The Sniper

[sniper930-blog]

XML Parsing and Web Services

>>> from bs4 import BeautifulSoup

>>> xml = open(‘defcon.rss’, ‘r’).read()

. . .

>>> bs = BeautifulSoup(xml, “xml”)

>>> for item in bs.find_all(‘item’):

. . .         print item.title.string

. . .         print item.title.link

. . .

>>> for item in bs.find_all(‘itme’):

. . .         print item.title.string

. . .         print item.link.string

. . .

-----------------------------------------------------------------------------------------------------------

·        Web Services are an important part of web communication now

·        Zolera Soap Infrastructure

·        http://pywebsvcs.sourceforge.net/zsi.html

·        Attack on WebGoat

·        http://yehg.net/lab/pr0js/Training/webgoat.php#Web_Services

[sniper930-blog]

Stateful Web Application Browsing with Mechanize

>>> import mechanize

>>> br = mechanize.Browser()

>>> br.open(‘http://student.securitytube.net/login/index.php’)

<response_seek_wrapper at 0xb7042cccL whose wrapped object = <closeable_response at 0xb704220cL whose fp = <socket._fileobject object at 0xb703b7ec>>>

>>> for form in br.forms():

. . .         print form

. . .

<POST http://student.securitytube.net/login/index.php application/x-www-form-url encoded

<TextControl (username=)>

<PasswordControl(password=)>

<SubmitControl(<None>=Login) (readonly)>>

>>> br.select_form(nr=0)

>>> br.form[‘username’] = ‘demo-user’

>>> br.form[‘password’] = ‘demouser1]M’

>>> br.submit()

<response_seek_wrapper at 0xb7046d0L whose wrapped object = <closeable_response at 0xb7046d4cL whose fp = <socket._fileobject object at 0xb703b9ec>>>

>>> print br.response().read()

. . .

>>> for link in br.links():

. . .         print link.url + ‘ : ’ + link.text

. . .

#maincontent : Skip to main content

http://student.securitytube.net/ : Home

http://student.securitytube.net/user/profile.php?id=642 : demo user

http://student.securitytube.net/login/logout.php?sesskey=xr2qC1nyHW : Logout

http://student.securitytube.net : [IMG]

#skipmycourses : Skip my courses

http://student.securitytube.net/course/view.php?id=4 : SecurityTube Python Scripting Expert

http://student.securitytube.net/user/view.php?id=3&course=1 : Vivek Ramachandran

http://student.securitytube.net/user.view.php?id=241&course=1 : SecurityTube Admin

http://student.securitytube.net/course/view.php?id=3 : SecurityTube Metasploit Framework Expert

http://student.securitytube.net/user/view.php?id=3&course=1 : Vivek Ramachandran

http://student.securitytube.net/course/view.php?id=2 : SecurityTube Wi-Fi Security Expert (SWSE)

http://student.securitytube.net/user/view.php?id=3&course=1 : Vivek Ramachandran

#sb-2 : Skip Navigation

http://student.securitytube.net/ : Home

http://student.securitytube.net/my/ : moodle[IMG]My home

http://student.securitytube.net/tag/search.php : moodle[IMG]Tags

http://student.securitytube.net/calendar/view.php?view=month : moodle[IMG]Calendar

http://student.securitytube.net/user/profile.php?id=642 : moodle[IMG]View profile

http://student.securitytube.net/mod/forum/user.php?id=642 : moodle[IMG]Posts

http://student.securitytube.net/mod/forum/user.php?id=642&mode=discussions : moodle[IMG]Discussions

http://student.securitytube.net/message/index.php : moodl[IMG]Messages

http://student.securitytube.net/user/files.php : moodle[IMG]My private files

http://student.securitytube.net/course/view.php?id=4 : SPSE

http://student.securitytube.net/course/view.php?id=3 : SMFE

http://student.securitytube.net/course/view.php?id=2 : Wi-Fi Security Expert

#sb-3 : Skip Settings

http://student.securitytube.net/user/edi.php?id=642&course=1 : moodle[IMG]Edit profile

http://student.securitytube.net/login/change_password.php?id=1 : moodle[IMG]Change password

http://student.securitytube.net/message/edit.php?id=642&course=1 : moodle[IMG]Messaging

http://student.securitytube.net/user/profile.php?id=642 : demo user

http://student.securitytube.net/login/logout.php?sesskey=xr2qC1nyHW : Logout

>>> new_link = br.click_link(text=’moodle[IMG]Change password’)

>>> br.open(new_link)

<response_seek_wrapper at 0x9317c6c whose wrapped object = <closeable_response at 0x93250ec whose fp = <socket._fileobject object at 0xb6f52eec>>>

>>> print br.response().read()

. . .

>>> for form in br.forms():

. . .         print form

. . .

<POST http://student.securitytube.net/login/change_password.php application/x-www-form-urlencoded

<HiddenControl(id=1) (readonly)>

<HiddenControl(sesskey=xr2qC1nyHW) (readonly)>

<HiddenControl(_qf__login_change_password_form=1) (readonly)>

<PasswordControl(password=)>

<PasswordControl(newpassword1=)>

<PasswordControl(newpassword2=)>

<SubmitControl(submitbutton=Save changes) (readonly)>

<SubmitControl(cancel=Cancel) (readonly)>>

>>> br.open(‘https://gmail.com’)

<response_seek_wrapper at 0x931ad4c whose wrapped object = <closeable_response at 0x931d10c whose fp = <socket._fileobject object at 0x93274ec>>>

>>> print br.response().read()

. . .

>>> for form in br.forms():

. . .         print form

. . .

<POST https://accounts.google.com/ServiceLoginAuth application/x-www-form-urlencoded

<HiddenControl(continue=https://mail.google.com/mail/) (readonly)>

<HiddenControl(service=mail) (readonly)>

<HiddenControl(rm=false) (readonly)>

<HiddenControl(dsh=-9126804368613133049) (readonly)>

<HiddenControl(ltmpl=default) (readonly)>

<HiddenControl(scc=1) (readonly)>

<HiddenControl(ss=1) (readonly)>

<HiddenControl(GALX=b5FdMIdfirw) (readonly)>

<HiddenControl(timeStmp=) (readonly)>

<HiddenControl(secTok=) (readonly)>

<TextControl(Email=)>

<PasswordControl(Passwd=)>

<SubmitControl(signIn=Sign in) (readonly)>

<CheckboxControl(PersistentCookie=[yeas])>

<HiddenControl(rmShown=1) (readonly)>>

<GET https://accounts.google.com/ServicesLogin?service=mail&passive=true&rm=false&continue=https://mail.google.com/mail/&ss=1&scc=1&ltmpl=default&ltmplcache=2 application/x-www-form-urlencoded

<SelectControl(<None>=[])>

<SelectControl(<None>=[*ms])>

<SelectControl(<None>=[*ca])>

<SelectControl(<None>=[*cy])>

<SelectControl(<None>=[*da])>

<SelectControl(<None>=[*de])>

<SelectControl(<None>=[*en])>

<SelectControl(<None>=[*en-GB])>

<SelectControl(<None>=[*es])>

<SelectControl(<None>=[*eu])>

<SelectControl(<None>=[*fil])>

<SelectControl(<None>=[*fr])>

<SelectControl(<None>=[*hr])>

<SelectControl(<None>=[*in])>

<SelectControl(<None>=[*it])>

<SelectControl(<None>=[*sw])>

<SelectControl(<None>=[*lv])>

<SelectControl(<None>=[*lt])>

<SelectControl(<None>=[*nl])>

<SelectControl(<None>=[*no])>

<SelectControl(<None>=[*pt-BR])>

<SelectControl(<None>=[*pt-PT])>

<SelectControl(<None>=[*ro])>

<SelectControl(<None>=[*sk])>

<SelectControl(<None>=[*sl])>

<SelectControl(<None>=[*sv])>

<SelectControl(<None>=[*tl])>

<SelectControl(<None>=[*vi])>

<SelectControl(<None>=[*tr])>

<SelectControl(<None>=[*et])>

<SelectControl(<None>=[*hu])>

<SelectControl(<None>=[*pl])>

<SelectControl(<None>=[*fi])>

<SelectControl(<None>=[*is])>

<SelectControl(<None>=[*cs])>

<SelectControl(<None>=[*el])>

<SelectControl(<None>=[*ru])>

<SelectControl(<None>=[*uk])>

<SelectControl(<None>=[*bg])>

<SelectControl(<None>=[*sr])>

<SelectControl(<None>=[*iw])>

<SelectControl(<None>=[*ur])>

<SelectControl(<None>=[*ar])>

<SelectControl(<None>=[*fa])>

<SelectControl(<None>=[*mr])>

<SelectControl(<None>=[*hi])>

<SelectControl(<None>=[*bn])>

<SelectControl(<None>=[*gu])>

<SelectControl(<None>=[*ta])>

<SelectControl(<None>=[*te])>

<SelectControl(<None>=[*kn])>

<SelectControl(<None>=[*ml])>

<SelectControl(<None>=[*th])>

<SelectControl(<None>=[*am])>

<SelectControl(<None>=[*zh-TW])>

<SelectControl(<None>=[*zh-CN])>

<SelectControl(<None>=[*ja])>

<SelectControl(<None>=[*ko])>>

-----------------------------------------------------------------------------------------------------------

·        Explore the concept of mechanize.CookieJar

·        Why is it userful?

·        Sample code to illustrate its functionality

·        Explore http://seleniumhq.org/support/

·        Can you automate the current example in it?

[sniper930-blog]

Form Parsing and Submission with Mechanize

>>> import mechanize

>>> br = mechanize.Browser()

>>> br.open(‘http://www.securitytube.net/video/3000’)

<response_seek_wrapper at 0xb708922cL whose wrapped object = <closeable_response at 0xb708188cL whose fp = <socket._fileobject object at 0xb6ef6fac>>>

>>> for form in br.forms():

. . .         print form

. . .

<GET http://www.securitytube.net/search application/x-www-form-urlencoded

<TextControl(q=)>

<SubmitButtonControl(<None>=) (readonly)>>

>>> br.select_form(nr=0)

>>> br.form[‘q’] = ‘defcon’

>>> br.submit()

<response_seek_wrapper at 0xb70e496cL whose wrapped object = <closeable_response at 0xb7081eacL whose fp = <socket._fileobject object at 0xb7062dec>>>

>>> for link in br.links()

. . .         print link

. . .

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/Login?mode=login', text='Login with Google', tag='a', attrs=[('href', '/Login?mode=login'), ('class', 'user')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/', text='Home', tag='a', attrs=[('href', '/')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Videos', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/groups?operation=viewall&groupId=0', text='Video Groups', tag='a', attrs=[('href', '/groups?operation=viewall&groupId=0')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/listing?type=latest', text='Latest Videos', tag='a', attrs=[('href', '/listing?type=latest')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/listing?type=popular', text='Popular Videos', tag='a', attrs=[('href', '/listing?type=popular')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Megaprimers', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/groups?operation=view&groupId=10', text='Metasploit Framework Expert', tag='a', attrs=[('href', '/groups?operation=view&groupId=10')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/groups?operation=view&groupId=9', text='Wi-Fi Security Expert', tag='a', attrs=[('href', '/groups?operation=view&groupId=9')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/groups?operation=view&groupId=7', text='Exploit Research Megaprimer', tag='a', attrs=[('href', '/groups?operation=view&groupId=7')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/groups?operation=view&groupId=6', text='Windows Assembly Language', tag='a', attrs=[('href', '/groups?operation=view&groupId=6')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/groups?operation=view&groupId=5', text='Linux Assembly Megaprimer', tag='a', attrs=[('href', '/groups?operation=view&groupId=5')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/groups?operation=view&groupId=4', text='Buffer Overflow Megaprimer', tag='a', attrs=[('href', '/groups?operation=view&groupId=4')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/groups?operation=view&groupId=3', text='Format String Exploitation', tag='a', attrs=[('href', '/groups?operation=view&groupId=3')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/groups?operation=view&groupId=2', text='Scenario based Pentesting', tag='a', attrs=[('href', '/groups?operation=view&groupId=2')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/groups?operation=view&groupId=1', text='Router Pentesting', tag='a', attrs=[('href', '/groups?operation=view&groupId=1')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='HackerCon Videos', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Athcon', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/ath-11', text='2011', tag='a', attrs=[('href', '/tags/ath-11')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/ath-10', text='2010', tag='a', attrs=[('href', '/tags/ath-10')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Blackhat', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/blackhat-2012', text='EU 2012', tag='a', attrs=[('href', '/tags/blackhat-2012')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Confidence', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/Confidence-2011', text='2011', tag='a', attrs=[('href', '/tags/Confidence-2011')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/Confidence-2010', text='2010', tag='a', attrs=[('href', '/tags/Confidence-2010')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Clubhack', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/clubhack', text='2011', tag='a', attrs=[('href', '/tags/clubhack')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Defcon', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/dc-19', text='DC 19', tag='a', attrs=[('href', '/tags/dc-19')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/dc-18', text='DC 18', tag='a', attrs=[('href', '/tags/dc-18')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/dc-17', text='DC 17', tag='a', attrs=[('href', '/tags/dc-17')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/dc-16', text='DC 16', tag='a', attrs=[('href', '/tags/dc-16')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/dc-15', text='DC 15', tag='a', attrs=[('href', '/tags/dc-15')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='HITB', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/hackinthebox-2011', text='2011', tag='a', attrs=[('href', '/tags/hackinthebox-2011')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Hack3rcon', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/hackercon-2011', text='2011', tag='a', attrs=[('href', '/tags/hackercon-2011')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Notacon', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/notacon-8', text='Notacon 8', tag='a', attrs=[('href', '/tags/notacon-8')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/notacon-7', text='Notacon 7', tag='a', attrs=[('href', '/tags/notacon-7')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/notacon-6', text='Notacon 6', tag='a', attrs=[('href', '/tags/notacon-6')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Nullcon', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/nullcon', text='2011', tag='a', attrs=[('href', '/tags/nullcon')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Shmoocon', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/shmoocon-2012', text='2012', tag='a', attrs=[('href', '/tags/shmoocon-2012')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/shmoocon-2011', text='2011', tag='a', attrs=[('href', '/tags/shmoocon-2011')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='SkyDogCon', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/skydogcon-2011', text='2011', tag='a', attrs=[('href', '/tags/skydogcon-2011')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Swiss Cyber Storm', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/swisscyberstorm-2011', text='2011', tag='a', attrs=[('href', '/tags/swisscyberstorm-2011')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Newsletter', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='2012', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='August', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://us4.campaign-archive2.com/?u=950872c698a3cf5cfcf752971&id=c1a650ce0f', text='Week 4', tag='a', attrs=[('href', 'http://us4.campaign-archive2.com/?u=950872c698a3cf5cfcf752971&id=c1a650ce0f'), ('target', '_blank')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='September', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://us4.campaign-archive2.com/?u=950872c698a3cf5cfcf752971&id=d7a088440a', text='Week 1', tag='a', attrs=[('href', 'http://us4.campaign-archive2.com/?u=950872c698a3cf5cfcf752971&id=d7a088440a'), ('target', '_blank')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://us4.campaign-archive2.com/?u=950872c698a3cf5cfcf752971&id=067c16179e', text='Week 2', tag='a', attrs=[('href', 'http://us4.campaign-archive2.com/?u=950872c698a3cf5cfcf752971&id=067c16179e'), ('target', '_blank')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://securitytube-training.com/?id=cert-link', text='Certifications', tag='a', attrs=[('href', 'http://securitytube-training.com/?id=cert-link'), ('target', 'blank')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://securitytube-training.com/certifications/securitytube-python-scripting-expert/', text='Python Scripting Expert', tag='a', attrs=[('target', '_blank'), ('href', 'http://securitytube-training.com/certifications/securitytube-python-scripting-expert/')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/', text='Linux Assembly Expert', tag='a', attrs=[('target', '_blank'), ('href', 'http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://securitytube-training.com/online-courses/securitytube-ios-security-expert/', text='iOS Security Expert', tag='a', attrs=[('target', '_blank'), ('href', 'http://securitytube-training.com/online-courses/securitytube-ios-security-expert/')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://securitytube-training.com/certifications/securitytube-metasploit-framework-expert/', text='Metasploit Framework Expert', tag='a', attrs=[('target', '_blank'), ('href', 'http://securitytube-training.com/certifications/securitytube-metasploit-framework-expert/')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://securitytube-training.com/certifications/securitytube-wi-fi-security-expert/', text='Wi-Fi Security Expert', tag='a', attrs=[('target', '_blank'), ('href', 'http://securitytube-training.com/certifications/securitytube-wi-fi-security-expert/')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://securitytube-training.com/testimonials/', text='Student Testimonials', tag='a', attrs=[('target', '_blank'), ('href', 'http://securitytube-training.com/testimonials/')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://forums.securitytube.net', text='Discussion Forums', tag='a', attrs=[('href', 'http://forums.securitytube.net')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://securitytube-tools.net', text='Tools', tag='a', attrs=[('href', 'http://securitytube-tools.net'), ('target', '_blank')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/listing?type=latest', text='Latest Videos', tag='a', attrs=[('href', '/listing?type=latest')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/listing?type=popular', text='Popular Videos', tag='a', attrs=[('href', '/listing?type=popular')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/groups?operation=viewall&groupId=0', text='Video Groups', tag='a', attrs=[('href', '/groups?operation=viewall&groupId=0')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://www.twitter.com/securitytube', text='[IMG]', tag='a', attrs=[('href', 'http://www.twitter.com/securitytube')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://www.facebook.com/pages/SecurityTube/157183860350', text='[IMG]', tag='a', attrs=[('href', 'http://www.facebook.com/pages/SecurityTube/157183860350')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://feeds2.feedburner.com/SecurityTube', text='[IMG]', tag='a', attrs=[('href', 'http://feeds2.feedburner.com/SecurityTube')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://www.facebook.com/plugins/likebox.php?href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FSecurityTube%2F157183860350&width=188&height=258&colorscheme=light&show_faces=true&border_color&stream=false&header=false&appId=246564115443745', text=None, tag='iframe', attrs=[('src', 'http://www.facebook.com/plugins/likebox.php?href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FSecurityTube%2F157183860350&width=188&height=258&colorscheme=light&show_faces=true&border_color&stream=false&header=false&appId=246564115443745'), ('scrolling', 'no'), ('frameborder', '0'), ('style', 'border:none; overflow:hidden; width:188px; height:258px;'), ('allowtransparency', 'true')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/', text='Home', tag='a', attrs=[('href', '/')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/listing?type=latest', text='Videos', tag='a', attrs=[('href', '/listing?type=latest')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='#', text='Defcon 19 - The Art Of Trolling', tag='a', attrs=[('href', '#')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://www.youtube.com/embed/3wAGdAOvu3I', text=None, tag='iframe', attrs=[('title', 'YouTube video player'), ('width', '640'), ('height', '390'), ('src', 'http://www.youtube.com/embed/3wAGdAOvu3I'), ('width', '640'), ('height', '390'), ('frameborder', '0'), ('allowfullscreen', 'allowfullscreen')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='https://twitter.com/share', text='Tweet', tag='a', attrs=[('href', 'https://twitter.com/share'), ('class', 'twitter-share-button'), ('data-via', 'securitytube'), ('data-lang', 'en')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='https://www.defcon.org/images/defcon-19/dc-19-presentations/Joyce/DEFCON-19-Joyce-trollspotting.png', text='https://www.defcon.org/images/defcon-19/dc-19-presentations/Joyce/DEFCON-19-Joyce-trollspotting.png', tag='a', attrs=[('href', 'https://www.defcon.org/images/defcon-19/dc-19-presentations/Joyce/DEFCON-19-Joyce-trollspotting.png'), ('rel', 'nofollow')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/securitytube', text='securitytube', tag='a', attrs=[('href', '/tags/securitytube')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/defcon', text='defcon', tag='a', attrs=[('href', '/tags/defcon')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/def%20con', text='def con', tag='a', attrs=[('href', '/tags/def con')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/hacking', text='hacking', tag='a', attrs=[('href', '/tags/hacking')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/hackers', text='hackers', tag='a', attrs=[('href', '/tags/hackers')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/information%20security', text='information security', tag='a', attrs=[('href', '/tags/information security')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/convention', text='convention', tag='a', attrs=[('href', '/tags/convention')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/computer%20security', text='computer security', tag='a', attrs=[('href', '/tags/computer security')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/DC%2019', text='DC 19', tag='a', attrs=[('href', '/tags/DC 19')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/Defcon%2019', text='Defcon 19', tag='a', attrs=[('href', '/tags/Defcon 19')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/tags/dc-19', text='dc-19', tag='a', attrs=[('href', '/tags/dc-19')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/Login?mode=login', text='Login to post a comment', tag='a', attrs=[('href', '/Login?mode=login')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/user/Securitytube_Poster', text='[IMG]', tag='a', attrs=[('href', '/user/Securitytube_Poster')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/user/Securitytube_Poster', text='Securitytube_Poster', tag='a', attrs=[('href', '/user/Securitytube_Poster')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/10095', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/10095')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/10095', text='Defeating Getimagesize() Checks In File Uploads', tag='a', attrs=[('href', '/video/10095')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8395', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/8395')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8395', text='Challenge 6: Digest Authentication Reloaded', tag='a', attrs=[('href', '/video/8395')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8394', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/8394')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8394', text='Challenge 5: Digest Authentication Attack', tag='a', attrs=[('href', '/video/8394')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8356', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/8356')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8356', text='Basic Authentication And Form Bruteforcing', tag='a', attrs=[('href', '/video/8356')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8355', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/8355')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8355', text='Http Basic Authentication Attack (Easy)', tag='a', attrs=[('href', '/video/8355')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8329', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/8329')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8329', text='Challenge 2: Http Form Attacks Reloaded', tag='a', attrs=[('href', '/video/8329')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8307', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/8307')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8307', text='Http Verb Tampering Demo', tag='a', attrs=[('href', '/video/8307')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8274', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/8274')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8274', text='Web Application Pentesting Course Introduction', tag='a', attrs=[('href', '/video/8274')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8267', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/8267')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/8267', text='Introducing Pentester Academy', tag='a', attrs=[('href', '/video/8267')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/7881', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/7881')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/7881', text='Hack Of The Day 13: Remote Shellcode Launcher: Testing Shellcode Over A Network', tag='a', attrs=[('href', '/video/7881')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/7875', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/7875')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/7875', text='Hack Of The Day 12: Pivots And Port Forwards In Scenario Based Pentesting', tag='a', attrs=[('href', '/video/7875')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6997', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/6997')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6997', text='Hack Of The Day: Customizing Shellcode For Fun And Profit', tag='a', attrs=[('href', '/video/6997')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6996', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/6996')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6996', text='Hack Of The Day: How Do I Run Untrusted Shellcode?', tag='a', attrs=[('href', '/video/6996')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6984', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/6984')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6984', text='Securitytube Linux Assembly Expert Exam Format', tag='a', attrs=[('href', '/video/6984')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6983', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/6983')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6983', text='[Slae] Writing An Custom Insertion Encoder', tag='a', attrs=[('href', '/video/6983')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6982', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/6982')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6982', text='[Slae] Execve Shellcode Stack Method', tag='a', attrs=[('href', '/video/6982')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6981', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/6981')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6981', text='[Slae] Shellcoding Basics', tag='a', attrs=[('href', '/video/6981')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6980', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/6980')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6980', text='[Slae] Using Libc And Nasm', tag='a', attrs=[('href', '/video/6980')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6979', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/6979')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6979', text='[Slae] Hello World In Assembly Language', tag='a', attrs=[('href', '/video/6979')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6977', text='video, security, hack, hacking[IMG]', tag='a', attrs=[('href', '/video/6977')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='/video/6977', text='[Slae] What Is Assembly Language?', tag='a', attrs=[('href', '/video/6977')])

Link(base_url='http://www.securitytube.net/video/3000?q=defcon', url='http://www.statcounter.com/free_hit_counter.html', text='hit counter html code[IMG]', tag='a', attrs=[('href', 'http://www.statcounter.com/free_hit_counter.html'), ('target', '_blank')])

>>> for link in br.links()

. . .         print link.url + ‘ : ’ + link.text

. . .

/Login?mode=login : Login with Google

/ : Home

# : Videos

/groups?operation=viewall&groupId=0 : Video Groups

/listing?type=latest : Latest Videos

/listing?type=popular : Popular Videos

# : Megaprimers

/groups?operation=view&groupId=10 : Metasploit Framework Expert

/groups?operation=view&groupId=9 : Wi-Fi Security Expert

/groups?operation=view&groupId=7 : Exploit Research Megaprimer

/groups?operation=view&groupId=6 : Windows Assembly Language

/groups?operation=view&groupId=5 : Linux Assembly Megaprimer

/groups?operation=view&groupId=4 : Buffer Overflow Megaprimer

/groups?operation=view&groupId=3 : Format String Exploitation

/groups?operation=view&groupId=2 : Scenario based Pentesting

/groups?operation=view&groupId=1 : Router Pentesting

# : HackerCon Videos

# : Athcon

/tags/ath-11 : 2011

/tags/ath-10 : 2010

# : Blackhat

/tags/blackhat-2012 : EU 2012

# : Confidence

/tags/Confidence-2011 : 2011

/tags/Confidence-2010 : 2010

# : Clubhack

/tags/clubhack : 2011

# : Defcon

/tags/dc-19 : DC 19

/tags/dc-18 : DC 18

/tags/dc-17 : DC 17

/tags/dc-16 : DC 16

/tags/dc-15 : DC 15

# : HITB

/tags/hackinthebox-2011 : 2011

# : Hack3rcon

/tags/hackercon-2011 : 2011

# : Notacon

/tags/notacon-8 : Notacon 8

/tags/notacon-7 : Notacon 7

/tags/notacon-6 : Notacon 6

# : Nullcon

/tags/nullcon : 2011

# : Shmoocon

/tags/shmoocon-2012 : 2012

/tags/shmoocon-2011 : 2011

# : SkyDogCon

/tags/skydogcon-2011 : 2011

# : Swiss Cyber Storm

/tags/swisscyberstorm-2011 : 2011

# : Newsletter

# : 2012

# : August

http://us4.campaign-archive2.com/?u=950872c698a3cf5cfcf752971&id=c1a650ce0f : Week 4

# : September

http://us4.campaign-archive2.com/?u=950872c698a3cf5cfcf752971&id=d7a088440a : Week 1

http://us4.campaign-archive2.com/?u=950872c698a3cf5cfcf752971&id=067c16179e : Week 2

http://securitytube-training.com/?id=cert-link : Certifications

http://securitytube-training.com/certifications/securitytube-python-scripting-expert/ : Python Scripting Expert

http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ : Linux Assembly Expert

http://securitytube-training.com/online-courses/securitytube-ios-security-expert/ : iOS Security Expert

http://securitytube-training.com/certifications/securitytube-metasploit-framework-expert/ : Metasploit Framework Expert

http://securitytube-training.com/certifications/securitytube-wi-fi-security-expert/ : Wi-Fi Security Expert

http://securitytube-training.com/testimonials/ : Student Testimonials

http://forums.securitytube.net : Discussion Forums

http://securitytube-tools.net : Tools

/listing?type=latest : Latest Videos

/listing?type=popular : Popular Videos

/groups?operation=viewall&groupId=0 : Video Groups

http://www.twitter.com/securitytube : [IMG]

http://www.facebook.com/pages/SecurityTube/157183860350 : [IMG]

http://feeds2.feedburner.com/SecurityTube : [IMG]

>>> br.form[‘q’] = ‘defcon’

-----------------------------------------------------------------------------------------------------------

·        In the example shown we did not try and modify the hidden fields. Try to see how you can do it and send arbitrary data

·        Install a vulnerable web application such as DVWA, OWASP Web Goat or other

·        Use mechanize to try SQL Injection on form fields and deduce which fields are vulnerable to SQL Injection

[sniper930-blog]

Coding a Screen Scraper

>>> import urllib

>>> from bs4 import BeautifulSoup

>>> httpResponse = urllib.urlopen(‘http://securitytube.net/video/3000’)

>>> httpResponse.code

200

>>> html = httpResponse.read()

>>> html

. . .

>>> bs = BeautifulSoup(html, “lxml”)

>>> descr = bs.find(‘div’, id=‘description’)

>>> descr

. . .

>>> allLinks = descr.find_all(‘a’)

>>> allLinks

>>> descr.get_Text()

>>> videoLink = bs.find(‘iframe’, { ‘title’ : ‘YouTube video player’ })

>>> videoLink

. . .

>>> videoLink[‘src’]

. . .

>>> forms = bs.find_all(‘form’)

>>> forms

. . .

>>>

[sniper930-blog]

Parsing HTML

>>> from bs4 import BeautifulSoup

>>> import urllib

>>> html = urllib.urlopen(‘http://www.securitytube.net/video/3000’)

>>> html

<addinfourl at 151733228 whose fp = <socket._fileobject object at 0xb7383eac>>

>>>  html.code

200

>>> bt = BeautifulSoup(html.read(), “lxml”)

>>> bt

. . .

>>> bt.title

<title>Defcon 19  – The Art Of Trolling</title>

>>> bt.title.string

u‘Defcon 19  – The Art Of Trolling’

>>> bt.title.name

‘title’

>>> bt.meta

<meta content=“6xTaa3p8o4OQd0L-iD2eRvaDjJR8rxUdSyZ1Etm5LMI” name=“google-site-verification”/>

>>> bt.meta.next

<meta content=“text/html;charset=utf-8” http-equiv=“Content-Type”/>

>>> bt.meta.next.next

<title>Defcon 19  – The Art Of Trolling</title>

>>> allMetaTags = bt.find_all(‘meta’)

>>> allMetaTags

[<meta content="6xTaa3p8o4OQd0L-iD2eRvaDjJR8rxUdSyZ1Etm5LMI" name="google-site-verification"/>, <meta content="text/html;charset=utf-8" http-equiv="Content-Type"/>, <meta content=" " name="keywords"/>, <meta content=" " name="description"/>, <meta content="no" name="apple-mobile-web-app-capable"/>, <meta content="black" name="apple-mobile-web-app-status-bar-style"/>, <meta content="width=device-width,initial-scale=0.69,user-scalable=yes,maximum-scale=1.00" name="viewport"/>]

>>> allMetaTags[0]

<meta content="6xTaa3p8o4OQd0L-iD2eRvaDjJR8rxUdSyZ1Etm5LMI" name="google-site-verification"/>

>>> allMetaTags[1]

<meta content=“text/html;charset=utf-8” http-equiv=“Content-Type”/>

>>> allMetaTags[1][‘content’]

u‘text/html;charset=utf-8’

>>> allMetaTags[1][‘http-equiv’]

‘Content-Type’

>>> allLinks = bt.find_all(‘a’)

>>> len(allLinks)

133

>>> allLinks[0]

<a class=“user” href=“/Login?mode=login”><span class=“bar”>Login with Google</span></a>

>>> allLinks[1]

<a href=“/”>Home</a>

>>> allLinks[0].string

u‘Login with Google’

>>> allLinks[0][‘href’]

‘/Login?mode=login’

>>> for link in allLinks:

. . .         print link[‘href’]

. . .

/Login?mode=login

/

#

/groups?operation=viewall&groupId=0

/listing?type=latest

/listing?type=popular

#

/groups?operation=view&groupId=10

/groups?operation=view&groupId=9

/groups?operation=view&groupId=7

/groups?operation=view&groupId=6

/groups?operation=view&groupId=5

/groups?operation=view&groupId=4

/groups?operation=view&groupId=3

/groups?operation=view&groupId=2

/groups?operation=view&groupId=1

#

#

/tags/ath-11

/tags/ath-10

#

/tags/blackhat-2012

#

/tags/Confidence-2011

/tags/Confidence-2010

#

/tags/clubhack

#

/tags/dc-19

/tags/dc-18

/tags/dc-17

/tags/dc-16

/tags/dc-15

#

/tags/hackinthebox-2011

#

/tags/hackercon-2011

#

/tags/notacon-8

/tags/notacon-7

/tags/notacon-6

#

/tags/nullcon

#

/tags/shmoocon-2012

/tags/shmoocon-2011

#

/tags/skydogcon-2011

#

/tags/swisscyberstorm-2011

#

#

#

http://us4.campaign-archive2.com/?u=950872c698a3cf5cfcf752971&id=c1a650ce0f

#

http://us4.campaign-archive2.com/?u=950872c698a3cf5cfcf752971&id=d7a088440a

http://us4.campaign-archive2.com/?u=950872c698a3cf5cfcf752971&id=067c16179e

http://securitytube-training.com/?id=cert-link

http://securitytube-training.com/certifications/securitytube-python-scripting-expert/

http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/

http://securitytube-training.com/online-courses/securitytube-ios-security-expert/

http://securitytube-training.com/certifications/securitytube-metasploit-framework-expert/

http://securitytube-training.com/certifications/securitytube-wi-fi-security-expert/

http://securitytube-training.com/testimonials/

http://forums.securitytube.net

http://securitytube-tools.net

/listing?type=latest

/listing?type=popular

/groups?operation=viewall&groupId=0

http://www.twitter.com/securitytube

http://www.facebook.com/pages/SecurityTube/157183860350

http://feeds2.feedburner.com/SecurityTube

/

/listing?type=latest

#

https://twitter.com/share

https://www.defcon.org/images/defcon-19/dc-19-presentations/Joyce/DEFCON-19-Joyce-trollspotting.png

/tags/securitytube

/tags/defcon

/tags/def con

/tags/hacking

/tags/hackers

/tags/information security

/tags/convention

/tags/computer security

/tags/DC 19

/tags/Defcon 19

/tags/dc-19

/Login?mode=login

/user/Securitytube_Poster

/user/Securitytube_Poster

/user/Securitytube_Poster

/video/10095

/video/10095

/video/8395

/video/8395

/video/8394

/video/8394

/video/8356

/video/8356

/video/8355

/video/8355

/video/8329

/video/8329

/video/8307

/video/8307

/video/8274

/video/8274

/video/8267

/video/8267

/video/7881

/video/7881

/video/7875

/video/7875

/video/6997

/video/6997

/video/6996

/video/6996

/video/6984

/video/6984

/video/6983

/video/6983

/video/6982

/video/6982

/video/6981

/video/6981

/video/6980

/video/6980

/video/6979

/video/6979

/video/6977

/video/6977

http://www.statcounter.com/free_hit_counter.html

>>> bt.get_text()

. . .

>>> 

-----------------------------------------------------------------------------------------------------------

·        Read the documentation of BeautifulSoup 4 and find other ways to iterate through tags and get to the juicy information

[sniper930-blog]

Fetching Web Pages

>>> import urllib

>>> httpResponse = urllib.urlopen(“http://localhost/sniper930”)

>>> httpResponse.code

404

>>> httpResponse = urllib.urlopen(“http://localhost”)

200

>>> print httpResponse.read()

<html><body><h1>It works</h1>

<p>This is the default web page for this server.</p>

<p>The web server software is running but no content has been added, yet.</p>

</body></html>

>>> dir(httpResponse)

[‘__doc__’, ‘__init__’, ‘__iter__’, ‘__module__’, ‘__repr__’, ‘close’, ‘code’, ‘fileno’, ‘fp’, ‘getcode’, ‘geturl’, ‘headers’, ‘info’, ‘next’, ‘read’, ‘readline’, ‘readlines’, ‘url’ ]

>>> httpResponse.url

‘http://localhost’

>>> dir(httpResponse.headers)

[ ‘__contains__’, ‘__delitem__’, ‘__doc__’, ‘__getitem__’, ‘__init__’, ‘__iter__’, ‘__len__’, ‘__module__’, ‘__setitem__’, ‘__str__’, ‘addcontinue’, ‘addheader’, ‘dict’, ‘encodingheader’, ‘fp’, ‘get’, ‘getaddr’, ‘getaddrlist’, ‘getallmatchingheaders’, ‘getdate’, ‘getdate_tz’, ‘getencoding’, ‘getfirstmatchingheader’, ‘getheader’, ‘getheaders’, ‘getmaintype’, ‘getparam’, ‘getparamnames’, ‘getplist’, ‘getrawheader’, ‘getsubtype’, ‘gettype’, ‘has_key’, ‘headers’, ‘iscomment’, ‘isheader’, ‘islast’, ‘items’, ‘keys’, ‘maintype’, ‘parseplist’, ‘parsetype’, ‘plist’, ‘plisttext’, ‘readheaders’, ‘rewindbody’, ‘seekable’, ‘setdefault’, ‘startofbody’, ‘startofheaders’, ‘status’, ‘subtype’, ‘type’, ‘typeheader’, ‘unixfrom’, ‘values’, ]

>>> httpResponse.headers.items()

[(‘content-length’, ‘177’), (‘accept-ranges’, ‘bytes’), (‘vary’, ‘Accept-Encoding’), (‘server’, ‘Apache/2.2.20 (Ubuntu)’), (‘last-modified’, ‘Mon, 16 Apr 2012 19:01:32 GMT’), (‘connection’, ‘close’), (‘etag’, ‘“10112-b1-4bdd0734f8014”’), (‘date’, ‘Mon, 16 Apr 2012 20:13:33 GMT’), (‘content-type’, ‘text/html’)]

>>> for header, value in httpResponse.headers.items():

. . .         print header + ‘ : ’ + value

. . .

content-length : 177

accept-ranges : bytes

vary : Accept-Encoding

server : Apache/2.2.20 (Ubuntu)

last-modified : Mon, 16 Apr 2012 19:01:32 GMT

connection : close

etag : “10112-b1-4bdd0734f8014”

date : Mon, 16 Apr 2012 20:13:33 GMT

content-type : text/html

>>> httpResponse.headers.keys()

[‘content-length’, ‘accept-ranges’, ‘vary’, ‘server’, ‘last-modified’, ‘connection’, ‘etag’, ‘date’, ‘content-type’]

>>> url = “http://www.securitytube.net/groups?operation=view&groupId=10”

>>> base_url = “http://www.securitytube.net/groups”

>>> args = { ‘operation’ : ‘view’, ‘groupId’ : 10}

>>> encode_args = urllib.urlencode(args)

>>> encode_args

‘operation=view&groupId=10’

>>> fp2 = urllib.urlopen(base_url + ‘?’ +encode_args)

>>> fp2.code

200

>>> fp2.read()

. . .

>>> fp2 = urllib.urlopen(base_url, encode_args)

>>> fp2.code

405

>>> 

-----------------------------------------------------------------------------------------------------------

·        If you try and download a very large file, then how do you monitor the progress?

    -    Research on urllib.urlretrieve() to solve this problem

·        Urlencode() does a bad job in handling special characters in the URL

    -    Research on .quote() and .quote_plus() and illustrate how they can help

[sniper930-blog]

Programming with Scapy

>>> from scapy.all import *

WARNING: No route found for IPv6 destination :: (no default route?)

>>> ls(ARP)

hwtype        : XShortField                        = (1)

ptype           : XShortEnumField              = (2048)

hwlen          : ByteField                            = (6)

plen             : ByteField                            = (4)

op                : ShortEnumField                = (1)

hwsrc          : ARPSourceMACField        = (None)

psrc             : SourceIPField                    = (None)

hwdst          : MACField                           = (‘00:00:00:00:00:’)

pdst             : IPField                                = (‘0.0.0.0’)

>>>

>>> pkt = Ether(dst=“ff:ff:ff:ff:ff:ff”)/ARP(pdst= ‘10.10.10.2’, hwdst=“ff:ff:ff:ff:ff:ff”)

<Ether  dst=ff:ff:ff:ff:ff:ff type=x806 |<ARP  hwdst=ff:ff:ff:ff:ff:ff pdst=10.10.10.2 |>>

>>> pkt.show()

###[ Ethernet ]###

dst        = ff:ff:ff:ff:ff:ff

src        = 08:00:27:30:c6:57

type      = 0x806

###[ ARP ]###

    hwtype        = 0x1

    ptype           = 0x800

    hwlen          = 6

    plen             = 4

    op                = who-has

    hwsrc          = 08:00:27:30:c6:57

    psrc             = 10.10.10.3

    hwdst          = ff:ff:ff:ff:ff:ff

>>> 

>>> srp1(pkt)

Begin emission:

Finished to send 1 packets.

-----------------------------------[Save as ArpScanner.py]------------------------------------

from scapy.all import *

# Subnet Scanner

for lsb in range(1, 50):

ip = “10.10.10.” + str(lsb)

arpRequest = Ether(dst=“ff:ff:ff:ff:ff:ff”)/ARP(pdst=ip, hwdst=“ff:ff:ff:ff:ff:ff”)

arpResponse = srp1(arpRequest, timeout=1, verbose=0)

if arpResponse:

    print “IP: ” + arpResponse.psrc + “ MAC: ” + arpResponse.hwsrc

-----------------------------------------------------------------------------------------------------------

·        Create a DNS poisoning tool similar to Dnsspoof using scapy

·        Create a ARP MITM tool using scapy

·        Create a TCP SYN Scanner using Scapy

·        Explore how to create a Fuzzer with Scapy

·        Create a DNS Fuzzer with Scapy and try it against DNSspoof

[sniper930-blog]

Packet Injection with Scapy

-----------------------------------------------[Python]------------------------------------------------

>>> pkt = IP(dst=“google.com”)

>>> pkt

<IP dst=0Net(‘google.com’) |>

>>> pkt.show()

###[ IP ]###

version= 4

ihl= None

tos= 0x0

len= None

id= 1

flags=

frag= 0

ttl= 64

proto= ip

chksum= None

src= 172.16.32.102

dst= Net(‘google.com’)

\options\

>>> pkt = IP(dst=“google.com”)/ICMP()/“Sniper930 was here”

>>> pkt.show()

###[ IP ]###

version= 4

ihl= None

tos= 0x0

len= None

id= 1

flags=

frag= 0

ttl= 64

proto= ip

chksum= None

src= 172.16.32.102

dst= Net(‘google.com’)

\options\

###[ ICMP ]###

    type= echo-request

    code= 0

    chksum= None

    id= 0x0

    seq= 0x0

###[ TCP ]###

        load= ‘Sniper930 was here’

>>>

>>> pkt

<IP frag=0 proto=icmp dst=Net(‘google.com’) |<ICMP |<Raw  load=’Sniper930 was here’ |>>>

----------------------------------------------[Terminal]----------------------------------------------

root@TheLaughingMan:~# tcpdump –i eth1 –XX -vvv icmp

-----------------------------------------------[Python]------------------------------------------------

>>> send(pkt)

.

Send 1 packets.

>>>

----------------------------------------------[Terminal]----------------------------------------------

tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

13:15:11.164822 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto ICMP (1), length 46)

172.16.32.102 > 120.28.26.99: ICMP echo request, id 0, seq 0, length 26

    0x0000:    84db ac45 c11a 0800 27df c45d 0800 4500    ...E....'..]..E.

    0x0010:    002e 0001 0000 4001 1bd9 ac10 2066 781c    [email protected].

    0x0020:    1a63 0800 a70e 0000 0000 536e 6970 6572    .c........Sniper

    0x0030:    3933 3020 7761 7320 6865 7265                      930.was.here

13:15:11.225806 IP (tos 0x0, ttl 50, id 10171, offset 0, flags [none], proto ICMP (1), length 46)

120.28.26.99 > 172.16.32.102: ICMP echo reply, id 0, seq 0, length 26

    0x0000:    0800 27df c45d 84db ac45 c11a 0800 4500    ..'..]...E....E.

    0x0010:    002e 27bb 0000 3201 021f 781c 1a63 ac10    ..'...2...x..c..

    0x0020:    2066 0000 af0e 0000 0000 536e 6970 6572    .f........Sniper

    0x0030:    3933 3020 7761 7320 6865 7265                     930.was.here

-----------------------------------------------[Python]------------------------------------------------

>>> sendp(Ether()/IP(dst=“google.com”)/ICMP()/“XXX”, iface=“eth1”)

.

Sent 1 packets.

----------------------------------------------[Terminal]----------------------------------------------

tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

13:20:55.933782 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto ICMP (1), length 31)

172.16.32.102 > 120.28.26.216: ICMP echo request, id 0, seq 0, length 11

    0x0000:    84db ac45 c11a 0800 27df c45d 0800 4500    ...E....'..]..E.

    0x0010:    001f 0001 0000 4001 1b73 ac10 2066 781c    [email protected].

    0x0020:    1ad8 0800 47a7 0000 0000 5858 58                ....G.....XXX

13:20:55.961031 IP (tos 0x0, ttl 49, id 38740, offset 0, flags [none], proto ICMP (1), length 31)

120.28.26.216 > 172.16.32.102: ICMP echo reply, id 0, seq 0, length 11

    0x0000:    0800 27df c45d 84db ac45 c11a 0800 4500    ..'..]...E....E.

    0x0010:    001f 9754 0000 3101 931f 781c 1ad8 ac10     ...T..1...x.....

    0x0020:    2066 0000 4fa7 0000 0000 5858 5800 0000    .f..O.....XXX...

    0x0030:    0000 0000 0000 0000 0000 0000                     ............

-----------------------------------------------[Python]------------------------------------------------

>>> sendp(Ether()/IP(dst=“google.com”)/ICMP()/“XXX”, iface=“eth1”, loop=1)

. . .

>>> sendp(Ether()/IP(dst=“google.com”)/ICMP()/“XXX”, iface=“eth1”, loop=1, inter=1)

. . .

>>> sr(IP(dst=“google.com”)/ICMP()/“XXX”)

Begin emission:

.Finished to send 1 packets.

*

Received 2 packets, got 1 answers, remaining 0 packets

(<Results: TCP:0 UDP:0 ICMP:1 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:0 Other:0>)

----------------------------------------------[Terminal]----------------------------------------------

tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

13:34:43.144045 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto ICMP (1), length 31)

172.16.32.102 > 120.28.26.226: ICMP echo request, id 0, seq 0, length 11

    0x0000:    84db ac45 c11a 0800 27df c45d 0800 4500    ...E....'..]..E.

    0x0010:    001f 0001 0000 4001 1b69 ac10 2066 781c    [email protected].

    0x0020:    1ae2 0800 47a7 0000 0000 5858 58                 ....G.....XXX

13:34:43.184605 IP (tos 0x0, ttl 49, id 6536, offset 0, flags [none], proto ICMP (1), length 31)

120.28.26.226 > 172.16.32.102: ICMP echo reply, id 0, seq 0, length 11

    0x0000:    0800 27df c45d 84db ac45 c11a 0800 4500    ..'..]...E....E.

    0x0010:    001f 1988 0000 3101 10e2 781c 1ae2 ac10     ......1...x.....

    0x0020:    2066 0000 4fa7 0000 0000 5858 5800 0000     .f..O.....XXX...

    0x0030:    0000 0000 0000 0000 0000 0000                      ............

-----------------------------------------------[Python]------------------------------------------------

>>> response, no_response = _

>>> response

<Results: TCP:0 UDP:0 ICMP:1 Other:0>

>>> no_response

<Unanswered: TCP:0 UDP:0 ICMP:0 Other:0>

>>> response[0]

(<IP  frag=0 proto=icmp dst=120.28.26.226 |<ICMP  |<Raw  load='XXX' |>>>, <IP  version=4L ihl=5L tos=0x0 len=31 id=6536 flags= frag=0L ttl=49 proto=icmp chksum=0x10e2 src=120.28.26.226 dst=172.16.32.102 options=[] |<ICMP  type=echo-reply code=0 chksum=0x4fa7 id=0x0 seq=0x0 |<Raw load='XXX' |<Padding load='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' |>>>>)

>>> 

>>> sr(IP(dst=“google.com”))

Begin emission:

.Finished to send 1 packets.

. . . . . . .^C

Received 8 packets, got 0 answers, remaining 1 packets

(<Results: TCP:0 UDP:0 ICMP:0 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:0 Other:1>)

>>> sr(IP(dst=“google.com”), timeout=5)

Begin emission:

.Finished to send 1 packets.

. . . . . . . .

Received 9 packets, got 0 answers, remaining 1 packets

(<Results: TCP:0 UDP:0 ICMP:0 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:0 Other:1>)

>>> sr1(IP(dst=“google.com”)/ICMP()/“XXX”)

.Finished to send 1 packets.

*

Received 2 packets, got 1 answers, remaining 0 packets

<IP  version=4L ihl=5L tos=0x0 len=31 id=13376 flags= frag=0L ttl=49 proto=icmp chksum=0xf629 src=120.28.26.226 dst=172.16.32.102 options=[] |<ICMP type=echo-reply code=0 chksum=0x4fa7 id=0x0 seq=0x0 |<Raw  load='XXX' |<Padding  load='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' |>>>>

>>> 

>>> conf.route

Network             Netmask                Gateway            Iface        Output IP

127.0.0.0            255.0.0.0                0.0.0.0                lo             127.0.0.1

0.0.0.0                0.0.0.0                    172.16.32.1        eth0         172.16.32.102

10.10.10.0          255.255.255.0        0.0.0.0                eth1         10.10.10.3

172.16.32.0        255.255.255.0        0.0.0.0                eth0         172.16.32.102

>>> conf.route.add(host=“192.168.1.199”, gw=“10.10.10.199”)

>>> conf.route

Network             Netmask                    Gateway              Iface    Output IP

127.0.0.0            255.0.0.0                    0.0.0.0                  lo         127.0.0.1

0.0.0.0                0.0.0.0                        172.16.32.1          eth0     172.16.32.102

10.10.10.0          255.255.255.0            0.0.0.0                  eth1     10.10.10.3

172.16.32.0        255.255.255.0            0.0.0.0                  eth0     172.16.32.102

192.168.1.199    255.255.255.255        10.10.10.199        eth1     10.10.10.3

>>> conf.route.add(host=“192.168.1.0/24”, gw=“10.10.10.2”)

>>> conf.route

Network             Netmask                    Gateway              Iface    Output IP

127.0.0.0            255.0.0.0                    0.0.0.0                  lo         127.0.0.1

0.0.0.0                0.0.0.0                        172.16.32.1          eth0     172.16.32.102

10.10.10.0          255.255.255.0            0.0.0.0                  eth1     10.10.10.3

172.16.32.0        255.255.255.0            0.0.0.0                  eth0     172.16.32.102

192.168.1.199    255.255.255.255        10.10.10.199        eth1     10.10.10.3

192.168.1.0        255.255.255.0            10.10.10.2            eth1     10.10.10.3

>>> conf.route.resync()

>>> conf.route

Network             Netmask                Gateway            Iface        Output IP

127.0.0.0            255.0.0.0                0.0.0.0                lo             127.0.0.1

0.0.0.0                0.0.0.0                    172.16.32.1        eth0         172.16.32.102

10.10.10.0          255.255.255.0        0.0.0.0                eth1         10.10.10.3

172.16.32.0        255.255.255.0        0.0.0.0                eth0         172.16.32.102

>>>

[sniper930-blog]

Packet Sniffing with Scapy

>>> ls()

. . .

>>> conf

. . .

>>> lsc()

. . .

>>> 

>>> pkts = sniff(iface=“eth1”, count=3)

>>> pkts

<Sniffed: TCP:1 UDP:0 ICMP:0 Other:2>

>>> pkts[0]

<Ether  dst=ff:ff:ff:ff:ff:ff src=08:00:27:06:e8:a7 type=0x806 |<ARP  hwtype=0x1 ptype=0x800 hwlen=6 plen=4 op=who-has hwsrc=08:00:27:06:e8:a7 psrc=10.10.10.2 hwdst=00:00:00:00:00:00 pdst=10.10.10.3 |<Padding load='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' |>>>

>>> pkts[1]

<Ether  dst=08:00:27:06:e8:a7 src=08:00:27:30:c6:57 type=0x806 |<ARP  hwtype=0x1 ptype=0x800 hwlen=6 plen=4 op=is-at hwsrc=08:00:27:30:c6:57 psrc=10.10.10.3 hwdst=08:00:27:06:e8:a7 pdst=10.10.10.2 |>>

>>> pkts[2]

<Ether  dst=08:00:27:30:c6:57 src=08:00:27:06:e8:a7 type=0x800 |<IP  version=4L ihl=5L tos=0x0 len=52 id=292 flags=DF frag=0L ttl=128 proto=tcp chksum=0xd187 src=10.10.10.2 dst=10.10.10.3 options=[] |<TCP  sport=1033 dport=webmin seq=564372634 ack=0 dataofs=8L reserved=0L flags=S window=8192 chksum=0x35a7 urgptr=0 options=[('MSS', 1460), ('NOP', None), ('WScale', 2), ('NOP', None), ('NOP', None), ('SAckOK', '')] |>>>

>>> 

>>> pkts[0].show

###[ Ethernet ]###

dst= 08:00:27:30:c6:57

src= 08:00:27:06:e8:a7

type= 0x800

###[ IP ]###

version= 4L

ihl= 5L

tos= 0x0

len= 52

id= 292

flags= DF

frag= 0L

ttl= 128

proto= tcp

chksum= 0xd187

src= 10.10.10.2

dst= 10.10.10.3

\options\

###[ TCP ]###

    sport= 1033

    dport= webmin

    seq= 564372634

    ack= 0

    dataofs= 8L

    reserved= 0L

    flags= S

    window= 8192

    chksum= 0x35a7

    urgptr= 0

    options= [('MSS', 1460), ('NOP', None), ('WScale', 2), ('NOP', None), ('NOP', None), ('SAckOK', '')]

>>> 

>>> hexdump(pkts[2])

0000    08 00 27 30 C6 57 08 00 27 06 E8 A7 08 00 45 00      ..'0.W..'.....E.

0010    00 34 01 24 40 00 80 06 D1 87 0A 0A 0A 02 0A 0A    .4.$@...........

0020    0A 03 04 09 27 10 21 A3 A4 9A 00 00 00 00 80 02     ....'.!.........

0030    20 00 35 A7 00 00 02 04 05 B4 01 03 03 02 01 01      .5.............

0040    04 02                                                                             ..

>>> 

>>> wrpcap(“pkts.pcap”, pkts)

>>> read_pkts = rdpcap(“pkts.pcap”)

>>> read_pkts

<pkts.pcap: TCP:1 UDP:0 ICMP:0 Other:2>

>>> read_pkts[0]

<Ether  dst=ff:ff:ff:ff:ff:ff src=08:00:27:06:e8:a7 type=0x806 |<ARP  hwtype=0x1 ptype=0x800 hwlen=6 plen=4 op=who-has hwsrc=08:00:27:06:e8:a7 psrc=10.10.10.2 hwdst=00:00:00:00:00:00 pdst=10.10.10.3 |<Padding load='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' |>>>

>>> read_pkts[1]

<Ether  dst=08:00:27:06:e8:a7 src=08:00:27:30:c6:57 type=0x806 |<ARP  hwtype=0x1 ptype=0x800 hwlen=6 plen=4 op=is-at hwsrc=08:00:27:30:c6:57 psrc=10.10.10.3 hwdst=08:00:27:06:e8:a7 pdst=10.10.10.2 |>>

>>> read_pkts[2]

<Ether  dst=08:00:27:30:c6:57 src=08:00:27:06:e8:a7 type=0x800 |<IP  version=4L ihl=5L tos=0x0 len=52 id=292 flags=DF frag=0L ttl=128 proto=tcp chksum=0xd187 src=10.10.10.2 dst=10.10.10.3 options=[] |<TCP  sport=1033 dport=webmin seq=564372634 ack=0 dataofs=8L reserved=0L flags=S window=8192 chksum=0x35a7 urgptr=0 options=[('MSS', 1460), ('NOP', None), ('WScale', 2), ('NOP', None), ('NOP', None), ('SAckOK', '')] |>>>

>>> 

>>> pkts = sniff(iface=“eth1”, filter=“icmp”, count=3)

>>> pkts

<Sniffed: TCP:0 UDP:0 ICMP:3 Other:0>

>>> pkts[0]

<Ether  dst=08:00:27:30:c6:57 src=08:00:27:06:e8:a7 type=0x800 |<IP  version=4L ihl=5L tos=0x0 len=60 id=344 flags= frag=0L ttl=128 proto=icmp chksum=0x1151 src=10.10.10.2 dst=10.10.10.3 options=[] |<ICMP  type=echo-request code=0 chksum=0x4d5a id=0x1 seq=0x1 |<Raw load='abcdefghijklmnopqrstuvwabcdefghi' |>>>>

>>> pkts[1]

<Ether  dst=08:00:27:06:e8:a7 src=08:00:27:30:c6:57 type=0x800 |<IP  version=4L ihl=5L tos=0x0 len=60 id=43734 flags= frag=0L ttl=64 proto=icmp chksum=0xa7d2 src=10.10.10.3 dst=10.10.10.2 options=[] |<ICMP  type=echo-reply code=0 chksum=0x555a id=0x1 seq=0x1 |<Raw load='abcdefghijklmnopqrstuvwabcdefghi' |>>>>

>>> pkts[2]

<Ether  dst=08:00:27:30:c6:57 src=08:00:27:06:e8:a7 type=0x800 |<IP  version=4L ihl=5L tos=0x0 len=60 id=345 flags= frag=0L ttl=128 proto=icmp chksum=0x1150 src=10.10.10.2 dst=10.10.10.3 options=[] |<ICMP  type=echo-request code=0 chksum=0x4d59 id=0x1 seq=0x2 |<Raw  load='abcdefghijklmnopqrstuvwabcdefghi' |>>>>

>>> pkts = sniff(iface=“eth1”, filter=“icmp”, count=30, prn=lambda x: x.summary())

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

Ether / IP / ICMP 10.10.10.2 > 10.10.10.3 echo-request 0 / Raw

Ether / IP / ICMP 10.10.10.3 > 10.10.10.2 echo-reply 0 / Raw

>>> pkts = sniff(iface=“eth1”, filter=“icmp”, count=30, prn=lambda x: x.show())

. . .

>>> 

>>> icmp_str = str(pkts[0])

>>> icmp_str

"\x08\x00'0\xc6W\x08\x00'\x06\xe8\xa7\x08\x00E\x00\x00<\x01\xcc\x00\x00\x80\x01\x10\xdd\n\n\n\x02\n\n\n\x03\x08\x00L\xe9\x00\x01\x00rabcdefghijklmnopqrstuvwabcdefghi"

>>> recon = Ether(icmp_str)

>>> recon

<Ether  dst=08:00:27:30:c6:57 src=08:00:27:06:e8:a7 type=0x800 |<IP  version=4L ihl=5L tos=0x0 len=60 id=460 flags= frag=0L ttl=128 proto=icmp chksum=0x10dd src=10.10.10.2 dst=10.10.10.3 options=[] |<ICMP  type=echo-request code=0 chksum=0x4ce9 id=0x1 seq=0x72 |<Raw load='abcdefghijklmnopqrstuvwabcdefghi' |>>>>

>>> export_object(icmp_str)

eNprYAr14mBQNzgWDiTZXiznYHBlYLBhPMPA0MAocJeLi4sJiJk5GHxeMjAyFCUmJaekpqVnZGZl

5+Tm5RcUFhWXlJaVw4ULGfUAKWoW+A==

 >>> newPkt = import_object()

eNprYAr14mBQNzgWDiTZXiznYHBlYLBhPMPA0MAocJeLi4sJiJk5GHxeMjAyFCUmJaekpqVnZGZl

5+Tm5RcUFhWXlJaVw4ULGfUAKWoW+A==

 >>> newPkt

"\x08\x00'0\xc6W\x08\x00'\x06\xe8\xa7\x08\x00E\x00\x00<\x01\xcc\x00\x00\x80\x01\x10\xdd\n\n\n\x02\n\n\n\x03\x08\x00L\xe9\x00\x01\x00rabcdefghijklmnopqrstuvwabcdefghi"

>>> Ether(newPkt)

.10.2 dst=10.10.10.3 options=[] |<ICMP  type=echo-request code=0 chksum=0x4ce9 id=0x1 seq=0x72 |<Raw load='abcdefghijklmnopqrstuvwabcdefghi' |>>>>

-----------------------------------------------------------------------------------------------------------

·        Create a Packet sniffer with Scapy for HTTP protocol and print out

    -        the HTTP Headers

    -        Data in GET/POST

·        Create a Wi-Fi Sniffer and print out the unique SSIDs of the Wi-Fi networks in your vicinity

[sniper930-blog]

Packet Injection with Raw Sockets

-----------------------------------------------[Python]------------------------------------------------

>>> import socket

>>> import struct

>>> rawSocket = socket.socket(socket.PF_PACKET, socket.SOCK_RAW, socket.htons(0x0800))

>>> rawSocket.bind((“eth0”, socket.htons(0x0800)))

>>> packet = struct.pack(“!6s6s2s”, ‘\xaa\xaa\xaa\xaa\xaa\xaa’, ‘\xbb\xbb\xbb\xbb\xbb\xbb’, ‘\x08\x00’)

>>> packet

‘\xaa\xaa\xaa\xaa\xaa\xaa\xbb\xbb\xbb\xbb\xbb\xbb\x08\x00’

>>> len(packet)

14

----------------------------------------------[Terminal]----------------------------------------------

root@TheLaughingMan:~# tcpdump –i eth0 –vv –XX “not port 22”

-----------------------------------------------[Python]------------------------------------------------

>>> rawSocket.send(packet + “Hello there”)

25

>>> 

-----------------------------------------------------------------------------------------------------------

·        Send an ARP Request Packet using Raw Sockets

·        Verify the same with Tcpdump or Wireshark

[sniper930-blog]

Packet Sniffing with Raw Sockets

----------------------------------------------[Terminal]----------------------------------------------

root@TheLaughingMan:~# python Server.py

Waiting for a Client ...

-----------------------------------------------[Python]------------------------------------------------

>>> import struct

>>> struct.pack(“B”, 1)

‘\x01’

>>> struct.pack(“H”, 1)

‘\x01\x00’

>>> struct.pack(“>H”, 1)

‘\x00\x01’

>>> struct.pack(“!H”, 1)

‘\x00\x01’

>>> struct.pack(“!L”, 1)

‘\x00\x00\x00\x01’

>>> struct.unpack(“!L”, “\x00\x00\x00\x01”)

(1,)

>>> import socket

>>> import binascii

>>> rawSocket = socket.socket(socket.PF_PACKET, socket.SOCK_RAW, socket.htons(0x0800))

>>> pkt = rawSocket.recvfrom(2048)

------------------------------[Terminal on a remote computer]------------------------------

root@ThePuppeteer:~# ncat -nv 10.10.10.3 8000

-----------------------------------------------[Python]------------------------------------------------

>>> pkt

("\x08\x00'0\xc6W\x08\x00'\x06\xe8\xa7\x08\x00E\x00\x004\x01N@\x00\x80\x06\xd1]\n\n\n\x02\n\n\n\x03\x04%\x1f@\x02\xaeF\x00\x00\x00\x00\x00\x80\x02 \x00\xba\xe4\x00\x00\x02\x04\x05\xb4\x01\x03\x03\x08\x01\x01\x04\x02", ('eth1', 2048, 0, 1, "\x08\x00'\x06\xe8\xa7"))

>>> ethernetHeader = pkt[0][0:14]

>>> ethernetHeader

“\x08\x00'0\xc6W\x08\x00'\x06\xe8\xa7\x08\x00”

>>> eth_hdr = struct.unpack(“!6s6s2s”, ethernetHeader)

>>> eth_hdr

(“\x08\x00'0\xc6W”, “\x08\x00’\x06\xe8\xa7”, ‘\x08\x00’)

>>> binascii.hexlify(eth_hdr[0])

‘08002730c657’

>>> binascii.hexlify(eth_hdr[1])

‘08002706e8a7’

>>> binascii.hexlify(eth_hdr[2])

‘0800’

>>> ipHeader = pkt[0][14:34]

>>> ipHeader

‘E\x00\x004\x01N@\x00\x80\x06\xd1]\n\n\n\x02\n\n\n\x03’

>>> ip_hdr = struct.unpack(“!12s4s4s”, ipHeader)

>>> print “Source IP address: ” + socket.inet_ntoa(ip_hdr[1])

Source IP address: 10.10.10.2

>>> print “Destination IP address: ” + socket.inet_ntoa(ip_hdr[2])

Destination IP address: 10.10.10.3

>>> tcpHeader = pkt[0][34:54]

>>> tcp_hdr = struct.unpack(“!HH16s”, tcpHeader)

>>> tcp_hdr

(1061, 8000, ‘\x02\xaeF\x00\x00\x00\x00\x00\x80\x02 \x00\xba\xe4\x00\x00’)

>>> 

-----------------------------------------------------------------------------------------------------------

root@TheLaughingMan:~# ifconfig eth0 promisc

-----------------------------------------------------------------------------------------------------------

·        Create a Packet Sniffer using Raw Sockets which can parse TCP packets

    -        Parse individual fields

·        Create a sniffer which uses a filter to only print details of an HTTP packet (TCP, Port 80)

    -        Also dump the data

[sniper930-blog]

Creating a WebServer

-----------------------------------------------[Python]------------------------------------------------

>>> import SocketServer

>>> import SimpleHTTPServer

>>> httpServer = SocketServer.TCPServer((‘’, 10001), SimpleHTTPServer.SimpleHTTPRequestHandler)

>>> httpServer.serve_forever()

192.168.1.10 – – [28/Jul/2015 13:16:43] “GET / HTTP/1.1” 200 –

192.168.1.10 – – [28/Jul/2015 13:16:50] code 404, message File not found

192.168.1.10 – – [28/Jul/2015 13:16:50] “GET /favicon.ico HTTP/1.1” 404 –

-----------------------------------------------------------------------------------------------------------

------------------------------------[Save as WebServer.py]-------------------------------------

import SocketServer

import SimpleHTTPServer

class HttpRequestHandler(SimpleHTTPServer. SimpleHTTPRequestHandler):

def do_GET(self):

    if self.path == ‘/admin’:

        self.wfile.write(‘This page is only for Admins!’)

        self.wfile.write(self.headers)

    else:

        SimpleHTTPServer.SimpleHTTPRequestHandler.do_GET(self)

httpServer = SocketServer.TCPServer((“”, 10000), HttpRequestHandler)

httpServer.serve_forever()

----------------------------------------------[Terminal]----------------------------------------------

root@TheLaughingMan:~# python WebServer.py

192.168.1.10 – – [28/Jul/2015 13:27:19] “GET / HTTP/1.1” 200 –

192.168.1.10 – – [28/Jul/2015 13:27:19] code 404, message File not found

192.168.1.10 – – [28/Jul/2015 13:27:19] “GET /favicon.ico HTTP/1.1” 404 –

192.168.1.10 – – [28/Jul/2015 13:29:54] code 404, message File not found

192.168.1.10 – – [28/Jul/2015 13:29:54] “GET /favicon.ico HTTP/1.1” 404 –

-----------------------------------------------------------------------------------------------------------

·        Is there a module available to run CGI as well?

·        Please write a PoC for the above

[sniper930-blog]

SocketServer Framework

---------------------------------------[Save as Client.py]-----------------------------------------

import socket

import sys

tcpSocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

tcpSocket.connect((sys.argv[1], 8000))

while 1:

userInput = raw_input(“Please enter a string: ”)

tcpSocket.send(userInput)

print tcpSocket.recv(2048)

tcpSocket.close()

--------------------------------------------[Terminal1]-----------------------------------------------

root@TheLaughingMan:~# python Server.py

Waiting for a Client ...

--------------------------------------------[Terminal2]-----------------------------------------------

root@ThePuppeteer:~# python Client.py 192.168.1.150

--------------------------------------------[Terminal1]-----------------------------------------------

Received connection from : 192.168.1.10

Starting ECHO output ....

--------------------------------------------[Terminal2]-----------------------------------------------

Please enter a string: Give me six hours to chop down a tree and I will spend the first four sharpening the axe.

Give me six hours to chop down a tree and I will spend the first four sharpening the axe.

Please enter a string:

--------------------------------------------[Terminal1]-----------------------------------------------

Client sent: Give me six hours to chop down a tree and I will spend the first four sharpening the axe.

-----------------------------------------------------------------------------------------------------------

-----------------------------------[Save as TcpServer.py]---------------------------------------

import SocketServer

class EchoHandler(SocketServer.BaseRequestHandler):

def handle(self):

    print “Got Connection from : ”, self.client_address

    data = ‘dummy’

    while len(data):

        data = self.request.recv(1024)

        print “Client sent: ” + data

        self.request.send(data)

    print “Client left”

serverAddr = (“0.0.0.0”, 9000)

server = SocketServer.TCPServer(serverAddr, EchoHandler)

server.serve_forever()

--------------------------------------------[Terminal1]-----------------------------------------------

root@TheLaughingMan:~# python TcpServer.py

--------------------------------------------[Terminal2]-----------------------------------------------

root@ThePuppeteer:~# nc 192.168.1.150 9000

--------------------------------------------[Terminal1]-----------------------------------------------

Got Connection from : (‘192.168.1.10’, 59697)

--------------------------------------------[Terminal2]-----------------------------------------------

Give me six hours to chop down a tree and I will spend the first four sharpening the axe.

Give me six hours to chop down a tree and I will spend the first four sharpening the axe.

--------------------------------------------[Terminal1]-----------------------------------------------

Client sent: Give me six hours to chop down a tree and I will spend the first four sharpening the axe.

-----------------------------------------------------------------------------------------------------------

·        Is this server multi-threaded?

·        Code up the multi-threaded version of the SocketServer

[sniper930-blog]

Socket Programming Basics

-----------------------------------------------[Python]------------------------------------------------

>>> import socket

>>> tcpSocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

>>> tcpSocket.bind((“0.0.0.0”, 8000))

>>> tcpSocket.listen(2)

>>> (client, (ip, port)) = tcpSocket.accept()

---------------------------------------------[Terminal]-----------------------------------------------

root@TheLaughingMan:~# ncat 192.168.1.150 8000

-----------------------------------------------[Python]------------------------------------------------

>>> client

<socket._socketobject object at 0xb74f6e9c>

>>> ip

‘192.168.1.10’

>>> port

1031

>>> client.send(“Give me six hours to chop down a tree and I will spend the first four sharpening the axe.\n”)

89

>>> data = client.recv(2048)

---------------------------------------------[Terminal]-----------------------------------------------

Give me six hours to chop down a tree and I will spend the first four sharpening the axe.

Brilliant!

-----------------------------------------------[Python]------------------------------------------------

>>> data

‘Brilliant!\n’

-----------------------------------------------------------------------------------------------------------

---------------------------------------[Save as Server.py]----------------------------------------

import socket

tcpSocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

tcpSocket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

tcpSocket.bind((“0.0.0.0”, 8000))

tcpSocket.listen(2)

print “Waiting for a Client ... ”

(client, (ip, sock)) = tcpSocket.accept()

print “Received connection from : ”, ip

print “Starting ECHO output .... ”

data = ‘dummy’

while len(data):

data = client.recv(2048)

print “Client sent: ”, data

client.send(data)

print “Closing connection ...”

client.close()

print “Shutting down server ...”

--------------------------------------------[Terminal1]-----------------------------------------------

root@TheLaughingMan:~# python Server.py

Waiting for a Client ...

--------------------------------------------[Terminal2]-----------------------------------------------

root@ThePuppeteer:~# ncat –nv 192.168.1.150 8000

Ncat Version 6.47 ( http://nmap.org/ncat )

Ncat: Connected to 192.168.1.150:8000.

--------------------------------------------[Terminal1]-----------------------------------------------

Received connection from : 192.168.1.10

Starting ECHO output ....

--------------------------------------------[Terminal2]-----------------------------------------------

Give me six hours to chop down a tree and I will spend the first four sharpening the axe.

Give me six hours to chop down a tree and I will spend the first four sharpening the axe.

--------------------------------------------[Terminal1]-----------------------------------------------

Client sent: Give me six hours to chop down a tree and I will spend the first four sharpening the axe.

-----------------------------------------------------------------------------------------------------------

·        Create a simple Echo Server to handle 1 client

·        Create a Multi-Threaded Echo Server

·        Create a Multi-Process Echo Server

·        Create a Non-Blocking Multiplexed Echo Server using Select()

[sniper930-blog]

Subprocess

>>> import subprocess

>>> subprocess.call([‘ps’, ‘aux’])

USER       PID %CPU %MEM    VSZ   RSS TTY     STAT START   TIME COMMAND

root         1  0.4  0.1   2296  1516 ?        Ss   11:40   0:00 init [2]  

root         2  0.0  0.0     0     0 ?        S   11:40   0:00 [kthreadd]

root         3  0.0  0.0     0     0 ?        S   11:40   0:00 [ksoftirqd/0]

root         4  0.0  0.0     0     0 ?        S   11:40   0:00 [kworker/0:0]

root         5  0.0  0.0     0     0 ?        S<   11:40   0:00 [kworker/0:0H]

root         6  0.0  0.0     0     0 ?        S   11:40   0:00 [kworker/u2:0]

root         7  0.1  0.0     0     0 ?        S   11:40   0:00 [rcu_sched]

root         8  0.0  0.0     0     0 ?        S   11:40   0:00 [rcu_bh]

root         9  0.0  0.0     0     0 ?        S   11:40   0:00 [migration/0]

root       10  0.0  0.0     0     0 ?        S   11:40   0:00 [watchdog/0]

root       11  0.0  0.0     0     0 ?        S<   11:40   0:00 [khelper]

root       12  0.0  0.0     0     0 ?        S   11:40   0:00 [kdevtmpfs]

root       13  0.0  0.0     0     0 ?        S<   11:40   0:00 [netns]

root       14  0.0  0.0     0     0 ?        S<   11:40   0:00 [perf]

root       15  0.0  0.0      0     0 ?        S    11:40   0:00 [khungtaskd]

root       16  0.0  0.0     0     0 ?        S<   11:40   0:00 [writeback]

root       17  0.0  0.0     0     0 ?        SN   11:40   0:00 [ksmd]

root       18  0.0  0.0     0     0 ?        SN   11:40   0:00 [khugepaged]

root       19  0.0  0.0     0     0 ?        S<   11:40   0:00 [crypto]

root       20  0.0  0.0     0     0 ?        S<   11:40   0:00 [kintegrityd]

root       21  0.0  0.0     0     0 ?        S<   11:40   0:00 [bioset]

root        22 0.0  0.0      0     0 ?        S<   11:40   0:00 [kblockd]

root       23  3.2  0.0     0     0 ?        S   11:40   0:04 [kworker/0:1]

root       24  0.0  0.0     0     0 ?        S<   11:40   0:00 [devfreq_wq]

root       25  0.0  0.0     0     0 ?       S    11:40   0:00 [kswapd0]

root       26  0.0  0.0     0     0 ?        S   11:40   0:00 [fsnotify_mark]

root       33  0.0  0.0     0     0 ?        S<   11:40   0:00 [kthrotld]

root       34  0.0  0.0     0     0 ?        S<   11:40   0:00 [ipv6_addrconf]

root       35  0.0  0.0     0     0 ?        S<   11:40   0:00 [deferwq]

root       36  0.0  0.0     0     0 ?        S   11:40   0:00 [kworker/u2:1]

root       104  0.0  0.0     0     0 ?        S<   11:40   0:00 [ata_sff]

root       136  0.0  0.0     0     0 ?        S   11:40   0:00 [scsi_eh_0]

root       137  0.0  0.0     0     0 ?        S<   11:40   0:00 [scsi_tmf_0]

root       138  0.0  0.0      0     0 ?        S    11:40   0:00 [scsi_eh_1]

root       139  0.0  0.0     0     0 ?        S   11:40   0:00 [kworker/u2:2]

root       140  0.0  0.0     0     0 ?        S<   11:40   0:00 [scsi_tmf_1]

root       141  0.0  0.0     0     0 ?        S   11:40   0:00 [scsi_eh_2]

root       142  0.0  0.0     0     0 ?        S<   11:40   0:00 [scsi_tmf_2]

root       143  0.0  0.0     0     0 ?        S   11:40   0:00 [kworker/u2:3]

root       144  0.0  0.0     0     0 ?        S   11:40   0:00 [kworker/u2:4]

root       145  0.3  0.0     0     0 ?        S   11:40   0:00 [kworker/0:2]

root       148  0.2  0.0     0     0 ?        S   11:40   0:00 [kworker/0:3]

root       151  0.1  0.0     0     0 ?        S<   11:40   0:00 [kworker/0:1H]

root       212 0.0  0.0      0     0 ?        S<   11:40   0:00 [kdmflush]

root       213  0.0  0.0     0     0 ?        S<   11:40   0:00 [bioset]

root       214  0.0  0.0     0     0 ?        S<   11:40   0:00 [kcryptd_io]

root       215  0.0  0.0     0     0 ?       S<   11:40   0:00 [kcryptd]

root       216  0.0  0.0     0     0 ?        S<   11:40   0:00 [bioset]

root       223  0.0  0.0     0     0 ?        S<   11:40   0:00 [kdmflush]

root       224  0.0  0.0     0     0 ?        S<   11:40   0:00 [bioset]

root       226  0.0  0.0     0     0 ?        S<   11:40   0:00 [kdmflush]

root       227  0.0  0.0     0     0 ?        S<   11:40   0:00 [bioset]

root       247  0.0  0.0     0     0 ?        S   11:40   0:00 [jbd2/dm-1-8]

root       248  0.0  0.0     0     0 ?        S<   11:40   0:00 [ext4-rsv-conver]

root       393  0.0  0.2   2932  2564 ?        Ss   11:40   0:00 udevd --daemon

root       530  0.0  0.2   2928  2332 ?        S   11:40   0:00 udevd --daemon

root       531  0.0  0.2   2928  2332 ?        S   11:40   0:00 udevd --daemon

root       546  0.0  0.0     0     0 ?        S<   11:40   0:00 [kpsmoused]

root       568  0.9  0.0     0     0 ?        S   11:40   0:01 [kworker/0:4]

root     1617  0.0  0.0     0     0 ?        S<   11:40   0:00 [ext4-rsv-conver]

root     2263  0.0  0.2 27956  2612 ?        Sl   11:40   0:00 /usr/sbin/rsyslogd -c5

root     2318  0.0  0.2   5196  2676 ?        Ss   11:40   0:00 dhclient -v -pf /run/dhclient.eth0.pid -lf /var

102       2389  0.2  0.2   3704  2688 ?        Ss   11:40   0:00 /usr/bin/dbus-daemon --system

root     2414  0.0  0.8 18840  8520 ?        Ssl 11:40   0:00 /usr/sbin/NetworkManager

root     2446  0.0  0.5 18076  5184 ?        Sl   11:40   0:00 /usr/sbin/gdm3

root     2465  0.1  0.6 24008  6264 ?        Sl   11:40   0:00 /usr/lib/policykit-1/polkitd --no-debug

root     2466  0.0  0.6 20404  6972 ?        Sl   11:40   0:00 /usr/lib/gdm3/gdm-simple-slave --display-id /or

root     2474  2.7  3.8 185940 39392 tty7     Ss+ 11:40   0:03 /usr/bin/Xorg :0 -br -verbose -novtswitch -auth

arpwatch 2480  0.0  0.4   6136  4484 ?        S   11:40   0:00 /usr/sbin/arpwatch -u arpwatch -N -p

root     2490  0.0  0.4   6904  4776 ?        S   11:40   0:00 /usr/sbin/modem-manager

daemon   2492  0.0  0.0   2168   124 ?        Ss   11:40   0:00 /usr/sbin/atd

root     2556  0.0  0.1   3788  1976 ?        Ss   11:40   0:00 /usr/sbin/cron

root     2614  0.0  0.1 10512  1756 ?        Sl   11:40   0:00 /usr/sbin/pcscd

root     2650  0.0  0.5 23112  5288 ?        Sl   11:40   0:00 /usr/lib/accountsservice/accounts-daemon

root     2654  0.0  0.5 27008  5320 ?        Sl   11:40   0:00 /usr/sbin/console-kit-daemon --no-daemon

postgres  2656  0.9 1.0  45160 11308 ?        S   11:40   0:01 /usr/lib/postgresql/9.1/bin/postgres -D /var/li

root     2741  0.0  0.6 34668  6244 ?        Sl   11:40   0:00 /usr/lib/upower/upowerd

postgres 2847  0.0  0.3 45160  3572 ?        Ss   11:40   0:00 postgres: writer process                      

postgres 2848  0.0  0.3 45160  3572 ?        Ss   11:40   0:00 postgres: wal writer process                  

postgres 2849  0.0  0.5 45724  5336 ?        Ss   11:40   0:00 postgres: autovacuum launcher process          

postgres 2850  0.0  0.3 15532  3728 ?        Ss   11:40   0:00 postgres: stats collector process              

rtkit     2861  0.0  0.2 19004  2184 ?        SNl 11:40   0:00 /usr/lib/rtkit/rtkit-daemon

root     2950  0.0  0.1   2296  1696 tty1     Ss+ 11:41   0:00 /sbin/getty 38400 tty1

root     2951  0.0  0.1   2296  1712 tty2     Ss+ 11:41   0:00 /sbin/getty 38400 tty2

root     2952  0.0  0.1   2296  1712 tty3     Ss+ 11:41   0:00 /sbin/getty 38400 tty3

root     2953  0.0  0.1   2296 1852 tty4     Ss+  11:41   0:00 /sbin/getty 38400 tty4

root     2954  0.0  0.1   2296  1848 tty5     Ss+ 11:41   0:00 /sbin/getty 38400 tty5

root     2955  0.0  0.1   2296  1632 tty6     Ss+ 11:41   0:00 /sbin/getty 38400 tty6

root     2957  0.0  0.6 26828  6660 ?        Sl   11:41   0:00 gdm-session-worker [pam/gdm3]

root     2964  0.0  0.6 59868  6332 ?        Sl   11:41   0:00 /usr/bin/gnome-keyring-daemon --daemonize --log

root     2966  0.0  0.0     0     0 ?        S   11:41   0:00 [kauditd]

root     2982  0.1  1.5 48996 15848 ?        Ssl  11:41   0:00 x-session-manager

root     3027  0.0  0.1   3532  1756 ?        S   11:41   0:00 dbus-launch --autolaunch=511a1c0ee95e1cfc823071

root     3028  0.0  0.1   3032  1964 ?        Ss   11:41   0:00 /usr/bin/dbus-daemon --fork --print-pid 5 --pri

root     3031  0.0  0.4 30352  4572 ?        Sl   11:41   0:00 /usr/lib/dconf/dconf-service

root     3043  0.0  0.0   3884   216 ?        Ss   11:41   0:00 /usr/bin/ssh-agent /usr/bin/dbus-launch --exit-

root     3046  0.0  0.1   3532  1752 ?        S   11:41   0:00 /usr/bin/dbus-launch --exit-with-session x-sess

root     3047  0.1  0.2   3540  2564 ?        Ss   11:41   0:00 /usr/bin/dbus-daemon --fork --print-pid 5 --pri

root     3053  1.0  2.5 154344 26224 ?        Sl   11:41   0:00 /usr/lib/gnome-settings-daemon/gnome-settings-d

root     3061  0.0  0.4   8568  4920 ?        S   11:41   0:00 /usr/lib/gvfs/gvfsd

root     3070  0.0  0.6   9336  6436 ?        S   11:41   0:00 /usr/lib/gvfs/gvfs-gdu-volume-monitor

root     3072  0.0  0.5 14828  5460 ?        Sl   11:41   0:00 /usr/lib/udisks/udisks-daemon

root     3073  0.0  0.0   6368   260 ?        S   11:41   0:00 udisks-daemon: polling /dev/sr0

root     3076  0.0  0.4   8616  5008 ?        S   11:41   0:00 /usr/lib/gvfs/gvfs-gphoto2-volume-monitor

root     3078  0.0  0.3 19084  3392 ?        Sl   11:41   0:00 /usr/lib/gvfs/gvfs-afc-volume-monitor

colord   3082  0.0  0.6 24600  6664 ?        Sl   11:41   0:00 /usr/lib/i386-linux-gnu/colord/colord

root     3083  0.0  0.8 55748  8736 ?        Sl   11:41   0:00 /usr/lib/packagekit/packagekitd

root     3084  0.2  1.5 38876 16384 ?        Sl   11:41   0:00 /usr/bin/metacity

root     3086  0.0  0.7 46284  8200 ?        Sl   11:41   0:00 /usr/lib/gnome-settings-daemon/gsd-printer

root     3089  2.0  3.3 88156 34888 ?        Sl   11:41   0:01 gnome-panel

root     3105  0.0  0.4   8340  4892 ?        S   11:41   0:00 /usr/lib/i386-linux-gnu/gconf/gconfd-2

colord   3111  0.3  1.2 42412 13256 ?        Sl   11:41   0:00 /usr/lib/i386-linux-gnu/colord/colord-sane

root     3114  0.0  0.4 30352  4672 ?        Sl   11:41   0:00 /usr/lib/dconf/dconf-service

root     3120  0.2  1.1 63912 11420 ?        Sl   11:41   0:00 /usr/lib/tracker/tracker-store

root     3121  0.4  2.2 47316 23228 ?        Sl   11:41   0:00 nm-applet

root     3122  0.0  1.4 31384 14700 ?        Sl   11:41   0:00 /usr/lib/policykit-1-gnome/polkit-gnome-authent

root     3123  0.2  2.0 103128 21616 ?        Sl   11:41   0:00 gnome-sound-applet

root     3127  0.0  1.4 56096 14972 ?        Sl   11:41   0:00 /usr/lib/gnome-settings-daemon/gnome-fallback-m

root     3132  0.2  1.7 41972 17724 ?        Sl   11:41 0:00 bluetooth-applet

root     3133  0.0  1.4 40136 15288 ?        Sl   11:41   0:00 gnome-screensaver

root     3139  1.7  3.0 95292 31280 ?        Sl   11:41   0:01 nautilus -n

root     3144  0.0  1.3 39588 14396 ?        Sl   11:41   0:00 /usr/lib/notification-daemon/notification-daemo

root     3145  0.1  1.4 24864 15396 ?        S    11:41   0:00 /usr/lib/gnome-disk-utility/gdu-notification-da

root     3148  0.2  1.1 41140 11780 ?        SNl  11:41   0:00 /usr/lib/tracker/tracker-miner-fs

root     3154  0.2  0.8 97376  8560 ?        S<l 11:41   0:00 /usr/bin/pulseaudio --start

root     3169  0.0  0.5   9088  6112 ?        S   11:41   0:00 /usr/lib/gvfs/gvfsd-trash --spawner :1.4 /org/g

root     3171  0.0  0.5   8568  5272 ?        S   11:41   0:00 /usr/lib/gvfs/gvfsd-burn --spawner :1.4 /org/gt

root     3179  0.0  0.5   8264  5856 ?        S   11:41   0:00 /usr/lib/gvfs/gvfsd-metadata

root     3188  0.0  0.9 37036  9644 ?        Sl   11:41   0:00 /usr/lib/telepathy/mission-control-5

root     3193  0.1  1.5 92024 15824 ?        Sl   11:41   0:00 /usr/lib/gnome-online-accounts/goa-daemon

root     3201  2.7  2.2 62148 23528 ?        Sl   11:41   0:00 gnome-terminal

root     3209  0.0  0.1   2096  1648 ?        S   11:41   0:00 gnome-pty-helper

root     3210  0.4  0.4   6148  4680 pts/0    Ss   11:41   0:00 bash

root     3255  0.0  0.5   7288  5912 pts/0    S+   11:42   0:00 python

root     3257  0.0  0.2   4296  2220 pts/0    R+   11:42   0:00 ps aux

0>>> 

>>> subprocess.call([‘ls’, ‘-al’])

total 1772

drwxrwxr-x 19 root root    4096 Jul 26 11:41 .

drwxr-xr-x 23 root root    4096 Jun 4 23:43 ..

-rw-------  1 root root   3827 Jul 19 16:19 .bash_history

-rw-rw-r--  1 root root   3391 Mar  3 18:35 .bashrc

drwx------  8 root root   4096 Jul 26 11:41 .cache

drwx------ 11 root root    4096 Jul 20 21:18 .config

drwxr-xr-x  6 root root   4096 Jun 30 00:46 .cpan

drwx------  3 root root   4096 Jun  5 00:04 .dbus

drwxr-xr-x  5 root root   4096 Jul 26 11:43 Desktop

drwx------  2 root root   4096 Jul  2 01:11 Downloads

drwx------  3 root root   4096 Jul 26 11:41 .gconf

drwx------  4 root root   4096 Jun  5 00:04 .gnome2

drwxr-xr-x  2 root root   4096 Jun 20 01:11 .gstreamer-0.10

drwx------  2 root root   4096 Jun  5 00:04 .gvfs

-rw-------  1 root root   18900 Jul 26 11:41 .ICEauthority

drwxr-xr-x  3 root root   4096 Jun  5 00:04 .local

drwx------  3 root root   4096 Jun  5 00:04 .mission-control

drwx------  4 root root   4096 Jun 12 16:02 .mozilla

drwxr-xr-x  8 root root   4096 Jul 14 08:14 .msf4

-rw-r--r--  1 root root 1667584 Jun 30  2011 ncat.exe

-rw-r--r--  1 root root     140 Feb 5 21:16 .profile

drwx------  2 root root   4096 Jul 26 11:41 .pulse

-rw-------  1 root root     256 Jun 5 00:04 .pulse-cookie

-rw-------  1 root root   1024 Mar 13 02:20 .rnd

drwxr-xr-x  3 root root   4096 Jul 17 17:48 .set

drwx------  4 root root   4096 Jul 16 00:11 .thumbnails

-rw-------  1 root root     847 Jul 12 20:59 .viminfo

-rw-------  1 root root   3814 Jul 26 11:51 .xsession-errors

-rw-------  1 root root   8195 Jul 22 23:56 .xsession-errors.old

0>>> 

>>> subprocess.check_output([‘ls’, ‘-al’])

'total 1772\ndrwxrwxr-x 19 root root    4096 Jul 26 11:41 .\ndrwxr-xr-x 23 root root    4096 Jun  4 23:43 ..\n-rw-------  1 root root   3827 Jul 19 16:19 .bash_history\n-rw-rw-r--  1 root root   3391 Mar  3 18:35 .bashrc\ndrwx------  8 root root    4096 Jul 26 11:41 .cache\ndrwx------ 11 root root    4096 Jul 20 21:18 .config\ndrwxr-xr-x  6 root root    4096 Jun 30 00:46 .cpan\ndrwx------  3 root root   4096 Jun  5 00:04 .dbus\ndrwxr-xr-x  5 root root   4096 Jul 26 11:43 Desktop\ndrwx------ 2 root root    4096 Jul  2 01:11 Downloads\ndrwx------  3 root root   4096 Jul 26 11:41 .gconf\ndrwx------ 4 root root    4096 Jun  5 00:04 .gnome2\ndrwxr-xr-x  2 root root   4096 Jun 20 01:11 .gstreamer-0.10\ndrwx------  2 root root   4096 Jun  5 00:04 .gvfs\n-rw-------  1 root root   18900 Jul 26 11:41 .ICEauthority\ndrwxr-xr-x  3 root root    4096 Jun  5 00:04 .local\ndrwx------  3 root root   4096 Jun  5 00:04 .mission-control\ndrwx------  4 root root    4096 Jun 12 16:02 .mozilla\ndrwxr-xr-x  8 root root    4096 Jul 14 08:14 .msf4\n-rw-r--r--  1 root root 1667584 Jun 30  2011 ncat.exe\n-rw-r--r--  1 root root     140 Feb 5 21:16 .profile\ndrwx------  2 root root    4096 Jul 26 11:41 .pulse\n-rw-------  1 root root     256 Jun 5 00:04 .pulse-cookie\n-rw------- 1 root root    1024 Mar 13 02:20 .rnd\ndrwxr-xr-x  3 root root    4096 Jul 17 17:48 .set\ndrwx------  4 root root   4096 Jul 16 00:11 .thumbnails\n-rw-------  1 root root     847 Jul 12 20:59 .viminfo\n-rw-------  1 root root   4008 Jul 26 11:57 .xsession-errors\n-rw-------  1 root root   8195 Jul 22 23:56 .xsession-errors.old\n'

>>> 

>>> lines = subprocess.check_output([‘ls’, ‘-al’])

>>> lines[0]

‘t’

>>> lines[1]

‘o’

>>> lines = subprocess.check_output([‘ls’])

>>> lines

‘Desktop\nDownloads\nncat.exe\n’

>>> lines[0]

‘D’

>>> lines_list = lines.split(‘\n’)

>>> lines_list

[‘Desktop’, ‘Downloads’, ‘ncat.exe’, ‘’]

>>> 

>>> handle = subprocess.Popen(“ls”, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)

>>> handle.stdoit.read()

‘Desktop\nDownloads\nncat.exe\n’

-----------------------------------------------------------------------------------------------------------

·        Why is shell = True a security issue?

[sniper930-blog]

Signals and IPC

root@TheLaughingMan:~# man signal

root@TheLaughingMan:~# man 7 signal

----------------------------------------[Save as signal.py]----------------------------------------

import signal

def ctrlc_handler(signum, frm):

print “\nHaha! You cannot kill me!”

print “Installing signal handler ….”

signal.signal(signal.SIGINT, ctrlc_handler)

print “Done!”

while True:

pass

-----------------------------------------------------------------------------------------------------------

----------------------------------------------[Terminal]----------------------------------------------

root@TheLaughingMan:~# python signal.py

Installing signal handler ….

Done!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

^C

Haha! You cannot kill me!

-----------------------------------------------------------------------------------------------------------

·        Create a TCP server which listens to a port

·        Implement signals to ensure it automatically shuts down after a pre-configured duration, which is given via command line

·        eg. tcp-server –s 100

·        shutdown after listening to port for 100 seconds

[sniper930-blog]

Threading and Queues

-------------------------------------------[Save as q.py]--------------------------------------------

import threading

import Queue

import time

class WorkerThread(threading.Thread):

def __init__(self, queue):

    threading.Thread.__init__(self)

    self.queue = queue

def run(self):

    print “In WorkerThread”

    while True:

        counter = self.queue.get()

        print “Ordered to sleep for %d seconds!” %counter

        time.sleep(counter)

        print “Finished sleeping for %d seconds” %counter

        self.queue.task_done()

queue = Queue.Queue()

for i in range(10):

print “Creating WorkerThread : %d” %i

worker = WorkerThread(queue)

worker.setDaemon(True)

worker.start()

print “WorkerThread %d Created!” %i

for j in range(10):

queue.put(j)

queue.join()

print “All tasks over!”

-----------------------------------------------------------------------------------------------------------

----------------------------------------------[Terminal]----------------------------------------------

root@TheLaughingMan:~# python q.py

Creating WorkerThread : 0

WorkerThread 0 Created!

Creating WorkerThread : 1

In WorkerThread

WorkerThread 1 Created!

Creating WorkerThread : 2

In WorkerThread

WorkerThread 2 Created!

Creating WorkerThread : 3

In WorkerThread

WorkerThread 3 Created!

Creating WorkerThread : 4

In WorkerThread

WorkerThread 4 Created!

Creating WorkerThread : 5

In WorkerThread

WorkerThread 5 Created!

Creating WorkerThread : 6

In WorkerThread

WorkerThread 6 Created!

Creating WorkerThread : 7

In WorkerThread

WorkerThread 7 Created!

Creating WorkerThread : 8

In WorkerThread

WorkerThread 8 Created!

Creating WorkerThread : 9

In WorkerThread

WorkerThread 9 Created!

Ordered to sleep for 0 seconds!

Finished sleeping for 0 seconds

Ordered to sleep for 1 seconds!

Ordered to sleep for 2 seconds!

Ordered to sleep for 3 seconds!

Ordered to sleep for 4 seconds!

Ordered to sleep for 5 seconds!

Ordered to sleep for 6 seconds!

Ordered to sleep for 7 seconds!

Ordered to sleep for 8 seconds!

Ordered to sleep for 9 seconds!

In WorkerThread

Finished sleeping for 1 seconds

Finished sleeping for 2 seconds

Finished sleeping for 3 seconds

Finished sleeping for 4 seconds

Finished sleeping for 5 seconds

Finished sleeping for 6 seconds

Finished sleeping for 7 seconds

Finished sleeping for 8 seconds

Finished sleeping for 9 seconds

All tasks over!

-----------------------------------------------------------------------------------------------------------

·        Create a list of FTP sites

·        Create a WorkerThread and Queue which can login to these sites and list the root directory and exit

·        Use 5 threads for this job and 10 FTP sites

·        There is a locking mechanism available in the Thread class which you can use to lock resources for dedicated use

·        Create a sample code to illustrate this concept

·        Explore the multiprocessing module in Python

·        How does it leverage multi-core setups?

·        Program the TCP SYN scanner using multiprocessing