Added arp ping detector

arpdet.py

@@ -16,8 +16,33 @@ import re
 import subprocess
 import commands
 bash = commands.getoutput
+<<<<<<< HEAD
 import argparse
 
+=======
+
+#user_pass contains the email to send from, the password to that email, and the recipient address
+try:
+	from user_pass import user, passwd, rcpt
+except ImportError:
+	print "[?] Error importing user_pass. Are you sure its in this directory? Email won't send."
+
+IPandMAC = {}
+prefixIP = ""
+essid = ""
+interface = ""
+routerip = ""
+devices = 0 
+localIP = ""
+localMAC = ""
+MAC = ""
+IPaddr = ""
+user=user
+passwd=passwd
+rcpt=rcpt
+
+#Save a few colors for the print function
+>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447
 class colors:
     PURPLE = '\033[95m'
     OKBLUE = '\033[94m'
@@ -34,6 +59,7 @@ class colors:
         self.FAIL = ''
         self.ENDC = ''
 
+<<<<<<< HEAD
 try:
 	localIP = [x[4] for x in scapy.all.conf.route.routes if x[2] != '0.0.0.0'][0]
 except Exception:
@@ -61,6 +87,17 @@ except ImportError:
 if args.promiscping == True:
 	print colors.FAIL+"\n[!]"+colors.ENDC+" Possible promisucous mode enabled on the following clients: "
 	ans,unans = promiscping(prefixIP+"*")
+=======
+#Example usage of colors
+#print bcolors.OKBLUE + "Check this out" + colors.ENDC
+localIP = [x[4] for x in scapy.all.conf.route.routes if x[2] != '0.0.0.0'][0]
+prefixIP = re.search('\d{2,3}\.\d{1,3}\.\d{1,3}\.', localIP).group()
+
+print colors.FAIL+"\n-----------------------------------------------------------------------------"
+print "[!]"+colors.ENDC+" Possible promisucous mode enabled on the following clients:\n"
+ans,unans = promiscping(prefixIP+"*")
+print colors.FAIL+"-----------------------------------------------------------------------------\n"+colors.ENDC
+>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447
 
 #Get the ESSID to match to iwlist scan "(.*?)" searches for all text between quotes
 essidcmd = bash('iwgetid')
@@ -70,7 +107,11 @@ essid = re.search('"(.*?)"', essidcmd).group(1)
 routecmd = bash('ip route')
 routerinfo = re.search('default via (%s\d{1,3}) \w+ (\w[a-zA-Z0-9]\w[a-zA-Z0-9][0-9]?)' % prefixIP, routecmd)
 interface = routerinfo.group(2)
+<<<<<<< HEAD
 routerIP = routerinfo.group(1)
+=======
+routerip = routerinfo.group(1)
+>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447
 
 ipalines=bash('ip addr').splitlines()
 for l in ipalines:
@@ -93,11 +134,21 @@ if len(IPandMAC) == 0:
 		IPandMAC[localMAC] = localIP
 
 #Print the known information
+<<<<<<< HEAD
 print colors.OKBLUE+"\n[+]"+colors.ENDC+" Your device: "+colors.OKBLUE+interface+colors.ENDC+" at "+colors.OKBLUE+localIP+colors.ENDC+" with MAC "+colors.OKBLUE+localMAC+colors.ENDC
 print colors.OKBLUE+"[+]"+colors.ENDC+" Router: "+colors.OKBLUE+essid+colors.ENDC+" at "+colors.OKBLUE+routerIP+colors.ENDC+" with MAC "+colors.OKBLUE+routermac
 print "[+]"+colors.ENDC+" Number of devices on the local network:",colors.OKBLUE,devices+1,colors.ENDC
 ans.show()
 print localMAC, localIP, "\n"
+=======
+print colors.OKBLUE+"-----------------------------------------------------------------------------"+colors.ENDC
+print colors.OKBLUE+"[+]"+colors.ENDC+" Your device: "+colors.OKBLUE+interface+colors.ENDC+" at "+colors.OKBLUE+localIP+colors.ENDC+" with MAC "+colors.OKBLUE+localMAC+colors.ENDC
+print colors.OKBLUE+"[+]"+colors.ENDC+" Router: "+colors.OKBLUE+essid+colors.ENDC+" at "+colors.OKBLUE+routerip+colors.ENDC+" with MAC "+colors.OKBLUE+routermac
+print "[+]"+colors.ENDC+" Number of devices on the local network:",colors.OKBLUE,devices+1,colors.ENDC+'\n'
+ans.show()
+print localMAC, localIP
+print colors.OKBLUE+"-----------------------------------------------------------------------------\n"+colors.ENDC
+>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447
 
 #Send the email
 def smtp(msg):
@@ -105,25 +156,36 @@ def smtp(msg):
 		server = smtplib.SMTP('smtp.gmail.com:587')
 	except Exception:
 		print colors.PURPLE+"\n[?]"+colors.ENDC+" Contacting Gmail server failed, trying again..."
+<<<<<<< HEAD
 	try:
 		server = smtplib.SMTP('smtp.gmail.com:587')
 	except Exception:
 		print colors.PURPLE+"[?]"+colors.ENDC+" Contacting Gmail server failed. Could not send notification."
 		return
+=======
+		server = smtplib.SMTP('smtp.gmail.com:587')
+>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447
 
 	server.starttls()
 	server.login(user,passwd)
 	server.sendmail(user, rcpt, msg)
 
+<<<<<<< HEAD
 	print colors.WARNING+"[*]"+colors.ENDC+" Email sent to "+colors.WARNING+rcpt+colors.ENDC+"\n"
 
 def newdevices(pkt):
+=======
+#Print the new device and new device list then email me the device information
+def newdevices(pkt):
+	print colors.WARNING+'-----------------------------------------------------------------------------'
+>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447
 	print colors.WARNING+"[*]"+colors.ENDC+" New device joined the network"
 	print colors.WARNING+"[*]"+colors.ENDC+" Device IP: "+colors.WARNING+IPaddr+colors.ENDC+" Device MAC: "+colors.WARNING+MAC
 	print "[*]"+colors.ENDC+" Updated list of current or previously connected devices:\n"
 	for k,v in IPandMAC.iteritems():
 		print k,v
 	if len(IPandMAC) > devices:
+<<<<<<< HEAD
 		newdevicemsg = "From: From Me <%s>\nTo: <%s>\nSubject:\n\nNew device joined network! IP: %s MAC: %s" % (user, rcpt, IPaddr, MAC)
 		smtp(newdevicemsg)
 
@@ -131,16 +193,40 @@ def newdevices(pkt):
 def deauth(pkt):
 	print colors.FAIL+"[!]"+colors.ENDC+" ARP spoof detected!"
 	print colors.FAIL+"[!]"+colors.ENDC+" Attacker IP: "+colors.FAIL+IPandMAC[MAC]+colors.ENDC+" Attacker MAC: "+colors.FAIL+MAC+colors.ENDC
+=======
+		#Trigger the email for joining network devices here
+		newdevicemsg = "From: From Me <%s>\nTo: <%s>\nSubject:\n\nNew device joined network! IP: %s MAC: %s" % (user, rcpt, IPaddr, MAC)
+		smtp(newdevicemsg)
+		print colors.WARNING+"\n[*]"+colors.ENDC+" Email sent to "+colors.WARNING+rcpt
+		print '-----------------------------------------------------------------------------\n'+colors.ENDC
+
+#Launch the deauth packets and send the email
+def deauth(pkt):
+	print colors.FAIL+'-----------------------------------------------------------------------------'
+	print "[!]"+colors.ENDC+" ARP spoof detected!"
+	print colors.FAIL+"[!]"+colors.ENDC+" Attacker IP: "+colors.FAIL+IPandMAC[MAC]+colors.ENDC+" Attacker MAC: "+colors.FAIL+MAC+colors.ENDC+"\n"
+>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447
 
 # Start monitor mode
 	moncmd = bash('airmon-ng start %s' % interface)
 	moniface = re.search('(mon[0-9])', moncmd).group()
 
 	print 'aireplay-ng -0 2 -a %s -c %s %s' % (routermac, MAC, moniface)
+<<<<<<< HEAD
+=======
+	################## PROBLEM HERE #### causes timeout so errors out timeout to send the email with smtp(arpdetmsg)
+	# Unfortunately when sending custom packet from scapy, it works, and when
+	# sending packet from other laptop it makes the variable server timeout!?
+	# Wireshark stops and says network interface failed whether sending from
+	# scapy or other laptop
+	# I wrapped it in try except and it works well, just take a long time on the
+	# first run
+>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447
 	deauthcmd = bash('aireplay-ng -0 1 -a %s -c %s %s' % (routermac, MAC, moniface))
 	print deauthcmd
 
 	monexit = bash('airmon-ng stop %s' % moniface)
+<<<<<<< HEAD
 
 	#Healing packet function here
 	print colors.WARNING+"[*]"+colors.ENDC+" Sending healing packets"
@@ -207,15 +293,51 @@ def monitor(pkt):
 	IPaddr = pkt.getlayer(ARP).psrc
 
 	arppingDet()
+=======
+	#Send email
+	#print "after monexit heres what email msg contains", user, rcpt, IPandMAC[MAC], MAC
+	arpdetmsg = "From: From Me <%s>\nTo: <%s>\nSubject:\nMIME-Version: 1.0\nContent-type: text/plain\n\nArp spoof detected! Attacker IP: %s Attacker MAC: %s" % (user, rcpt, IPandMAC[MAC], MAC)
+	smtp(arpdetmsg)
+	print colors.FAIL+"\n[!]"+colors.ENDC+" Email sent to "+colors.FAIL+rcpt
+	print '-----------------------------------------------------------------------------\n'+colors.ENDC
+
+
+###########################      MAIN LOOP      #######################
+
+def monitor(pkt):
+	global IPandMAC
+	global IPaddr, MAC
+
+	try:
+		MAC = pkt.getlayer(ARP).hwsrc
+	except Exception:
+		print "MAC = NONETYPE"
+		return
+	if MAC == None:
+		return
+	if MAC == '00:00:00:00:00:00':
+		return
+	IPaddr = pkt.getlayer(ARP).psrc
+	if re.search(prefixIP, IPaddr) == None:
+		return
+>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447
 
 	#Check for arp spoof
 	if MAC in IPandMAC:
 		if IPaddr != IPandMAC[MAC]:
+<<<<<<< HEAD
 			deauth(pkt) 
+=======
+
+			#Fire the packets
+			deauth(pkt) 
+
+>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447
 	else:
 		IPandMAC[MAC] = IPaddr
 		newdevices(pkt)
 
+<<<<<<< HEAD
 while 1:
 	try:
 		sniff(store=0, filter='arp', prn=monitor, iface=interface)
@@ -223,3 +345,30 @@ while 1:
 		print Exception
 		print colors.WARNING+"[!] "+colors.ENDC+"Network down, trying again in a minute."
 		time.sleep(60)
+=======
+sniff(store=0, filter='arp', prn=monitor, iface=interface)
+
+
+
+
+#NOTES
+
+#check if the transistor's network has DHCP offers and requests when devices join
+
+#Threading for the arp ping or to ping the router to test for connectivity
+
+#<omgimdrunk> fly-tri: time.sleep(5000)
+#<omgimdrunk> and threading is stupid simple, hang on i got a one liner
+#<pdtpatrick> or use something similar to eventmachine ?
+#<jorrit> Threading is not the good solution for this.
+#<jorrit> It rarely is.
+#<jorrit> Better use some event mechanism like twisted.
+#<omgimdrunk> import threading
+#<omgimdrunk> t = threadclass ()
+#<omgimdrunk> t.start
+
+#Read about Twisted for the regular interval arp ping, as well as inputing commands while script is running?
+#Read about curses for user input while the script is running
+
+#Look at pysnort
+>>>>>>> 9444156c44b0621f556b59aac415d6013adf9447