mirror of https://github.com/secdev/scapy.git
Spelling fixes in documentation
This commit is contained in:
Alex Chan
parent
0053196c26
commit
4459b5f2cf
|
|
@ -12,7 +12,7 @@ What is ASN.1?
|
|||
|
||||
This is only my view on ASN.1, explained as simply as possible. For more theoretical or academic views, I'm sure you'll find better on the Internet.
|
||||
|
||||
ASN.1 is a notation whose goal is to specify formats for data exchange. It is independant of the way data is encoded. Data encoding is specified in Encoding Rules.
|
||||
ASN.1 is a notation whose goal is to specify formats for data exchange. It is independent of the way data is encoded. Data encoding is specified in Encoding Rules.
|
||||
|
||||
The most used encoding rules are BER (Basic Encoding Rules) and DER (Distinguished Encoding Rules). Both look the same, but the latter is specified to guarantee uniqueness of encoding. This property is quite interesting when speaking about cryptography, hashes and signatures.
|
||||
|
||||
|
|
@ -739,7 +739,7 @@ When the automaton switches to a given state, the state's method is executed. Th
|
|||
Decorator for actions
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Actions are methods that are decorated by the return of ``ATMT.action`` function. This function takes the transition method it is bound to as first parameter and an optionnal priority ``prio`` as a second parameter. Default priority is 0. An action method can be decorated many times to be bound to many transitions.
|
||||
Actions are methods that are decorated by the return of ``ATMT.action`` function. This function takes the transition method it is bound to as first parameter and an optional priority ``prio`` as a second parameter. Default priority is 0. An action method can be decorated many times to be bound to many transitions.
|
||||
|
||||
::
|
||||
|
||||
|
|
|
|||
|
|
@ -26,10 +26,10 @@ of a field class::
|
|||
In this example, our layer has three fields. The first one is an 2 byte integer
|
||||
field named ``mickey`` and whose default value is 5. The second one is a 1 byte
|
||||
integer field named ``minnie`` and whose default value is 3. The difference between
|
||||
a vanilla ``ByteField`` and a ``XByteField`` is only the fact that the prefered human
|
||||
a vanilla ``ByteField`` and a ``XByteField`` is only the fact that the preferred human
|
||||
representation of the field’s value is in hexadecimal. The last field is a 4 byte
|
||||
integer field named ``donald``. It is different from a vanilla ``IntField`` by the fact
|
||||
that some of the possible values of the field have litterate representations. For
|
||||
that some of the possible values of the field have literate representations. For
|
||||
example, if it is worth 3, the value will be displayed as angry. Moreover, if the
|
||||
"cool" value is assigned to this field, it will understand that it has to take the
|
||||
value 2.
|
||||
|
|
@ -941,7 +941,7 @@ Variable length fields
|
|||
|
||||
This is about how fields that have a variable length can be handled with Scapy. These fields usually know their length from another field. Let's call them varfield and lenfield. The idea is to make each field reference the other so that when a packet is dissected, varfield can know its length from lenfield when a packet is assembled, you don't have to fill lenfield, that will deduce its value directly from varfield value.
|
||||
|
||||
Problems arise whe you realize that the relation between lenfield and varfield is not always straightforward. Sometimes, lenfield indicates a length in bytes, sometimes a number of objects. Sometimes the length includes the header part, so that you must substract the fixed header length to deduce the varfield length. Sometimes the length is not counted in bytes but in 16bits words. Sometimes the same lenfield is used by two different varfields. Sometimes the same varfield is referenced by two lenfields, one in bytes one in 16bits words.
|
||||
Problems arise when you realize that the relation between lenfield and varfield is not always straightforward. Sometimes, lenfield indicates a length in bytes, sometimes a number of objects. Sometimes the length includes the header part, so that you must subtract the fixed header length to deduce the varfield length. Sometimes the length is not counted in bytes but in 16bits words. Sometimes the same lenfield is used by two different varfields. Sometimes the same varfield is referenced by two lenfields, one in bytes one in 16bits words.
|
||||
|
||||
|
||||
The length field
|
||||
|
|
@ -966,7 +966,7 @@ The variable length field
|
|||
|
||||
A varfield can be: ``StrLenField``, ``PacketLenField``, ``PacketListField``, ``FieldListField``, ...
|
||||
|
||||
For the two firsts, whe a packet is being dissected, their lengths are deduced from a lenfield already dissected. The link is done using the ``length_from`` parameter, which takes a function that, applied to the partly dissected packet, returns the length in bytes to take for the field. For instance::
|
||||
For the two firsts, when a packet is being dissected, their lengths are deduced from a lenfield already dissected. The link is done using the ``length_from`` parameter, which takes a function that, applied to the partly dissected packet, returns the length in bytes to take for the field. For instance::
|
||||
|
||||
StrLenField("the_varfield", "the_default_value", length_from = lambda pkt: pkt.the_lenfield)
|
||||
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ This first example take an IP or a name as first parameter, send an ICMP echo re
|
|||
if p:
|
||||
p.show()
|
||||
|
||||
This is a more complex example which does an ARP ping and reports what it found with LaTeX formating::
|
||||
This is a more complex example which does an ARP ping and reports what it found with LaTeX formatting::
|
||||
|
||||
#! /usr/bin/env python
|
||||
# arping2tex : arpings a network and outputs a LaTeX table as a result
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ Overview
|
|||
1. Download and install *Scapy*.
|
||||
2. (For non-Linux platforms): Install *libpcap and libdnet* and their Python wrappers.
|
||||
3. (Optional): Install *additional software* for special features.
|
||||
4. Run Scapy with root priviledges.
|
||||
4. Run Scapy with root privileges.
|
||||
|
||||
Each of these steps can be done in a different way dependent on your platform and on the version of Scapy you want to use.
|
||||
|
||||
|
|
@ -147,7 +147,7 @@ Here are the topics involved and some examples that you can use to try if your i
|
|||
>>> p=IP()/ICMP()
|
||||
>>> p.pdfdump("test.pdf")
|
||||
|
||||
* Graphs. ``conversations()`` needs `Grapviz <http://www.graphviz.org/>`_ and `ImageMagick <http://www.imagemagick.org/>`_.
|
||||
* Graphs. ``conversations()`` needs `Graphviz <http://www.graphviz.org/>`_ and `ImageMagick <http://www.imagemagick.org/>`_.
|
||||
|
||||
.. code-block:: python
|
||||
|
||||
|
|
@ -395,7 +395,7 @@ For your convenience direct links are given to the versions I used (for Python 2
|
|||
|
||||
After all packages are installed, open a command prompt (cmd.exe) and run Scapy by typing ``scapy``. If you have set the PATH correctly, this will find a little batch file in your ``C:\Python26\Scripts`` directory and instruct the Python interpreter to load Scapy.
|
||||
|
||||
If really nothing seems to work, consider skipping the Windows version and using Scapy from a Linux Live CD -- either in a virtual machine on your Windows host or by booting from CDROM: An older version of Scapy is already included in grml and BackTrack for example. While using the Live CD you can easily upgrade to the lastest Scapy version by typing ``cd /tmp && wget scapy.net``.
|
||||
If really nothing seems to work, consider skipping the Windows version and using Scapy from a Linux Live CD -- either in a virtual machine on your Windows host or by booting from CDROM: An older version of Scapy is already included in grml and BackTrack for example. While using the Live CD you can easily upgrade to the latest Scapy version by typing ``cd /tmp && wget scapy.net``.
|
||||
|
||||
Optional packages
|
||||
^^^^^^^^^^^^^^^^^
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ On top of this can be build more high level functions, for example one that does
|
|||
What makes Scapy so special
|
||||
===========================
|
||||
|
||||
First, with most other networking tools, you won't build someting the author did not imagine. These tools have been built for a specific goal and can't deviate much from it. For example, an ARP cache poisoning program won't let you use double 802.1q encapsulation. Or try to find a program that can send, say, an ICMP packet with padding (I said *padding*, not *payload*, see?). In fact, each time you have a new need, you have to build a new tool.
|
||||
First, with most other networking tools, you won't build something the author did not imagine. These tools have been built for a specific goal and can't deviate much from it. For example, an ARP cache poisoning program won't let you use double 802.1q encapsulation. Or try to find a program that can send, say, an ICMP packet with padding (I said *padding*, not *payload*, see?). In fact, each time you have a new need, you have to build a new tool.
|
||||
|
||||
Second, they usually confuse decoding and interpreting. Machines are good at decoding and can help human beings with that. Interpretation is reserved to human beings. Some programs try to mimic this behaviour. For instance they say "*this port is open*" instead of "*I received a SYN-ACK*". Sometimes they are right. Sometimes not. It's easier for beginners, but when you know what you're doing, you keep on trying to deduce what really happened from the program's interpretation to make your own, which is hard because you lost a big amount of information. And you often end up using ``tcpdump -xX`` to decode and interpret what the tool missed.
|
||||
|
||||
|
|
@ -199,7 +199,7 @@ For a quick start, here's an overview of Python's data types:
|
|||
* ``list`` (mutable): ``[4,2,"1"]``
|
||||
* ``dict` (mutable): ``{ "one":1 , "two":2 }``
|
||||
|
||||
There are no block delimiters in Python. Instead, indendation does matter::
|
||||
There are no block delimiters in Python. Instead, indentation does matter::
|
||||
|
||||
if cond:
|
||||
instr
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ The kernel is not aware of what Scapy is doing behind his back. If Scapy sends a
|
|||
I can't ping 127.0.0.1. Scapy does not work with 127.0.0.1 or on the loopback interface
|
||||
---------------------------------------------------------------------------------------
|
||||
|
||||
The loopback interface is a very special interface. Packets going through it are not really assembled and dissassembled. The kernel routes the packet to its destination while it is still stored an internal structure. What you see with tcpdump -i lo is only a fake to make you think everything is normal. The kernel is not aware of what Scapy is doing behind his back, so what you see on the loopback interface is also a fake. Except this one did not come from a local structure. Thus the kernel will never receive it.
|
||||
The loopback interface is a very special interface. Packets going through it are not really assembled and disassembled. The kernel routes the packet to its destination while it is still stored an internal structure. What you see with tcpdump -i lo is only a fake to make you think everything is normal. The kernel is not aware of what Scapy is doing behind his back, so what you see on the loopback interface is also a fake. Except this one did not come from a local structure. Thus the kernel will never receive it.
|
||||
|
||||
In order to speak to local applications, you need to build your packets one layer upper, using a PF_INET/SOCK_RAW socket instead of a PF_PACKET/SOCK_RAW (or its equivalent on other systems that Linux)::
|
||||
|
||||
|
|
@ -32,7 +32,7 @@ traceroute() does not work. I'm on a ppp link
|
|||
|
||||
This is a known bug. See BPF filters do not work. I'm on a ppp link
|
||||
|
||||
To work arround this, use ``nofilter=1``::
|
||||
To work around this, use ``nofilter=1``::
|
||||
|
||||
>>> traceroute("target", nofilter=1)
|
||||
|
||||
|
|
@ -66,4 +66,4 @@ There's a low traffic mailing list at ``scapy.ml(at)secdev.org`` (`archive <htt
|
|||
|
||||
|
||||
|
||||
To avoid spam, you must subscribe to the mailing list to post.
|
||||
To avoid spam, you must subscribe to the mailing list to post.
|
||||
|
|
|
|||
|
|
@ -152,7 +152,7 @@ str(pkt) assemble the packet
|
|||
hexdump(pkt) have an hexadecimal dump
|
||||
ls(pkt) have the list of fields values
|
||||
pkt.summary() for a one-line summary
|
||||
pkt.show() for a developped view of the packet
|
||||
pkt.show() for a developed view of the packet
|
||||
pkt.show2() same as show but on the assembled packet (checksum is calculated, for instance)
|
||||
pkt.sprintf() fills a format string with fields values of the packet
|
||||
pkt.decode_payload_as() changes the way the payload is decoded
|
||||
|
|
@ -166,7 +166,7 @@ pkt.command() return a Scapy command that can generate the packet
|
|||
Generating sets of packets
|
||||
--------------------------
|
||||
|
||||
For the moment, we have only generated one packet. Let see how to specify sets of packets as easily. Each field of the whole packet (ever layers) can be a set. This implicidely define a set of packets, generated using a kind of cartesian product between all the fields.
|
||||
For the moment, we have only generated one packet. Let see how to specify sets of packets as easily. Each field of the whole packet (ever layers) can be a set. This implicitly define a set of packets, generated using a kind of cartesian product between all the fields.
|
||||
|
||||
::
|
||||
|
||||
|
|
@ -201,7 +201,7 @@ Command Effect
|
|||
summary() displays a list of summaries of each packet
|
||||
nsummary() same as previous, with the packet number
|
||||
conversations() displays a graph of conversations
|
||||
show() displays the prefered representation (usually nsummary())
|
||||
show() displays the preferred representation (usually nsummary())
|
||||
filter() returns a packet list filtered with a lambda function
|
||||
hexdump() returns a hexdump of all packets
|
||||
hexraw() returns a hexdump of the Raw layer of all packets
|
||||
|
|
@ -243,7 +243,7 @@ Fuzzing
|
|||
.. index::
|
||||
single: fuzz(), fuzzing
|
||||
|
||||
The function fuzz() is able to change any default value that is not to be calculated (like checksums) by an object whose value is random and whose type is adapted to the field. This enables to quicky built fuzzing templates and send them in loop. In the following example, the IP layer is normal, and the UDP and NTP layers are fuzzed. The UDP checksum will be correct, the UDP destination port will be overloaded by NTP to be 123 and the NTP version will be forced to be 4. All the other ports will be randomized::
|
||||
The function fuzz() is able to change any default value that is not to be calculated (like checksums) by an object whose value is random and whose type is adapted to the field. This enables to quickly built fuzzing templates and send them in loop. In the following example, the IP layer is normal, and the UDP and NTP layers are fuzzed. The UDP checksum will be correct, the UDP destination port will be overloaded by NTP to be 123 and the NTP version will be forced to be 4. All the other ports will be randomized::
|
||||
|
||||
>>> send(IP(dst="target")/fuzz(UDP()/NTP(version=4)),loop=1)
|
||||
................^C
|
||||
|
|
@ -349,7 +349,7 @@ Classic SYN Scan can be initialized by executing the following command from Scap
|
|||
|
||||
>>> sr1(IP(dst="72.14.207.99")/TCP(dport=80,flags="S"))
|
||||
|
||||
The above will send a single SYN packet to Google's port 80 and will quit after receving a single response::
|
||||
The above will send a single SYN packet to Google's port 80 and will quit after receiving a single response::
|
||||
|
||||
Begin emission:
|
||||
.Finished to send 1 packets.
|
||||
|
|
@ -638,7 +638,7 @@ We can sniff and do passive OS fingerprinting::
|
|||
(0.875, ['Linux 2.4.2 - 2.4.14 (1)', 'Linux 2.4.10 (1)', 'Windows 98 (?)'])
|
||||
(1.0, ['Windows 2000 (9)'])
|
||||
|
||||
The number before the OS guess is the accurracy of the guess.
|
||||
The number before the OS guess is the accuracy of the guess.
|
||||
|
||||
Filters
|
||||
-------
|
||||
|
|
@ -677,7 +677,7 @@ Send and receive in a loop
|
|||
.. index::
|
||||
single: srloop()
|
||||
|
||||
Here is an example of a (h)ping-like functionnality : you always send the same set of packets to see if something change::
|
||||
Here is an example of a (h)ping-like functionality : you always send the same set of packets to see if something change::
|
||||
|
||||
>>> srloop(IP(dst="www.target.com/30")/TCP())
|
||||
RECV 1: Ether / IP / TCP 192.168.11.99:80 > 192.168.8.14:20 SA / Padding
|
||||
|
|
@ -878,7 +878,7 @@ Routing
|
|||
.. index::
|
||||
single: Routing, conf.route
|
||||
|
||||
Now scapy has its own routing table, so that you can have your packets routed diffrently than the system::
|
||||
Now scapy has its own routing table, so that you can have your packets routed differently than the system::
|
||||
|
||||
>>> conf.route
|
||||
Network Netmask Gateway Iface
|
||||
|
|
@ -1089,7 +1089,7 @@ Similarly, filtered ports can be found with unanswered packets::
|
|||
Xmas Scan
|
||||
---------
|
||||
|
||||
Xmas Scan can be launced using the following command::
|
||||
Xmas Scan can be launched using the following command::
|
||||
|
||||
>>> ans,unans = sr(IP(dst="192.168.1.1")/TCP(dport=666,flags="FPU") )
|
||||
|
||||
|
|
@ -1356,7 +1356,7 @@ Identifying rogue DHCP servers on your LAN
|
|||
Problem
|
||||
^^^^^^^
|
||||
|
||||
You suspect that someone has installed an additional, unauthorized DHCP server on your LAN -- either unintentiously or maliciously.
|
||||
You suspect that someone has installed an additional, unauthorized DHCP server on your LAN -- either unintentionally or maliciously.
|
||||
Thus you want to check for any active DHCP servers and identify their IP and MAC addresses.
|
||||
|
||||
Solution
|
||||
|
|
|
|||
Loading…
Reference in New Issue