Forge a DNS response - networking

I use scapy to intercept DNS request and forge a response. The interception and forging parts work fine, and it seems that the sending of the forged packet works (at least I can see the dot indicating the success of the sendp function). But, on the target station I don't receive the packet -- or I don't see it on Wireshark.
I don't know where my problem is, but I guess it is not in the DNS/UDP part (the packet would be visible in Wireshark). So it's probably in the 802.11 or IP layers.
Here is a request:
192.168.2.117 (a4:4e:31:5c:54:78) -> 194.2.0.50 (00:14:d1:ad:9f:88)
DNS request for www.youtube.com.
###[ RadioTap dummy ]###
version = 0
pad = 0
len = 38
present = TSFT+Flags+Rate+Channel+dBm_AntSignal+b14+b29+Ext
notdecoded= ' \x08\x00\xa0 \x08\x00\x00\xc8+\xa3\x10\x00\x00\x00\x00\x10l\x9e\t\xc0\x00\xd5\x00\x00\x00\xcd\x00\xd4\x01'
###[ 802.11 ]###
subtype = 8L
type = Data
proto = 0L
FCfield = to-DS
ID = 11264
addr1 = 00:14:d1:ad:9f:88
addr2 = a4:4e:31:5c:54:78
addr3 = 00:25:9c:9a:aa:b1
SC = 4272
addr4 = None
###[ 802.11 QoS ]###
TID = 0L
EOSP = 0L
Ack Policy= 0L
Reserved = 0L
TXOP = 0
###[ LLC ]###
dsap = 0xaa
ssap = 0xaa
ctrl = 3
###[ SNAP ]###
OUI = 0x0
code = 0x800
###[ IP ]###
version = 4L
ihl = 5L
tos = 0x0
len = 61
id = 213
flags =
frag = 0L
ttl = 128
proto = udp
chksum = 0xb489
src = 192.168.2.117
dst = 194.2.0.50
\options \
###[ UDP ]###
sport = 50648
dport = domain
len = 41
chksum = 0x7b3c
###[ DNS ]###
id = 64118
qr = 0L
opcode = QUERY
aa = 0L
tc = 0L
rd = 1L
ra = 0L
z = 0L
rcode = ok
qdcount = 1
ancount = 0
nscount = 0
arcount = 0
\qd \
|###[ DNS Question Record ]###
| qname = 'www.youtube.com.'
| qtype = A
| qclass = IN
an = None
ns = None
ar = None
###[ Padding ]###
load = '\xb2\x17\xa3\x8a'
And the forged response:
###[ RadioTap dummy ]###
version = 0
pad = 0
len = 38
present = TSFT+Flags+Rate+Channel+dBm_AntSignal+b14+b29+Ext
notdecoded= ' \x08\x00\xa0 \x08\x00\x00\xc8+\xa3\x10\x00\x00\x00\x00\x10l\x9e\t\xc0\x00\xd5\x00\x00\x00\xcd\x00\xd4\x01'
###[ 802.11 ]###
subtype = 8L
type = Data
proto = 0L
FCfield = from-DS
ID = 11264
addr1 = a4:4e:31:5c:54:78
addr2 = 00:14:d1:ad:9f:88
addr3 = 00:25:9c:9a:aa:b1
SC = 14272
addr4 = None
###[ 802.11 QoS ]###
TID = 0L
EOSP = 0L
Ack Policy= 0L
Reserved = 0L
TXOP = 0
###[ LLC ]###
dsap = 0xaa
ssap = 0xaa
ctrl = 3
###[ SNAP ]###
OUI = 0x0
code = 0x800
###[ IP ]###
version = 4L
ihl = 5L
tos = 0x0
len = None
id = 213
flags =
frag = 0L
ttl = 128
proto = udp
chksum = None
src = 194.2.0.50
dst = 192.168.2.117
\options \
###[ UDP ]###
sport = domain
dport = 50648
len = None
chksum = None
###[ DNS ]###
id = 64118
qr = 1L
opcode = QUERY
aa = 0L
tc = 0L
rd = 1L
ra = 1L
z = 0L
rcode = ok
qdcount = 1
ancount = 1
nscount = 0
arcount = 0
\qd \
|###[ DNS Question Record ]###
| qname = 'www.youtube.com.'
| qtype = A
| qclass = IN
\an \
|###[ DNS Resource Record ]###
| rrname = 'www.youtube.com.'
| type = A
| rclass = IN
| ttl = 900
| rdlen = 4
| rdata = '192.168.2.100'
ns = None
ar = None
###[ Padding ]###
load = '\xb2\x17\xa3\x8a'
I tried to check with a valid DNS response, I don't see any difference explaining my problem. I tried to modify the ID and SC fields, but it doesn't change anything. The addr3 doesn't change.
Do you see an error explaining why the target doesn't receive it?

Well, the length of your IP response is 'None'. That would not go well in processing. :) That's the obvious thing that stands out. Also, your overall length at the top doesn't change, even though you've added data.
I'm not sure what sport/dport = domain means; I'm assuming those are port 53.
The IP ID fields should be generally be different in the query/response, but that wouldn't impact your results here.

Related

Issue with SMTP lib in python3.6

I have a strange issue with my python monitoring script:-
I've written a script with a number of alerts for any server. In that I have a function that gathers Network bytes/sec in and out.
Now the issue is when I print the alert outside my mail function it prints the current output, but for some reason when it triggers the mail for the alert, the mail body is empty. If I trigger the mail with another alert which isn't in the Network function it works properly.
Also is there a way to get smtplib to use port 587 instead of 465, any pointers on formatting the alert would be appreciated too.
Please find my script below:-
#!/usr/bin/env python3
#Module psutil needs to be installed via pip3 first.
#Python script to Monitor Server Resources.
import time
import psutil
import smtplib
from email.message import EmailMessage
project_and_instance_name = 'test-stage' #Edit the name of the project name and environment
sender = '<sender email>' #Email Address of the sender
receivers = ['recepient email'] #comma seperated list of recipients enclosed in ''
cpu_thresh = 50.0
cpu_pct = psutil.cpu_percent(interval=1)
if cpu_pct >= cpu_thresh:
cpu_alert = "CPU Warning, CPU at ",cpu_pct, "percent"
else:
cpu_alert = ""
mem = psutil.virtual_memory()
mem_thresh = 1024 * 1024 * 1024 #change the end value to choose the amount of MB
if mem_thresh >= mem.available:
mem_alert = "Memory Usage Warning only", round((mem.available /1024 /1024), 2), "MB available"
else:
mem_alert = ""
partition1 = '/'
disk1 = psutil.disk_usage(partition1)
disk_thresh = 85.0
if disk_thresh <= disk1[3]:
disk_alert = f"Root volume usage warning {disk1[3]} % used"
else:
disk_alert = ""
def net_usage(inf = "eth0"): #change the inf variable according to the interface
global net_in_alert
global net_out_alert
net_in_ps1 = psutil.net_io_counters(pernic=True, nowrap=True)[inf]
net_in_1 = net_in_ps1.bytes_recv
net_out_1 = net_in_ps1.bytes_sent
time.sleep(1)
net_in_ps2 = psutil.net_io_counters(pernic=True, nowrap=True)[inf]
net_in_2 = net_in_ps2.bytes_recv
net_out_2 = net_in_ps2.bytes_sent
net_in_res = round((net_in_2 - net_in_1) /1024 /1024, 2)
net_out_res = round((net_out_2 - net_out_1) /1024 /1024, 2)
net_in_thresh = 1.5
net_out_thresh = 1.5
if net_in_res >= net_in_thresh:
net_in_alert = f"Current net-usage:IN: {net_in_res} MB/s"
else:
net_in_alert = ""
if net_out_res <= net_out_thresh:
net_out_alert = f"Current net-usage:OUT: {net_out_res} MB/s"
else:
net_out_alert = ""
net_usage()
message_list = []
if cpu_alert == "" :
pass
else:
message_list.append(cpu_alert)
if mem_alert == "" :
pass
else:
message_list.append(mem_alert)
if disk_alert == "" :
pass
else:
message_list.append(disk_alert)
if net_in_alert == "" :
pass
else:
message_list.append(net_in_alert)
if net_out_alert == "" :
pass
else:
message_list.append(net_out_alert)
msg = '\n'.join(message_list)
print(msg)
def alerts():
server = smtplib.SMTP_SSL('smtp.gmail.com', 465)
server.login(sender, "<password>")
server.sendmail(sender,receivers,msg)
if msg == "":
pass
else:
alerts()
Got the answer by changing the SMTP format for any who are stuck here's the code:-
#!/usr/bin/env python3
#Module psutil needs to be installed via pip3 first.
#Python script to Monitor Server Resources.
import time
import psutil
import smtplib, ssl
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
project_and_instance_name = 'test-stage' #Edit the name of the project name and environment
sender = '<senders email>' #Email Address of the sender
receivers = ['recepient email'] #comma seperated list of recipients enclosed in ''
cpu_thresh = 50.0
cpu_pct = psutil.cpu_percent(interval=1)
if cpu_pct >= cpu_thresh:
cpu_alert = "CPU Warning, CPU at ",cpu_pct, "percent"
else:
cpu_alert = ""
mem = psutil.virtual_memory()
mem_thresh = 1024 * 1024 * 1024 #change the end value to choose the amount of MB
if mem_thresh >= mem.available:
mem_alert = "Memory Usage Warning only", round((mem.available /1024 /1024), 2), "MB available"
else:
mem_alert = ""
partition1 = '/'
disk1 = psutil.disk_usage(partition1)
disk_thresh = 85.0
if disk_thresh <= disk1[3]:
disk_alert = f"Root volume usage warning {disk1[3]} % used"
else:
disk_alert = ""
def net_usage(inf = "eth0"): #change the inf variable according to the interface
global net_in_alert
global net_out_alert
net_in_ps1 = psutil.net_io_counters(pernic=True, nowrap=True)[inf]
net_in_1 = net_in_ps1.bytes_recv
net_out_1 = net_in_ps1.bytes_sent
time.sleep(1)
net_in_ps2 = psutil.net_io_counters(pernic=True, nowrap=True)[inf]
net_in_2 = net_in_ps2.bytes_recv
net_out_2 = net_in_ps2.bytes_sent
net_in_res = round((net_in_2 - net_in_1) /1024 /1024, 2)
net_out_res = round((net_out_2 - net_out_1) /1024 /1024, 2)
net_in_thresh = 1.5
net_out_thresh = 1.5
if net_in_res >= net_in_thresh:
net_in_alert = f"Current net-usage:IN: {net_in_res} MB/s"
else:
net_in_alert = ""
if net_out_res >= net_out_thresh:
net_out_alert = f"Current net-usage:OUT: {net_out_res} MB/s"
else:
net_out_alert = ""
net_usage()
message_list = []
if cpu_alert == "" :
pass
else:
message_list.append(cpu_alert)
if mem_alert == "" :
pass
else:
message_list.append(mem_alert)
if disk_alert == "" :
pass
else:
message_list.append(disk_alert)
if net_in_alert == "" :
pass
else:
message_list.append(net_in_alert)
if net_out_alert == "" :
pass
else:
message_list.append(net_out_alert)
msg = '\n'.join(message_list)
print(msg)
def alerts():
msg_template = MIMEMultipart()
msg_template['From'] = sender
msg_template['To'] = ', '.join(receivers)
msg_template['Subject'] = f"{project_and_instance_name} Alert"
msg_template.attach(MIMEText(msg, 'plain'))
server = smtplib.SMTP('smtp.gmail.com', 587)
server.ehlo()
server.starttls()
server.ehlo()
server.login(sender, "<password>")
server.sendmail(sender,receivers,msg_template.as_string())
server.quit()
if msg == "":
pass
else:
alerts()
Something helpful for me in understanding this answer -
receivers is a list of emails
receivers = ['email1', 'email2']
message template ["To"] is a joined string
msg_template['To'] = ', '.join(receivers)
server.sendmail() is the list of emails
server.sendmail(sender,receivers,msg_template.as_string())

putting letters with number inside lua variables

I have this Nginx lua code which is used to encrypt numbers from 0 to 9 with its equivalent encrypted code ... ( see the example below )
and its working great , but i want to make it also encrypt Letters from A to Z.
I'm not familiar with lua so i don't know what is the best way to make it works !
content_by_lua_block {
local bf = {}
bf[0] = '(((_<<_)<<_)'
bf[1] = '(({}>[])-(()>[]))'
bf[2] = '(({}>[])-(()>[]))])'
bf[3] = '(({}>[])-(()>[]))])*'
bf[4] = '(({}>[])-(()>[]))])*(()>[])'
bf[5] = '(({}>[])-(()>[]))])*(()>[])%'
bf[6] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_'
bf[7] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_'
bf[8] = '(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))'
bf[9] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))'
local cookie = ngx.var.token
for i=0, 9 do
cookie = string.gsub(cookie, i, "'+"..bf[i].."+'")
end
Maybe something like that :
content_by_lua_block {
local bf = {}
bf[0] = '(((_<<_)<<_)'
bf[1] = '(({}>[])-(()>[]))'
bf[2] = '(({}>[])-(()>[]))])'
bf[3] = '(({}>[])-(()>[]))])*'
bf[4] = '(({}>[])-(()>[]))])*(()>[])'
bf[5] = '(({}>[])-(()>[]))])*(()>[])%'
bf[6] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_'
bf[7] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_'
bf[8] = '(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))'
bf[9] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))'
bf[a] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))(()>[])%'
bf[b] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))(()>[])%(()>[])%'
bf[c] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))(()>[])%(()>[])%(()>[])%'
...................
...................
...................
...................
bf[z] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))(()>[])%(()>[])%(()>[])%)%(()>[])%)%(()>[])%'
local cookie = ngx.var.token
for i=0, 9 and a, z do
cookie = string.gsub(cookie, i, "'+"..bf[i].."+'")
end
I tried to rewrite your code:
local bf = {}
bf[0] = '(((_<<_)<<_)'
bf[1] = '(({}>[])-(()>[]))'
bf[2] = '(({}>[])-(()>[]))])'
bf[3] = '(({}>[])-(()>[]))])*'
bf[4] = '(({}>[])-(()>[]))])*(()>[])'
bf[5] = '(({}>[])-(()>[]))])*(()>[])%'
bf[6] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_'
bf[7] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_'
bf[8] = '(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))'
bf[9] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))'
bf['a'] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))(()>[])%'
bf['b'] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))(()>[])%(()>[])%'
bf['c'] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))(()>[])%(()>[])%(()>[])%'
--
--
--
bf['z'] = '(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))(()>[])%(()>[])%(()>[])%)%(()>[])%)%(()>[])%'
local cookie = "01sdz" -- ngx.var.token
-- first example
local cookie = cookie:gsub ( '.', function (x)
local s = tonumber(x) or x
if bf[s] then return "'+".. bf[s] .."+'"
else return x
end
end )
print(cookie)
-- second example
cookie = "01sdz"
for i=0, 9 do
cookie = string.gsub(cookie, i, "'+".. bf[i] .."+'")
-- may be use bf[i]:gsub( '([%%])', '%%%1') with escape escaping symbol %
end
for i= string.byte('a'), string.byte('z') do
local v = bf[string.char(i)]
if v then
cookie = cookie:gsub( string.char(i), "'+".. v:gsub( '([%%])', '%%%1') .."+'")
end
end
print(cookie)
result
'+(((_<<_)<<_)+''+(({}>[])-(()>[]))+'sd'+(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))(()>[])%(()>[])%(()>[])%)%(()>[])%)%(()>[])%+'
'+(((_<<_)<<_)+''+(({}>[])-(()>[]))+'sd'+(({}>[])-(()>[]))])*(()>[])%(((_<<_)<<_)+((_<<_)*_))(()>[])%(()>[])%(()>[])%)%(()>[])%)%(()>[])%+'
I updated my code, anyway the second example will help you

How to use NuSMV to witness the man-in-the-middle attack (Needham-Schroeder protocol)?

I have the following simplified public-key Needham-Schroeder protocol:
A → B: {Na, A} Kb
B → A: {Na, Nb} Ka
A → B: {Nb} Kb
where Na, Nb are the nonces of A, B, and Ka, Kb are the public keys of A, B respectively.
Messages encrypted by a party’s public key can only be decrypted by the party.
At Step (1), A initiates the protocol by sending a nonce and its identity (encrypted by B’s public key) to B. Using its private key, B deciphers the message and gets A’s identity.
At Step (2), B sends A’s and its nonces (encrypted by A’s public key) back to A. Using its private key, A decodes the message and checks its nonce is returned.
At Step (3), A returns B’s nonce (encrypted by B’s public key) back to B.
Here is the main-in-the-middle attack to the above simplified protocol:
(1A) A → E: {Na, A} Ke (A wants to talk to E)
(1B) E → B: {Na, A} Kb (E wants to convince B that it is A)
(2B) B → E: {Na, Nb} Ka (B returns nonces encrypted by Ka)
(2A) E → A: {Na, Nb} Ka (E forwards the encrypted message to A)
(3A) A → E: {Nb} Ke (A confirms it is talking to E)
(3B) E → B: {Nb} Kb (E returns B’s nonce back)
I hope that when the attack was found, a fix was proposed to prevent the attack (B sends its identity along with the nonces back to A):
A → B: {Na, A} Kb
B → A: {Na, Nb, B} Ka (B sends its identity along with the nonces back to A)
A → B: {Nb} Kb
The questions are:
How can I write an LTL formula and a NuSMV module eve to model the attacker and witness the man-in-the middle attack?
How to prevents the attack?
The process of alice(A):
MODULE alice (in0, in1, inkey, out0, out1, outkey)
VAR
st : { request, wait, attack, finish };
nonce : { NONE, Na, Nb, Ne };
ASSIGN
init (st) := request;
next (st) := case
st = request : wait;
st = wait & in0 = Na & inkey = Ka : attack;
st = attack : finish;
TRUE : st;
esac;
init (nonce) := NONE;
next (nonce) := case
st = wait & in0 = Na & inkey = Ka : in1;
TRUE : nonce;
esac;
init (out0) := NONE;
next (out0) := case
st = request : Na;
st = attack : nonce;
TRUE : out0;
esac;
init (out1) := NOONE;
next (out1) := case
st = request : Ia;
st = attack : NOONE;
TRUE : out1;
esac;
init (outkey) := NOKEY;
next (outkey) := case
st = request : { Kb };
TRUE : outkey;
esac;
FAIRNESS running;
The process of bob(B):
MODULE bob (in0, in1, inkey, out0, out1, outkey)
VAR
st : { wait, receive, confirm, done };
nonce : { NONE, Na, Nb, Ne };
other : { NOONE, Ia, Ib, Ie };
ASSIGN
init (st) := wait;
next (st) := case
st = wait & in0 = Na & in1 = Ia & inkey = Kb : receive;
st = wait & in0 = Ne & in1 = Ie & inkey = Kb : receive;
st = receive : confirm;
st = confirm & in0 = Nb & in1 = NOONE & inkey = Kb : done;
TRUE : st;
esac;
init (nonce) := NONE;
next (nonce) := case
st = wait & in0 = Na & in1 = Ia & inkey = Kb : in0;
st = wait & in0 = Ne & in1 = Ie & inkey = Kb : in0;
TRUE : nonce;
esac;
init (other) := NOONE;
next (other) := case
st = wait & in0 = Na & in1 = Ia & inkey = Kb : in1;
st = wait & in0 = Ne & in1 = Ie & inkey = Kb : in1;
TRUE : other;
esac;
init (out0) := NONE;
next (out0) := case
st = confirm : nonce;
TRUE : out0;
esac;
init (out1) := NONE;
next (out1) := case
st = confirm : Nb;
TRUE : out1;
esac;
init (outkey) := NOKEY;
next (outkey) := case
st = confirm & other = Ia : Ka;
st = confirm & other = Ie : Ke;
TRUE : outkey;
esac;
FAIRNESS running;
The process of main:
MODULE main
VAR
a_in0 : { NONE, Na, Nb, Ne };
a_in1 : { NONE, Na, Nb, Ne };
a_out0 : { NONE, Na, Nb, Ne };
a_out1 : { NOONE, Ia, Ib, Ie };
a_inkey : { NOKEY, Ka, Kb, Ke };
a_outkey : { NOKEY, Ka, Kb, Ke };
a : process alice (a_in0, a_in1, a_inkey, a_out0, a_out1, a_outkey);
b : process bob (a_out0, a_out1, a_outkey, a_in0, a_in1, a_inkey);
FAIRNESS running;
LTLSPEC F (a.st = finish & b.st = done)
Thanks a lot!
(note: modeling and verifying the system you have in mind with some other tool (e.g. Spin or the STIATE Toolkit) would be much more simple.)
Alice and Bob.
Here we model the type of user that behaves in a honest, transparent manner and that in your use-case can be instantiated as either Alice or Bob.
As a simplification, i hard-coded the fact that if the user is Alice then it will initiate the protocol by trying to contact the other entity.
The inputs my_nonce, my_id and my_key define a user's identity, whereas other_key and other_id represent the publicly available information about the other user we want to get in touch with. Inputs in_1, in_2 and in_k are just like in your code example, whereas in_3 is reserved for exchanging the third value used in the patched version of the protocol.
A user can be in one of five states:
IDLE: initial state, Alice will initiate the protocol whereas Bob waits for some request.
WAIT_RESPONSE: when Alice waits to a response to her request
WAIT_CONFIRMATION: when Bob waits to a confirmation to his response
OK: when Alice and Bob handshake has been successful
ERROR: when something goes wrong in the handshake (e.g. unexpected inputs)
A user can perform one of the following actions:
SEND_REQUEST: {Na, IA} Kb
SEND_RESPONSE: {Na, Nb} Ka
SEND_CONFIRMATION: {Nb} Kb
As a simplification, similarly to your own model, I made output values persistent along several transitions instead of putting them back immediately to NONE. In this way, I don't have to add extra variables to keep track of input values before they are resetted.
MODULE user(patched, my_nonce, my_id, my_key, other_key, other_id, in_1, in_2, in_3, in_k)
VAR
state : { IDLE, WAIT_RESPONSE, WAIT_CONFIRMATION, OK, ERROR };
action : { NONE, SEND_REQUEST, SEND_RESPONSE, SEND_CONFIRMATION };
out_1 : { NONE, NA, NB, NE, IA, IB, IE };
out_2 : { NONE, NA, NB, NE, IA, IB, IE };
out_3 : { NONE, NA, NB, NE, IA, IB, IE };
out_k : { NONE, KA, KB, KE };
INIT
state = IDLE & action = NONE & out_1 = NONE
& out_2 = NONE & out_3 = NONE & out_k = NONE;
-- protocol actions defining outputs
TRANS
next(action) = SEND_REQUEST -> (
next(out_1) = my_nonce & next(out_2) = my_id &
next(out_3) = NONE & next(out_k) = other_key
);
TRANS
((next(action) = SEND_RESPONSE) & patched) -> (
next(out_1) = in_1 & next(out_2) = my_nonce &
next(out_3) = my_id & next(out_k) = other_key
);
TRANS
((next(action) = SEND_RESPONSE) & !patched) -> (
next(out_1) = in_1 & next(out_2) = my_nonce &
next(out_3) = NONE & next(out_k) = other_key
);
TRANS
next(action) = SEND_CONFIRMATION -> (
next(out_1) = in_2 & next(out_2) = NONE &
next(out_3) = NONE & next(out_k) = other_key
);
-- outputs stabilization: easier modeling
TRANS
next(action) = NONE -> (
next(out_1) = out_1 & next(out_2) = out_2 &
next(out_3) = out_3 & next(out_k) = out_k
);
-- protocol life-cycle
TRANS
case
-- protocol: end-positions
(action = NONE &
state = ERROR)
: next(action) = NONE &
next(state) = ERROR;
(action = NONE &
state = OK)
: next(action) = NONE &
next(state) = OK;
-- protocol: send request
(action = NONE &
state = IDLE &
my_id = IA)
: next(action) = SEND_REQUEST &
next(state) = WAIT_RESPONSE;
-- protocol: handle request
(action = NONE &
state = IDLE &
in_k = my_key)
: next(action) = SEND_RESPONSE &
next(state) = WAIT_CONFIRMATION;
-- protocol: handle response
-- without patch
(action = NONE &
state = WAIT_RESPONSE &
in_k = my_key &
in_1 = my_nonce &
!patched)
: next(action) = SEND_CONFIRMATION &
next(state) = OK;
-- with patch
(action = NONE &
state = WAIT_RESPONSE &
in_k = my_key &
in_1 = my_nonce &
in_3 = other_id &
patched)
: next(action) = SEND_CONFIRMATION &
next(state) = OK;
-- protocol: handle confirmation
(action = NONE &
state = WAIT_CONFIRMATION &
in_k = my_key &
in_1 = my_nonce)
: next(action) = NONE &
next(state) = OK;
-- protocol: no change state while performing action
(action != NONE)
: next(action) = NONE &
next(state) = state;
-- protocol: no state change if no valid input
(action = NONE &
in_k != my_key)
: next(action) = NONE &
next(state) = state;
-- sink error condition for malformed inputs
TRUE
: next(action) = NONE &
next(state) = ERROR;
esac;
We add a very simple main module and a simple CTL property to check that Alice and Bob behave in the expected way and are able to complete the handshake in normal circumstances:
MODULE main
VAR
a1 : process user(FALSE, NA, IA, KA, KB, IB, b1.out_1, b1.out_2, b1.out_3, b1.out_k);
b1 : process user(FALSE, NB, IB, KB, KA, IA, a1.out_1, a1.out_2, a1.out_3, a1.out_k);
FAIRNESS running;
CTLSPEC ! EF (a1.state = OK & b1.state = OK);
The output is the following one:
NuSMV > reset; read_model -i ns01.smv ; go ; check_property
...
-- specification !(EF (a1.state = OK & b1.state = OK)) is false
-- as demonstrated by the following execution sequence
Trace Description: CTL Counterexample
Trace Type: Counterexample
-> State: 1.1 <-
a1.state = IDLE
a1.action = NONE
a1.out_1 = NONE
a1.out_2 = NONE
a1.out_3 = NONE
a1.out_k = NONE
b1.state = IDLE
b1.action = NONE
b1.out_1 = NONE
b1.out_2 = NONE
b1.out_3 = NONE
b1.out_k = NONE
-> Input: 1.2 <-
_process_selector_ = main
running = TRUE
b1.running = FALSE
a1.running = FALSE
-> State: 1.2 <-
a1.state = WAIT_RESPONSE
a1.action = SEND_REQUEST
a1.out_1 = NA
a1.out_2 = IA
a1.out_k = KB
-> Input: 1.3 <-
-> State: 1.3 <-
a1.action = NONE
b1.state = WAIT_CONFIRMATION
b1.action = SEND_RESPONSE
b1.out_1 = NA
b1.out_2 = NB
b1.out_k = KA
-> Input: 1.4 <-
-> State: 1.4 <-
a1.state = OK
a1.action = SEND_CONFIRMATION
a1.out_1 = NB
a1.out_2 = NONE
b1.action = NONE
-> Input: 1.5 <-
-> State: 1.5 <-
a1.action = NONE
b1.state = OK
Alice, Bob and Eve.
In order to model our attack scenario, we first need to model the attacker. This is very similar to Alice and Bob, only that it has double inputs and outputs so that it can communicate with both Alice and Bob at the same time.
Its design is very similar to that of Alice and Bob, so I won't spend many words on it. As a simplification, i removed any error checking on the attacker, since it does not actually have any meaningful reason to fail in the use-case scenario being considered. Not doing so would complicate the code for no good reason.
MODULE attacker(my_nonce, my_id, my_key, a_key, b_key,
ain_1, ain_2, ain_3, ain_k,
bin_1, bin_2, bin_3, bin_k)
VAR
state : { IDLE, WAIT_RESPONSE, WAIT_CONFIRMATION, OK, ERROR };
action : { NONE, SEND_REQUEST, SEND_RESPONSE, SEND_CONFIRMATION };
aout_1 : { NONE, NA, NB, NE, IA, IB, IE };
aout_2 : { NONE, NA, NB, NE, IA, IB, IE };
aout_3 : { NONE, NA, NB, NE, IA, IB, IE };
aout_k : { NONE, KA, KB, KE };
bout_1 : { NONE, NA, NB, NE, IA, IB, IE };
bout_2 : { NONE, NA, NB, NE, IA, IB, IE };
bout_3 : { NONE, NA, NB, NE, IA, IB, IE };
bout_k : { NONE, KA, KB, KE };
INIT
state = IDLE & action = NONE &
aout_1 = NONE & aout_2 = NONE & aout_3 = NONE & aout_k = NONE &
bout_1 = NONE & bout_2 = NONE & bout_3 = NONE & bout_k = NONE;
-- protocol actions defining outputs
TRANS
-- attacker: forward A secrets to B
next(action) = SEND_REQUEST -> (
next(aout_1) = NONE & next(aout_2) = NONE &
next(aout_3) = NONE & next(aout_k) = NONE &
next(bout_1) = ain_1 & next(bout_2) = ain_2 &
next(bout_3) = ain_3 & next(bout_k) = b_key
);
TRANS
-- attacker: forward B response to A (cannot be unencripted)
next(action) = SEND_RESPONSE -> (
next(aout_1) = bin_1 & next(aout_2) = bin_2 &
next(aout_3) = bin_3 & next(aout_k) = bin_k &
next(bout_1) = NONE & next(bout_2) = NONE &
next(bout_3) = NONE & next(bout_k) = NONE
);
TRANS
-- attacker: send confirmation to B
next(action) = SEND_CONFIRMATION -> (
next(aout_1) = NONE & next(aout_2) = NONE &
next(aout_3) = NONE & next(aout_k) = NONE &
next(bout_1) = ain_1 & next(bout_2) = NONE &
next(bout_3) = NONE & next(bout_k) = b_key
);
-- outputs stabilization: easier modeling
TRANS
next(action) = NONE -> (
next(aout_1) = aout_1 & next(aout_2) = aout_2 &
next(aout_3) = aout_3 & next(aout_k) = aout_k &
next(bout_1) = bout_1 & next(bout_2) = bout_2 &
next(bout_3) = bout_3 & next(bout_k) = bout_k
);
-- attack life-cycle
TRANS
case
-- attack: end-positions
(action = NONE &
state = ERROR)
: next(action) = NONE &
next(state) = ERROR;
(action = NONE &
state = OK)
: next(action) = NONE &
next(state) = OK;
-- attack: handle request, send forged request
(action = NONE &
state = IDLE &
ain_k = my_key)
: next(action) = SEND_REQUEST &
next(state) = WAIT_RESPONSE;
-- attack: handle response, forward undecryptable response
(action = NONE &
state = WAIT_RESPONSE &
bin_k = a_key)
: next(action) = SEND_RESPONSE &
next(state) = WAIT_CONFIRMATION;
-- attack: handle confirmation, send confirmation
(action = NONE &
state = WAIT_CONFIRMATION &
ain_k = my_key)
: next(action) = SEND_CONFIRMATION &
next(state) = OK;
-- attack: simple catch-all control no error checking
TRUE
: next(action) = NONE &
next(state) = state;
esac;
Again, we add a very simple main module and a simple CTL property to check that Eve is able to successfully attack Alice and Bob.. at the end of it, Alice thinks to be talking to Eve (as it is) and Bob thinks to be talking with Alice when it's truly talking with Eve.
MODULE main
VAR
a2 : process user(FALSE, NA, IA, KA, KE, IE, e2.aout_1, e2.aout_2, e2.aout_3, e2.aout_k);
b2 : process user(FALSE, NB, IB, KB, KA, IA, e2.bout_1, e2.bout_2, e2.bout_3, e2.bout_k);
e2 : process attacker(NE, IE, KE, KA, KB,
a2.out_1, a2.out_2, a2.out_3, a2.out_k,
b2.out_1, b2.out_2, b2.out_3, b2.out_k);
FAIRNESS running;
CTLSPEC ! EF (a2.state = OK & b2.state = OK & e2.state = OK);
The output follows:
NuSMV > reset; read_model -i ns02.smv ; go ; check_property
...
-- specification !(EF ((a2.state = OK & b2.state = OK) & e2.state = OK)) is false
-- as demonstrated by the following execution sequence
Trace Description: CTL Counterexample
Trace Type: Counterexample
-> State: 1.1 <-
a2.state = IDLE
a2.action = NONE
a2.out_1 = NONE
a2.out_2 = NONE
a2.out_3 = NONE
a2.out_k = NONE
b2.state = IDLE
b2.action = NONE
b2.out_1 = NONE
b2.out_2 = NONE
b2.out_3 = NONE
b2.out_k = NONE
e2.state = IDLE
e2.action = NONE
e2.aout_1 = NONE
e2.aout_2 = NONE
e2.aout_3 = NONE
e2.aout_k = NONE
e2.bout_1 = NONE
e2.bout_2 = NONE
e2.bout_3 = NONE
e2.bout_k = NONE
-> Input: 1.2 <-
_process_selector_ = main
running = TRUE
e2.running = FALSE
b2.running = FALSE
a2.running = FALSE
-> State: 1.2 <-
a2.state = WAIT_RESPONSE
a2.action = SEND_REQUEST
a2.out_1 = NA
a2.out_2 = IA
a2.out_k = KE
-> Input: 1.3 <-
-> State: 1.3 <-
a2.action = NONE
e2.state = WAIT_RESPONSE
e2.action = SEND_REQUEST
e2.bout_1 = NA
e2.bout_2 = IA
e2.bout_k = KB
-> Input: 1.4 <-
-> State: 1.4 <-
b2.state = WAIT_CONFIRMATION
b2.action = SEND_RESPONSE
b2.out_1 = NA
b2.out_2 = NB
b2.out_k = KA
e2.action = NONE
-> Input: 1.5 <-
-> State: 1.5 <-
b2.action = NONE
e2.state = WAIT_CONFIRMATION
e2.action = SEND_RESPONSE
e2.aout_1 = NA
e2.aout_2 = NB
e2.aout_k = KA
e2.bout_1 = NONE
e2.bout_2 = NONE
e2.bout_k = NONE
-> Input: 1.6 <-
-> State: 1.6 <-
a2.state = OK
a2.action = SEND_CONFIRMATION
a2.out_1 = NB
a2.out_2 = NONE
e2.action = NONE
-> Input: 1.7 <-
-> State: 1.7 <-
a2.action = NONE
e2.state = OK
e2.action = SEND_CONFIRMATION
e2.aout_1 = NONE
e2.aout_2 = NONE
e2.aout_k = NONE
e2.bout_1 = NB
e2.bout_k = KB
-> Input: 1.8 <-
-> State: 1.8 <-
b2.state = OK
e2.action = NONE
Patched Alice, Bob and Eve.
Luckily, I already sneaked the patched version of Alice and Bob in the code that I have already shown. So, all that it remains to do is to check that the patch meets the desired behavior by writing a new main that combines Alice, Bob and Eve together:
MODULE main
VAR
a3 : process user(TRUE, NA, IA, KA, KE, IE, e3.aout_1, e3.aout_2, e3.aout_3, e3.aout_k);
b3 : process user(TRUE, NB, IB, KB, KA, IA, e3.bout_1, e3.bout_2, e3.bout_3, e3.bout_k);
e3 : process attacker(NE, IE, KE, KA, KB,
a3.out_1, a3.out_2, a3.out_3, a3.out_k,
b3.out_1, b3.out_2, b3.out_3, b3.out_k);
FAIRNESS running;
CTLSPEC ! EF (a3.state = OK & b3.state = OK & e3.state = OK);
CTLSPEC ! EF (a3.state = ERROR & b3.state = ERROR);
The output follows:
NuSMV > reset; read_model -i ns03.smv ; go ; check_property
...
-- specification !(EF ((a3.state = OK & b3.state = OK) & e3.state = OK)) is true
-- specification !(EF (a3.state = ERROR & b3.state = ERROR)) is false
-- as demonstrated by the following execution sequence
Trace Description: CTL Counterexample
Trace Type: Counterexample
-> State: 1.1 <-
a3.state = IDLE
a3.action = NONE
a3.out_1 = NONE
a3.out_2 = NONE
a3.out_3 = NONE
a3.out_k = NONE
b3.state = IDLE
b3.action = NONE
b3.out_1 = NONE
b3.out_2 = NONE
b3.out_3 = NONE
b3.out_k = NONE
e3.state = IDLE
e3.action = NONE
e3.aout_1 = NONE
e3.aout_2 = NONE
e3.aout_3 = NONE
e3.aout_k = NONE
e3.bout_1 = NONE
e3.bout_2 = NONE
e3.bout_3 = NONE
e3.bout_k = NONE
-> Input: 1.2 <-
_process_selector_ = main
running = TRUE
e3.running = FALSE
b3.running = FALSE
a3.running = FALSE
-> State: 1.2 <-
a3.state = WAIT_RESPONSE
a3.action = SEND_REQUEST
a3.out_1 = NA
a3.out_2 = IA
a3.out_k = KE
-> Input: 1.3 <-
-> State: 1.3 <-
a3.action = NONE
e3.state = WAIT_RESPONSE
e3.action = SEND_REQUEST
e3.bout_1 = NA
e3.bout_2 = IA
e3.bout_k = KB
-> Input: 1.4 <-
-> State: 1.4 <-
b3.state = WAIT_CONFIRMATION
b3.action = SEND_RESPONSE
b3.out_1 = NA
b3.out_2 = NB
b3.out_3 = IB
b3.out_k = KA
e3.action = NONE
-> Input: 1.5 <-
-> State: 1.5 <-
b3.action = NONE
e3.state = WAIT_CONFIRMATION
e3.action = SEND_RESPONSE
e3.aout_1 = NA
e3.aout_2 = NB
e3.aout_3 = IB
e3.aout_k = KA
e3.bout_1 = NONE
e3.bout_2 = NONE
e3.bout_k = NONE
-> Input: 1.6 <-
-> State: 1.6 <-
a3.state = ERROR
e3.action = NONE
-> Input: 1.7 <-
-> State: 1.7 <-
e3.state = OK
e3.action = SEND_CONFIRMATION
e3.aout_1 = NONE
e3.aout_2 = NONE
e3.aout_3 = NONE
e3.aout_k = NONE
e3.bout_1 = NA
e3.bout_k = KB
-> Input: 1.8 <-
-> State: 1.8 <-a
b3.state = ERROR
e3.action = NONE
The first property confirms that the attack fails and the handshake is not completed for neither Alice nor Bob because Eve does not fulfil it. The second property shows how the attack is attempted and how it fails in practice.

how do i get http data from a site by scapy

i know its a dumb question. but belive me - i searched i all the internet and i didnt got any answer.
first of all, there is my code:
def Make_Get():
synR = IP(dst = 'www.google.com', ttl = 64)/TCP(dport = 80, flags = 'S')
synAckAN = sr1(synR)
getStr = 'GET /index.html HTTP/1.0 \n\n'
req = (IP(dst = 'www.google.com', ttl = 64)/TCP(dport = 80, sport = synAckAN[TCP].dport, seq = synAckAN[TCP].ack, ack = synAckAN[TCP].seq+1, flags = 'A')/getStr)
ans, unans = sr(req)
return ans, unans
when i run this function and tring to print the "ans" (first parameter) - its giving me an answer without the data.
look:
Received 1 packets, got 1 answers, remaining 0 packets
###[ IP ]###
version = 4L
ihl = 5L
tos = 0x0
len = 40
id = 9784
flags =
frag = 0L
ttl = 128
proto = tcp
chksum = 0xc02f
src = 216.58.210.4
dst = 192.168.233.128
\options \
###[ TCP ]###
sport = http
dport = ftp_data
seq = 2116250139
ack = 28
dataofs = 5L
reserved = 0L
flags = A
window = 64240
chksum = 0x77bc
urgptr = 0
options = {}
###[ Padding ]###
load = '\x00\x00\x00\x00\x00\x00'
None
there is no any data.......
but when i sniffed the transmition in Wireshark, i'd got an html code in a packet.
my question is - how can i send a Get request like i did, and save the html code from the site (to print it, or to a file.. doesnt metter..)
I'd highly recommend using scapy-http, which is a scapy extension that helps you support HTTP.

One Esp8266 Client One Esp8266 Server

I did Server-Client Application with lua using one Esp8266. I wanna do this with two Esp8266. I wanna use one of these Esp8266 is Server and the other other one is Client. You can see below first code using for get RSSI from one AP and second code is using for writing these RSSI in a Server. How can i placed these two codes in two Esp8266?
i=5
tmr.alarm(1,10000,1, function()
print(wifi.sta.getap(scan_cfg, 1, listap))
if i>1 then
print(i)
i=i-1
else
tmr.stop(1)
print("Timer Durdu")
end
end
)
function listap(t)
for bssid,v in pairs(t) do
local ssid = string.match(v, "([^,]+)")
l=string.format("%-10s",ssid)
stringtoarray = {}
index = 1
for value in string.gmatch(v,"%w+") do
stringtoarray [index] = value
index = index + 1
end
print(l)
print(stringtoarray[2])
end
end
scan_cfg = {}
scan_cfg.ssid = "VSP250s"
scan_cfg.bssid = "00:09:df:8e:03:b4"
scan_cfg.channel = 0
scan_cfg.show_hidden = 1
Second code:
srv=net.createServer(net.TCP)
srv:listen(80,function(conn)
conn:on("receive", function(client,request)
local buf = "";
local _, _, method, path, vars = string.find(request, "([A-Z]+) (.+)?(.+) HTTP");
if(method == nil)then
_, _, method, path = string.find(request, "([A-Z]+) (.+) HTTP");
end
local _GET = {}
if (vars ~= nil)then
for k, v in string.gmatch(vars, "(%w+)=(%w+)&*") do
_GET[k] = v
end
end
buf = buf.."<!DOCTYPE html><html><div id='container'><font size='5'>"
buf = buf..'<style>body{width:auto;height:auto;background-color:#ffffff;}'
buf = buf..'.button {font-size: 20px;}</style>'
buf = buf.."<head> <meta http-equiv='refresh' content=3> "
buf = buf.."<p><h1>RSSI meter<br> ESP8266</h1>";
--buf = buf.."<p>Refresh : <button class='button'>ON</button>&nbsp</p>";
--buf = buf.."<p>Relay Switch : <button class='button'>ON</button>  "
--buf = buf.."<button class='button'>OFF</button><br>"
buf = buf..'<B>Voltage :<font color=red>'..string.format('%s',l)..' V</font></b><br>'
buf = buf..'<B>Current :<B><font color=blue>'..string.format('%g',stringtoarray[2])..' A</font></b><br>'
--buf = buf..'<B>Power Consumption :<B><font color=DeepSkyBlue>'..'Not Available'..'</font></b><br><BR>'
-- buf = buf..'<p>Function Button :<B><font color=BlueViolet>'..button_status..'</font></b><br></p>';
buf = buf..'</head>'
buf = buf..'<br><br><details><summary><font color=red>BURAK IPEK</font><p>'
buf = buf..'<summary><p>Vestel Electronics </p></details>'
buf = buf.."</body></font></div></html>"
client:send(buf);
client:close();
collectgarbage();
end)
end)
Put each code into a lua file. Include both from init.lua with typing
dofile("client.lua");
dofile("server.lua");
To make things easier, write methods.
Good luck.

Resources