Modbus Extensions

I was wondering if anybody had done a Modbus Extension for Scapy?  I am
currently working on one and was just looking to see if someone else had any
start to one.  I was also wondering if there is an easy way to resize a field. 
I receive a packet from a server copy it and change a couple fields around and
only two fields go from two bytes long to only a size byte and I did not know if
there is a way to change the size of the fields without using the variable
length field.  I tried to add just a different class and build the packet that
way but when I did that I always ended up getting an Ethernet trailer and the
packet was all messed up.

Thanks in advance,

Dustin

---------------------------------------------------------------------
To unsubscribe, send a mail to scapy.ml-unsubscribe <at> secdev.org

Capture result serveur

Dears,

I'm new in scapy world.
Can you give me an idea for capture response of POP server ?

First I'm connect to proxy
Second I'm connect to POP server

My code :

**********************************************************
from scapy.all import *
dst, dport, sport = "xxx.xxx.xxx.xxx", 8080, int(RandShort())
print "telnet proxy\r\n"
#SYN
syn = IP(dst = dst)/TCP(sport = sport, dport = dport, flags = 'S')

#Send SYN and receive  SYN/ACK
synack = sr1(syn, verbose=0)

#Send ACK
ack = IP(dst = dst)/TCP(sport = syn.sport, dport = dport, seq =
synack.ack, ack = synack.seq+1, flags = 'A')
send(ack, verbose=0)

print "CONNECT pop.xxx.xxx:110 HTTP/1.0\n"
C1 = IP(dst = dst)/TCP(sport = syn.sport, dport = dport, seq =
synack.ack, ack = synack.seq+1, flags = 'PA')/Raw(load = 'C')
rep1 = sr1(C1, verbose=0)

Scapy and SQLite3

Hello!

So, I'm beginner in Python, therefore please - 
don't scold me a long time...

I have one question: where can I find 
the definition of variable? For example, in 
fuzz() function there is the following code:
"""Transform a layer into a fuzzy layer by 
replacing some default values by random 
objects"""
    pdb.set_trace()
    if not _inplace:
        p = p.copy()
    q = p
...

And I can't find, what is the q (or p) variable? 
Which is its type and etc.

Thanks. 

---------------------------------------------------------------------
To unsubscribe, send a mail to scapy.ml-unsubscribe <at> secdev.org

IPv6 Network Security: from theory to practice with Scapy

Hi guys,

I will be giving a dojo at cansecwest on Tuesday March 6th
(http://cansecwest.com/dojos/2012/ipv6_netsec.html).

The dojo focuses on IPv6 network security and uses Scapy to present
examples of IPv6 packets and local attacks.

Guillaume

---------------------------------------------------------------------
To unsubscribe, send a mail to scapy.ml-unsubscribe <at> secdev.org

SNAP header with Q Tag

DHCPv6OptIAAddress Option extra field

Saving Session

dns query never response

IPv6 neighbor solicitations in scapy

Hi

I'm working with scapy to test some IPv6 stuff and I came to a situation 
where scapy didn't fill out the source MAC address field correctly (in 
my opinion).

The node running scapy has a simple IPv6 routing table:

> # ip -6 route show
> 2001:db8:fe20:100::1 dev eth1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
> fe80::/65 dev eth1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
> fe80::/64 dev eth0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
> fe80::/64 dev eth1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
> default via fe80::1 dev eth1  metric 1024  mtu 1500 advmss 1440 hoplimit 0

So packets which are sent to networks not directly connected should use 
the default gateway fe80::1

> # ip -6 neighbor show
> fe80::1 dev eth1 lladdr 00:05:73:a0:00:01 router STALE

and the destination MAC should be 00:05:73:a0:00:01, which is a MAC 
address used by Cisco routers speaking HSRP version 2. After looking in 
the scapy sources I found the function getmacbyip6() in inet6.py and 
executed a neighbor solicitaion used by this function with my values:

neighsol('fe80::1','fe80::1','eth1',0)

The dump of this neighbor solicitation has been put up at

http://www.cloudshark.org/captures/12766e13eb2d

As you can see the neighbor advertisement contains two different MAC 
addresses. One in the Ethernet Layer 2 which is always picked by scapy 
in getmacbyipb6

mac = res.src

and the second and correct one can be found in the ICMPv6 option.

As far as I understand RFC2461 the ICMPv6 option MAC address should 
always be used if it is there. Actually Linux does it this way as you 
can see in my "ip -6 neighbor show" output. So I think the code in scapy 
should be extended and the mac should always be set to res.lladdr and 
only to res.src if this fails.  My suggestion for the line above is:

try:
	mac = res.lladdr
except AttributeError:
	mac = res.src

With kind regards,
Uwe Weissenbacher

--

-- 

---------------------------------------------------------------------
To unsubscribe, send a mail to scapy.ml-unsubscribe <at> secdev.org

Ethernet Checkum

Scapy sniffing inactivity