Scapy/AP Scanner - Revision history

Admin at 04:05, 31 August 2016

2016-08-31T04:05:36Z

← Older revision		Revision as of 04:05, 31 August 2016
Line 199:		Line 199:


			=Flags=

	{{ScapyFlag}}		{{ScapyFlag}}

			{{WirelessFlag}}

Admin: /* The Code */

2016-01-24T20:25:36Z

The Code

← Older revision		Revision as of 20:25, 24 January 2016
Line 27:		Line 27:

	=The Code=		=The Code=

			<code>ap_scanner.py</code>

	{{Scroll box		{{Scroll box

Admin: /* The Summary */

2016-01-24T20:25:24Z

The Summary

← Older revision		Revision as of 20:25, 24 January 2016
Line 11:		Line 11:

	The main method then begins Scapy's sniffer, passing all packets through the sniffAP function.		The main method then begins Scapy's sniffer, passing all packets through the sniffAP function.

			To run the code, you will first need to put your wireless card into monitor mode:

			<pre>
			ifconfig wlan1 down
			iwconfig wlan1 mode monitor
			ifconfig wlan1 up
			</pre>

			then pass the same interface as an argument to the script:

			<pre>
			$ python ap_scanner.py wlan1
			</pre>

	=The Code=		=The Code=

Admin: /* Cleanup */

2016-01-24T20:20:06Z

Cleanup

← Older revision		Revision as of 20:20, 24 January 2016
Line 154:		Line 154:
	sys.exit(0)		sys.exit(0)
	</pre>		</pre>

			==Main Function==

			The main function prints out a header for information, sets up a listener for a Control-C, and begins the Scapy sniffer.

			<pre>
			if __name__ == "__main__":
			if len(sys.argv) != 2:
			print "Usage %s monitor_interface" % sys.argv[0]
			sys.exit(1)

			interface = sys.argv[1]

			# Print the program header
			print "-=-=-=-=-=-= AIROSCAPY =-=-=-=-=-=-"
			print "CH ENC BSSID SSID"

			# Start the channel hopper
			p = Process(target = channel_hopper)
			p.start()

			# Capture CTRL-C
			signal.signal(signal.SIGINT, signal_handler)

			# Start the sniffer
			sniff(iface=interface,prn=sniffAP)
			</pre>



			{{ScapyFlag}}

Admin: /* Packet Handling */

2016-01-24T20:19:02Z

Packet Handling

@@ Line 121: / Line 121: @@
          # Display discovered AP
          print "%02d  %s  %s %s" % (int(channel), enc, bssid, ssid)
 </pre>

Admin: /* The Code */

2016-01-24T20:16:45Z

The Code

← Older revision		Revision as of 20:16, 24 January 2016
Line 93:		Line 93:
	</source>		</source>
	}}		}}

			=The Pieces=

			Let's break down each piece.

			==Packet Handling==

			The <code>sniffAP()</code> function, which is passed to the Scapy sniff() function call, is used to process each packet.

			<pre>
			def sniffAP(p):
			if ( (p.haslayer(Dot11Beacon) or p.haslayer(Dot11ProbeResp))
			and not aps.has_key(p[Dot11].addr3)):
			ssid = p[Dot11Elt].info
			bssid = p[Dot11].addr3
			channel = int( ord(p[Dot11Elt:3].info))
			capability = p.sprintf("{Dot11Beacon:%Dot11Beacon.cap%}\
			{Dot11ProbeResp:%Dot11ProbeResp.cap%}")

			# Check for encrypted networks
			if re.search("privacy", capability): enc = 'Y'
			else: enc = 'N'

			# Save discovered AP
			aps[p[Dot11].addr3] = enc

			# Display discovered AP
			print "%02d %s %s %s" % (int(channel), enc, bssid, ssid)
			</pre>

Admin: /* The Code */

2016-01-24T20:07:25Z

The Code

← Older revision		Revision as of 20:07, 24 January 2016
Line 14:		Line 14:
	=The Code=		=The Code=

	<~~pre~~>		{{Scroll box
			\|
			<source lang="python">
	#!/usr/bin/env python		#!/usr/bin/env python
	# airoscapy.py - Wireless AP scanner based on scapy		# airoscapy.py - Wireless AP scanner based on scapy
Line 89:		Line 91:
	# Start the sniffer		# Start the sniffer
	sniff(iface=interface,prn=sniffAP)		sniff(iface=interface,prn=sniffAP)
	</~~pre~~>		</source>
			}}

Admin: Created page with "This shows an application of Scapy to create an AP scanner. This shows how to utilize Scapy to filter packets and look specifically for beacon packets. This code is authored..."

2016-01-24T20:06:23Z

Created page with "This shows an application of Scapy to create an AP scanner. This shows how to utilize Scapy to filter packets and look specifically for beacon packets. This code is authored..."

New page

This shows an application of Scapy to create an AP scanner. This shows how to utilize Scapy to filter packets and look specifically for beacon packets.

This code is authored by iphelix and is available here: http://www.thesprawl.org/projects/airoscapy/

=The Summary=

This script consists of three pieces:
* <code>sniffAP()</code> function, which processes packets and looks for beacons or probe responses
* <code>channel_hopper()</code> function, which hops from channel to channel, spending 1 second on each channel
* <code>signal_handler()</code> function, which cleans up at the end of the program and prints summary statistics

The main method then begins Scapy's sniffer, passing all packets through the sniffAP function.

=The Code=

<pre>
#!/usr/bin/env python
# airoscapy.py - Wireless AP scanner based on scapy
# version: 0.2
# Author: iphelix
import sys, os, signal
from multiprocessing import Process

from scapy.all import *

interface='' # monitor interface
aps = {} # dictionary to store unique APs

# process unique sniffed Beacons and ProbeResponses.
def sniffAP(p):
if ( (p.haslayer(Dot11Beacon) or p.haslayer(Dot11ProbeResp))
and not aps.has_key(p[Dot11].addr3)):
ssid = p[Dot11Elt].info
bssid = p[Dot11].addr3
channel = int( ord(p[Dot11Elt:3].info))
capability = p.sprintf("{Dot11Beacon:%Dot11Beacon.cap%}\
{Dot11ProbeResp:%Dot11ProbeResp.cap%}")

# Check for encrypted networks
if re.search("privacy", capability): enc = 'Y'
else: enc = 'N'

# Save discovered AP
aps[p[Dot11].addr3] = enc

# Display discovered AP
print "%02d %s %s %s" % (int(channel), enc, bssid, ssid)

# Channel hopper
def channel_hopper():
while True:
try:
channel = random.randrange(1,15)
os.system("iw dev %s set channel %d" % (interface, channel))
time.sleep(1)
except KeyboardInterrupt:
break

# Capture interrupt signal and cleanup before exiting
def signal_handler(signal, frame):
p.terminate()
p.join()

print "\n-=-=-=-=-= STATISTICS =-=-=-=-=-=-"
print "Total APs found: %d" % len(aps)
print "Encrypted APs : %d" % len([ap for ap in aps if aps[ap] =='Y'])
print "Unencrypted APs: %d" % len([ap for ap in aps if aps[ap] =='N'])

sys.exit(0)

if __name__ == "__main__":
if len(sys.argv) != 2:
print "Usage %s monitor_interface" % sys.argv[0]
sys.exit(1)

interface = sys.argv[1]

# Print the program header
print "-=-=-=-=-=-= AIROSCAPY =-=-=-=-=-=-"
print "CH ENC BSSID SSID"

# Start the channel hopper
p = Process(target = channel_hopper)
p.start()

# Capture CTRL-C
signal.signal(signal.SIGINT, signal_handler)

# Start the sniffer
sniff(iface=interface,prn=sniffAP)
</pre>