma visao geral dos frames 0000 Ether / IP / TCP 192.168.0.2:mtqp > 89.209.91.49:http S 0001 Ether / IP / TCP 89.209.91.49:http > 192.168.0.2:mtqp SA 0002 Ether / IP / TCP 192.168.0.2:mtqp > 89.209.91.49:http A / Padding 0003 Ether / IP / TCP 192.168.0.2:mtqp > 89.209.91.49:http PA / Raw 0004 Ether / IP / TCP 89.209.91.49:http > 192.168.0.2:mtqp PA / Raw 0005 Ether / IP / TCP 89.209.91.49:http > 192.168.0.2:mtqp FA / Padding 0006 Ether / IP / TCP 192.168.0.2:mtqp > 89.209.91.49:http A / Padding 0007 Ether / IP / TCP 192.168.0.2:mtqp > 89.209.91.49:http FA / Padding 0008 Ether / IP / TCP 89.209.91.49:http > 192.168.0.2:mtqp A / Padding # para analisar qualquer frame é só definir na variável >>> b[4] <Ether dst=52:54:00:12:34:56 src=92:27:fc:57:72:bb type=0x800 |<IP version=4L ihl=5L tos=0x0 len=444 id=35057 flags=DF frag=0L ttl=103 proto=tcp chksum=0x139e src=89.209.91.49 dst=192.168.0.2 options='' |<TCP sport=http dport=mtqp seq=2622890338L ack=3064987870L dataofs=5L reserved=0L flags=PA window=64702 chksum=0xe61e urgptr=0 options=[] |<Raw load='HTTP/1.1 404 Not Found\r\nDate: Thu, 08 Nov 2007 06:09:09 GMT\r\nServer: Apache/2.2.15 (Win32) PHP/5.2.13\r\nContent-Length: 214\r\nConnection: close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p>The requested URL /e/websitechk.php was not found on this server.</p>\n</body></html>\n' |>>>> # para uma análise melhor, usar o método show() >>> b[4].show() ###[ Ethernet ]### dst= 52:54:00:12:34:56 src= 92:27:fc:57:72:bb type= 0x800 ###[ IP ]### version= 4L ihl= 5L tos= 0x0 len= 444 id= 35057 flags= DF frag= 0L ttl= 103 proto= tcp chksum= 0x139e src= 89.209.91.49 dst= 192.168.0.2 options= '' ###[ TCP ]### sport= http dport= mtqp seq= 2622890338L ack= 3064987870L dataofs= 5L reserved= 0L flags= PA window= 64702 chksum= 0xe61e urgptr= 0 options= [] ###[ Raw ]### load= 'HTTP/1.1 404 Not Found\r\nDate: Thu, 08 Nov 2007 06:09:09 GMT\r\nServer: Apache/2.2.15 (Win32) PHP/5.2.13\r\nContent-Length: 214\r\nConnection: close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p>The requested URL /e/websitechk.php was not found on this server.</p>\n</body></html>\n' # para exibir todo o conteudo, equivalente ao 'follow tcp stream' no wireshark: >>> print '\n'.join([('%s -> %s\n%s'%(b[i].payload.src,b[i].payload.dst,b[i].load)) for i in range(len(b)) if hasattr(b[i], 'load')]) 192.168.0.2 -> 89.209.91.49 POST http://89.209.91.49/e/websitechk.php HTTP/1.1 Host: 89.209.91.49 Connection: close Content-Type: multipart/form-data; boundary=55377776816118 Content-Length: 659 ...
Enfim, é isso. O Scapy é uma ferramenta excelente e merece ser bem explorada.