scapy学习笔记（3）

在安装完scapy（前两篇笔记有介绍）后，linux环境下，执行sudo scapy运行scapy。

一、简单的发送包

1、send()在第三层发送数据包，但没有接收功能。如：

>>> send(IP(dst="www.baidu.com",ttl=1)/ICMP())

.

Sent 1 packets.

这里相当于ping了下百度，ttl=1

2、sendp()，在第二层发送数据包，同样没有接收功能。如：

>>> sendp(Ether()/IP(dst="www.baidu.com",ttl=1)/ICMP())

WARNING: Mac address to reach destination not found. Using broadcast.

.

Sent 1 packets.

>>> sendp(Ether()/IP(dst="127.0.0.1",ttl=1)/ICMP())

.

Sent 1 packets.

3、sr()，在第三层发送数据包，有接收功能。如：

>>> p=sr(IP(dst="www.baidu.com",ttl=1)/ICMP())

Begin emission:

..Finished to send 1 packets.

.*

Received 4 packets, got 1 answers, remaining 0 packets

>>> p

(<Results: TCP:0 UDP:0 ICMP:1 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:0 Other:0>)

>>> p[0]

<Results: TCP:0 UDP:0 ICMP:1 Other:0>

>>> p[0].show()

0000 IP / ICMP 27.214.222.160 > 61.135.169.105 echo-request 0 ==> IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror

再比如，连续发送ttl=1,2,3,4四个包的情况

>>> p=sr(IP(dst="www.baidu.com",ttl=(1,4))/ICMP())

Begin emission:

Finished to send 4 packets.

.*.*.*.*

Received 8 packets, got 4 answers, remaining 0 packets

>>> p

(<Results: TCP:0 UDP:0 ICMP:4 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:0 Other:0>)

>>> p[0].show()

0000 IP / ICMP 27.214.222.160 > 61.135.169.125 echo-request 0 ==> IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror

0001 IP / ICMP 27.214.222.160 > 61.135.169.125 echo-request 0 ==> IP / ICMP 222.132.4.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror

0002 IP / ICMP 27.214.222.160 > 61.135.169.125 echo-request 0 ==> IP / ICMP 119.190.5.126 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror

0003 IP / ICMP 27.214.222.160 > 61.135.169.125 echo-request 0 ==> IP / ICMP 112.253.4.197 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror

>>>

4、sr1(),在第三层发送数据包，有接收功能，但只接收第一个包。以上面的发送四个包为例：

>>> q=sr1(IP(dst="www.baidu.com",ttl=(1,4))/ICMP())

Begin emission:

Finished to send 4 packets.

.*.*.*.*

Received 8 packets, got 4 answers, remaining 0 packets

>>> q

<IP  version=4L ihl=5L tos=0xc0 len=56 id=4773 flags= frag=0L ttl=255 proto=icmp chksum=0xb611 src=27.214.220.1 dst=27.214.222.160 options=[] |<ICMP  type=time-exceeded code=ttl-zero-during-transit chksum=0xf4ff unused=0 |<IPerror  version=4L ihl=5L tos=0x0 len=28 id=1 flags= frag=0L ttl=1 proto=icmp chksum=0xd879 src=27.214.222.160 dst=61.135.169.105 options=[] |<ICMPerror  type=echo-request code=0 chksum=0xf7ff id=0x0 seq=0x0 |>>>>

>>> q.show()

###[ IP ]###

  version= 4L

  ihl= 5L

  tos= 0xc0

  len= 56

  id= 4773

  flags=

  frag= 0L

  ttl= 255

  proto= icmp

  chksum= 0xb611

  src= 27.214.220.1

  dst= 27.214.222.160

  \options\

###[ ICMP ]###

     type= time-exceeded

     code= ttl-zero-during-transit

     chksum= 0xf4ff

     unused= 0

###[ IP in ICMP ]###

        version= 4L

        ihl= 5L

        tos= 0x0

        len= 28

        id= 1

        flags=

        frag= 0L

        ttl= 1

        proto= icmp

        chksum= 0xd879

        src= 27.214.222.160

        dst= 61.135.169.105

        \options\

###[ ICMP in ICMP ]###

           type= echo-request

           code= 0

           chksum= 0xf7ff

           id= 0x0

           seq= 0x0

5、srloop()，在第三层工作，如下：

>>> p=srloop(IP(dst="www.baidu.com",ttl=1)/ICMP())

RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror

RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror

RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror

RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror

RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror

^C

Sent 5 packets, received 5 packets. 100.0% hits.

>>> p=srloop(IP(dst="www.baidu.com",ttl=1)/ICMP(),inter=3,count=2)

RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror

RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror

Sent 2 packets, received 2 packets. 100.0% hits.

这里第一条语句在执行时，将会不停的ping百度，第二条执行时每隔3秒ping一次，一共执行两次。inter表示间隔，count记录次数。

6、srp()、srp1()、srploop()与上面3、4、5相同，只是工作在第二层。

二、SYN扫描

SYN扫描：也叫“半开式扫描”（half-open scanning），因为它没有完成一个完整的TCP连接。这种方法向目标端口发送一个SYN分组（packet），如果目标端口返回SYN/ACK，那么可以肯定该端口处于检听状态；否则，返回的是RST/ACK。

>>> sr1(IP(dst="61.135.169.105")/TCP(dport=80,flags="S"))

Begin emission:

Finished to send 1 packets.

.*

Received 2 packets, got 1 answers, remaining 0 packets

<IP  version=4L ihl=5L tos=0x0 len=40 id=1 flags= frag=0L ttl=56 proto=tcp chksum=0xa168 src=61.135.169.105 dst=27.214.222.160 options=[] |<TCP  sport=http dport=ftp_data seq=3516051844L ack=1 dataofs=5L reserved=0L flags=SA window=8192 chksum=0x2aef urgptr=0 |>>

>>> sr1(IP(dst="61.135.169.105")/TCP(dport=81,flags="S"))

Begin emission:

Finished to send 1 packets.

.*

Received 2 packets, got 1 answers, remaining 0 packets

<IP  version=4L ihl=5L tos=0x0 len=56 id=31986 flags= frag=0L ttl=249 proto=icmp chksum=0xd677 src=123.125.248.102 dst=27.214.222.160 options=[] |<ICMP  type=dest-unreach code=communication-prohibited chksum=0xfc8d unused=0 |<IPerror  version=4L ihl=5L tos=0x0 len=40 id=1 flags= frag=0L ttl=56 proto=tcp chksum=0xa168 src=27.214.222.160 dst=61.135.169.105 options=[] |<TCPerror  sport=ftp_data dport=81 seq=0 |>>>>

从结果看，当扫描百度（61.135.169.105）的80端口时，返回的包中ACK＝1或者flags=SA，说明该端口处于监听状态，当扫描81端口时，无ACK＝1,或者flags=，说明其未处于监听状态。

如果要扫描多个端口，可以使用以下语句，如扫描百度的80－83端口：

>>>sr(IP(dst="www.baidu.com")/TCP(dport=(80,83),flags="S"))

如要扫描21，80，3389等端口：

>>>sr(IP(dst="www.baidu.com")/TCP(dport=[21,80,3389],flags="S"))

简单要显示结果：

>>>ans,unans=_

>>>ans.summary(lambda(s,r):r.sprintf("%TCP.sport% \t %TCP.flags%"))

http SA

81   RA

82   RA

83   RA

这里我在扫描80－83时，总是在不停的扫，用ctrl+C停止后，只能得到两个结果，目前没搞明白是什么原因。如下：

>>> sr(IP(dst="www.baidu.com",ttl=56)/TCP(dport=(80,83),flags="S"))

Begin emission:

Finished to send 4 packets.

.*.*.................................................................................

^C

Received 85 packets, got 2 answers, remaining 2 packets

(<Results: TCP:1 UDP:0 ICMP:1 Other:0>, <Unanswered: TCP:2 UDP:0 ICMP:0 Other:0>)

>>> ans,unans=_

>>> ans.summary()

IP / TCP 27.214.134.124:ftp_data > 61.135.169.105:http S ==> IP / TCP 61.135.169.105:http > 27.214.134.124:ftp_data SA

IP / TCP 27.214.134.124:ftp_data > 61.135.169.105:82 S ==> IP / ICMP 123.125.248.42 > 27.214.134.124 dest-unreach communication-prohibited / IPerror / TCPerror

>>> ans.summary(lambda(s,r):r.sprintf("%TCP.sport% \t %TCP.flags%"))

http      SA

??      ??

三、TCP traceroute

traceroute:用来追踪出发点到目的地所经过的路径,通过Traceroute我们可以知道信息从你的计算机到互联网另一端的主机是走的什么路径。当然每次数据包由某一同样的出发点（source）到达某一同样的目的地(destination)走的路径可能会不一样，但基本上来说大部分时候所走的路由是相同的。

>>> ans,unans=sr(IP(dst="www.baidu.com",ttl=(4,25),id=RandShort())/TCP(flags=0x2))

Begin emission:

...*.*.*.*.*.*.*.*.*.*.*Finished to send 22 packets.

.*.*.*.*.*.*.*.*.*.*....^C

Received 48 packets, got 21 answers, remaining 1 packets

>>> for snd,rcv in ans:

...     print snd.ttl,rcv.src,isinstance(rcv.payload,TCP)

...

4 112.253.4.177 False

5 219.158.98.221 False

6 124.65.194.22 False

7 124.65.58.182 False

8 123.125.248.42 False

9 61.135.169.105 True

10 61.135.169.105 True

11 61.135.169.105 True

12 61.135.169.105 True

13 61.135.169.105 True

14 61.135.169.105 True

15 61.135.169.105 True

16 61.135.169.105 True

17 61.135.169.105 True

18 61.135.169.105 True

19 61.135.169.105 True

20 61.135.169.105 True

21 61.135.169.105 True

22 61.135.169.105 True

23 61.135.169.105 True

24 61.135.169.105 True