Added an arp ping detector
This commit is contained in:
DanMcInerney
4
README.md
Normal file
4
README.md
Normal file
@@ -0,0 +1,4 @@
|
||||
Don't forget to edit the userpass file with your details.
|
||||
|
||||
-h for help
|
||||
-p for promiscuous ping at the beginning
|
||||
225
arpdet.py
Executable file
225
arpdet.py
Executable file
@@ -0,0 +1,225 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
#Suppress scapy warnings, but not errors
|
||||
import logging
|
||||
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
|
||||
|
||||
#turn off the output for scapy functions with conf.verb
|
||||
from scapy.all import *
|
||||
conf.verb=0
|
||||
|
||||
import sys
|
||||
import time
|
||||
import os
|
||||
import smtplib
|
||||
import re
|
||||
import subprocess
|
||||
import commands
|
||||
bash = commands.getoutput
|
||||
import argparse
|
||||
|
||||
class colors:
|
||||
PURPLE = '\033[95m'
|
||||
OKBLUE = '\033[94m'
|
||||
OKGREEN = '\033[92m'
|
||||
WARNING = '\033[93m'
|
||||
FAIL = '\033[91m'
|
||||
ENDC = '\033[0m'
|
||||
|
||||
def disable(self):
|
||||
self.PURPLE = ''
|
||||
self.OKBLUE = ''
|
||||
self.OKGREEN = ''
|
||||
self.WARNING = ''
|
||||
self.FAIL = ''
|
||||
self.ENDC = ''
|
||||
|
||||
try:
|
||||
localIP = [x[4] for x in scapy.all.conf.route.routes if x[2] != '0.0.0.0'][0]
|
||||
except Exception:
|
||||
sys.exit(colors.WARNING+"[*]"+colors.ENDC+" No local IP found, check network connectivity")
|
||||
|
||||
IPandMAC = {}
|
||||
MAC = ""
|
||||
IPaddr = ""
|
||||
MAClist = []
|
||||
pktTime = []
|
||||
detectTimer = 0
|
||||
prefixIP = re.search('\d{2,3}\.\d{1,3}\.\d{1,3}\.', localIP).group()
|
||||
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("-p", "--promiscping", help="Start with a promiscuous ping scan", action="store_true")
|
||||
args = parser.parse_args()
|
||||
|
||||
#Example usage of colors
|
||||
#print bcolors.OKBLUE + "Check this out" + colors.ENDC
|
||||
try:
|
||||
from user_pass import user, passwd, rcpt
|
||||
except ImportError:
|
||||
print colors.WARNING+"[?]"+colors.ENDC+" Error importing user_pass. Are you sure its in this directory? Email won't send."
|
||||
|
||||
if args.promiscping == True:
|
||||
print colors.FAIL+"\n[!]"+colors.ENDC+" Possible promisucous mode enabled on the following clients: "
|
||||
ans,unans = promiscping(prefixIP+"*")
|
||||
|
||||
#Get the ESSID to match to iwlist scan "(.*?)" searches for all text between quotes
|
||||
essidcmd = bash('iwgetid')
|
||||
essid = re.search('"(.*?)"', essidcmd).group(1)
|
||||
|
||||
#Define interface in use and router IP
|
||||
routecmd = bash('ip route')
|
||||
routerinfo = re.search('default via (%s\d{1,3}) \w+ (\w[a-zA-Z0-9]\w[a-zA-Z0-9][0-9]?)' % prefixIP, routecmd)
|
||||
interface = routerinfo.group(2)
|
||||
routerIP = routerinfo.group(1)
|
||||
|
||||
ipalines=bash('ip addr').splitlines()
|
||||
for l in ipalines:
|
||||
macsearch = re.search(interface+":", l)
|
||||
if macsearch != None:
|
||||
indexof = ipalines.index(l)
|
||||
localMAC = re.search('([a-fA-F0-9]{2}[:|\-]?){6}', ipalines[indexof+1]).group()
|
||||
|
||||
#Define router MAC
|
||||
linelist=bash('iwlist scan').splitlines()
|
||||
startline=linelist.index(' ESSID:"%s"' % essid)
|
||||
routermac = re.search('([a-fA-F0-9]{2}[:|\-]?){6}', linelist[startline-5]).group()
|
||||
|
||||
#Populate the IPandMAC table with an arping
|
||||
if len(IPandMAC) == 0:
|
||||
ans,unans = arping(prefixIP+"*")
|
||||
devices = len(ans)
|
||||
for s,r in ans:
|
||||
IPandMAC[r.sprintf("%ARP.hwsrc%")] = r.sprintf("%ARP.psrc%")
|
||||
IPandMAC[localMAC] = localIP
|
||||
|
||||
#Print the known information
|
||||
print colors.OKBLUE+"\n[+]"+colors.ENDC+" Your device: "+colors.OKBLUE+interface+colors.ENDC+" at "+colors.OKBLUE+localIP+colors.ENDC+" with MAC "+colors.OKBLUE+localMAC+colors.ENDC
|
||||
print colors.OKBLUE+"[+]"+colors.ENDC+" Router: "+colors.OKBLUE+essid+colors.ENDC+" at "+colors.OKBLUE+routerIP+colors.ENDC+" with MAC "+colors.OKBLUE+routermac
|
||||
print "[+]"+colors.ENDC+" Number of devices on the local network:",colors.OKBLUE,devices+1,colors.ENDC
|
||||
ans.show()
|
||||
print localMAC, localIP, "\n"
|
||||
|
||||
#Send the email
|
||||
def smtp(msg):
|
||||
try:
|
||||
server = smtplib.SMTP('smtp.gmail.com:587')
|
||||
except Exception:
|
||||
print colors.PURPLE+"\n[?]"+colors.ENDC+" Contacting Gmail server failed, trying again..."
|
||||
try:
|
||||
server = smtplib.SMTP('smtp.gmail.com:587')
|
||||
except Exception:
|
||||
print colors.PURPLE+"[?]"+colors.ENDC+" Contacting Gmail server failed. Could not send notification."
|
||||
return
|
||||
|
||||
server.starttls()
|
||||
server.login(user,passwd)
|
||||
server.sendmail(user, rcpt, msg)
|
||||
|
||||
print colors.WARNING+"[*]"+colors.ENDC+" Email sent to "+colors.WARNING+rcpt+colors.ENDC+"\n"
|
||||
|
||||
def newdevices(pkt):
|
||||
print colors.WARNING+"[*]"+colors.ENDC+" New device joined the network"
|
||||
print colors.WARNING+"[*]"+colors.ENDC+" Device IP: "+colors.WARNING+IPaddr+colors.ENDC+" Device MAC: "+colors.WARNING+MAC
|
||||
print "[*]"+colors.ENDC+" Updated list of current or previously connected devices:\n"
|
||||
for k,v in IPandMAC.iteritems():
|
||||
print k,v
|
||||
if len(IPandMAC) > devices:
|
||||
newdevicemsg = "From: From Me <%s>\nTo: <%s>\nSubject:\n\nNew device joined network! IP: %s MAC: %s" % (user, rcpt, IPaddr, MAC)
|
||||
smtp(newdevicemsg)
|
||||
|
||||
#Launch the deauth packets and send the email
|
||||
def deauth(pkt):
|
||||
print colors.FAIL+"[!]"+colors.ENDC+" ARP spoof detected!"
|
||||
print colors.FAIL+"[!]"+colors.ENDC+" Attacker IP: "+colors.FAIL+IPandMAC[MAC]+colors.ENDC+" Attacker MAC: "+colors.FAIL+MAC+colors.ENDC
|
||||
|
||||
# Start monitor mode
|
||||
moncmd = bash('airmon-ng start %s' % interface)
|
||||
moniface = re.search('(mon[0-9])', moncmd).group()
|
||||
|
||||
print 'aireplay-ng -0 2 -a %s -c %s %s' % (routermac, MAC, moniface)
|
||||
deauthcmd = bash('aireplay-ng -0 1 -a %s -c %s %s' % (routermac, MAC, moniface))
|
||||
print deauthcmd
|
||||
|
||||
monexit = bash('airmon-ng stop %s' % moniface)
|
||||
|
||||
#Healing packet function here
|
||||
print colors.WARNING+"[*]"+colors.ENDC+" Sending healing packets"
|
||||
send(ARP(op=2, psrc=localIP, pdst=routerIP, hwdst="ff:ff:ff:ff:ff", hwsrc=localMAC), count=10)
|
||||
|
||||
#Send email
|
||||
arpdetmsg = "From: From Me <%s>\nTo: <%s>\nSubject:\nMIME-Version: 1.0\nContent-type: text/plain\n\nArp spoof detected! Attacker IP: %s Attacker MAC: %s" % (user, rcpt, IPandMAC[MAC], MAC)
|
||||
smtp(arpdetmsg)
|
||||
|
||||
#Reset the IPandMAC table
|
||||
IPandMAC[localMAC] = localIP
|
||||
|
||||
def arppingDet():
|
||||
|
||||
global pktTime
|
||||
global detectTimer
|
||||
global MAClist
|
||||
|
||||
pktTime.append(time.mktime(time.gmtime()))
|
||||
pktDif = [pktTime[i+1]-pktTime[i] for i in range(len(pktTime)-1)]
|
||||
MACcounter = 0
|
||||
timeCounter = 0
|
||||
|
||||
if len(MAClist) < 8:
|
||||
MAClist.append(MAC)
|
||||
for a in MAClist:
|
||||
if a == MAC:
|
||||
MACcounter += 1
|
||||
if MACcounter > 6:
|
||||
for b in pktDif:
|
||||
if b == 0:
|
||||
timeCounter += 1
|
||||
if timeCounter > 5:
|
||||
curTimer = time.mktime(time.gmtime())
|
||||
lastDet = curTimer - detectTimer
|
||||
if lastDet > 30:
|
||||
detectTimer = time.mktime(time.gmtime())
|
||||
print colors.FAIL+"[!]"+colors.ENDC+" ARP ping detected!"
|
||||
print colors.FAIL+"[!]"+colors.ENDC+" Attacker IP: "+colors.FAIL+IPandMAC[MAC]+colors.ENDC+" Attacker MAC: "+colors.FAIL+MAC+colors.ENDC
|
||||
arpPingmsg = "From: From Me <%s>\nTo: <%s>\nSubject:\n\nARP ping detected! IP: %s MAC: %s" % (user, rcpt, IPaddr, MAC)
|
||||
smtp(arpPingmsg)
|
||||
MACcounter = 0
|
||||
timeCounter = 0
|
||||
|
||||
else:
|
||||
MAClist = []
|
||||
pktDif = []
|
||||
pktTime = []
|
||||
|
||||
def monitor(pkt):
|
||||
|
||||
global IPaddr, MAC, detectTimer
|
||||
|
||||
#Fill in MAC and IPAddr variables. Sometimes it gets a packet where pkt.getlayer(ARP) is None, that's why MAC is wrapped in try
|
||||
if pkt.getlayer(ARP).psrc == None:
|
||||
return
|
||||
if pkt.getlayer(ARP).psrc == '00:00:00:00:00:00':
|
||||
return
|
||||
if pkt.getlayer(ARP).psrc == localIP:
|
||||
return
|
||||
MAC = pkt.getlayer(ARP).hwsrc
|
||||
if re.search(prefixIP, pkt.getlayer(ARP).psrc) == None:
|
||||
return
|
||||
IPaddr = pkt.getlayer(ARP).psrc
|
||||
|
||||
arppingDet()
|
||||
|
||||
#Check for arp spoof
|
||||
if MAC in IPandMAC:
|
||||
if IPaddr != IPandMAC[MAC]:
|
||||
deauth(pkt)
|
||||
else:
|
||||
IPandMAC[MAC] = IPaddr
|
||||
newdevices(pkt)
|
||||
|
||||
while 1:
|
||||
try:
|
||||
sniff(store=0, filter='arp', prn=monitor, iface=interface)
|
||||
except Exception:
|
||||
print Exception
|
||||
print colors.WARNING+"[!] "+colors.ENDC+"Network down, trying again in a minute."
|
||||
time.sleep(60)
|
||||
7
user_pass.py
Executable file
7
user_pass.py
Executable file
@@ -0,0 +1,7 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
#Don't forget to give this file 700 permissions to keep it safe
|
||||
|
||||
user='your-email@example.com'
|
||||
passwd='your-email-password'
|
||||
rcpt='recipient-email@example.com'
|
||||
Reference in New Issue
Block a user