Tampering with live network packets - networking

I've put a lot of time and research into finding a reliable solution for my problem. I am attempting to modify values in packets sent to and from my Iphone, of course I can't directly view and tamper with packets directly from my phone. So I've connected my phone via proxy to my computer (windows) so I could attempt to modify the packets their. Now I can successfully view and save packets but I can't seem to find a way to modify them on the fly.
I've followed many suggestions posted here such as scapy and other tools like it yet I can't seem to get them to work on windows at all, also i'm not sure these tools are even right for my end goal. I am familiar with modifying live packets on programs like WPE Pro, but I don't think that's the right tool for the job.
My question is this, is this the right path for accomplishing my goal? If so do you have a suggestion for tools that may help? If not, where should I begin looking for different solution?
Edit: Specifically I am aiming to alter hex code in the packet. In the http 1.1 packets I want to alter, I know the exact position of a certain group of hex values that translate to a plain text number. For example, say on line 80 is some hex equaling "value:12345". I want to alter that "12345" part to different numbers, keeping everything else the same so my phone will process that different value instead.

Related

Functionality in QR code without a web server

The context of this problem is weird (a magic trick that occurred to me), so I will skip that explanation and go straight to the point.
What I want: a set of QR codes (it can be just 1, or 2 different ones, either way will work for me). These QR codes may be scanned with a regular smartphone QR scanner to show some kind of text. My initial idea was a simple HTML page with the message in plain text. The difficult part is this:
Whenever someone scans the QR for the first time, certain message is show. But the second time, another message is shown. If it's just one QR code, I would like it to follow that sequence (alternating between the two messages). If there are 2 QR codes, I would want the first one scanned to display the first message (always) and the second one scanned to show the second one (always); the first scanned QR would determine which message will be shown in each one. The scan of one QR by one cell should not affect the scan of another phone (their functionality flow is independent).
I got some limitations though:
It must work just with the QR scanner a regular Android smartphone has (don't want the person installing any app).
I would like avoiding having to pay a server to store a page that has the functionality. The ideal scenery is the QR behaving like this by itself (maybe containing the proper script inside the QR).
I know how to generate QR codes and how to store HTML code in them using data:text/html protocol. My problem is the design of this functionality. Is there a way I can embed that functionality into a QR code (or two) without it being an URL to a web that stores the functionality? If not, which is the easiest way to achieve this?
Any help will be appreciated, thanks in advance.

Block for serial output in GNURadio/GRC

I am working on a project that involves GNU Radio/GRC and am not very familiar with the software. I am trying to output data to a serial port in GNU Radio using a block, but have not found a way to do so.
I was wondering if there is a pre-defined block that I can use to put this information to a serial port (USB on a Raspberry Pi 3), or if I had to create my own block. And if I had to create my own block, what that code would look like.
I have been able to write the data to a file using the File Sink to make sure I was getting data, and was wondering if the fix is something as simple as changing the File sink to an serial port sink. See picture below:
http://imgur.com/a/BdaMZ
I also did some research and found a github repo that looks like what I need -- unfortunately, the repository that it links to is no longer there. It did mention using pyserial, which is what I believe is meant for creating my own block in python. The link to this repo is below:
https://github.com/jmalsbury/gr-pyserial
… was wondering if the fix is something as simple as changing the File sink to an serial port sink.
Yes! Or No, it's even easier:
So, in fact, you could even simply use your file sink to write to e.g. /dev/ttyS0 (or /dev/ttyUSB0, or whatever is the device name of your serial port), but you'd have to set up the serial port to work like you want it to separately first. A way of doing that would be using stty, e.g.
stty -F /dev/ttyS0 115200
prior to running your flow graph.
Note that practically all in your flow graph point points to you not being sufficiently proficient with GNU Radio to successfully exchange data. I can't cover everything here, please read the official Guided Tutorials, but:
In a flow graph like yours, where the IO is the inherently rate-limiting element, you must not use "Throttle". Throttle is really just a tool to avoid a flowgraph consuming all your CPU (and to slow down simulations)
Giving your files a .grc ending is bad practice, as that is the ending reserved for GNU Radio flow graphs.
Giving it a .txt ending is plain misleading, since there's no text involved whatsoever. The "file format" (I wouldn't even call it a format) is really just plain binary numbers, as your computer handles them; not decimal ASCII representations of these floating point binary numbers
I also did some research and found a github repo that looks like what I need -- unfortunately, the repository that it links to is no longer there. It did mention using pyserial, which is what I believe is meant for creating my own block in python. The link to this repo is below:
Don't know what you're referring to, https://github.com/jmalsbury/gr-pyserial is perfectly existing!

Can you use wildcards in Solaris ipfilter?

Solaris 10 has a very nice firewall called ipfilter. I've been creating rules like
block in quick from 218.87.111.108 to any
to keep the Chinese hackers away but they keep coming back from other IP's.
Is there a way to specify a whole range of IP's in ipf.conf, like say 218.87..? I don't want to just try it for fear of messing something up. Thanks.
I always hate answering my own questions but apparently this one was either too obvious or too obscure for anyone else. Anyway, it turns out that Solaris ipfilter does indeed allow wildcards, but not using stars as one might think. IP ranges are specified using CIDR notation, as described here http://www.aprelium.com/data/doc/2/abyssws-linux-doc-html/ipformat.html
So for example to block the entire class C and D subnets of 61.152.x.x you would specify
block in quick from 61.152.0.0/16 to any

Is there a way to play sound on mobile when task finished

Maybe I didn't search to good, but I wonder is there a way to play a sound on my Apple mobile device when the task is finished, for example call to apply?
Best Regards
(This is one of many possible answers, and happens to work very well for me.)
I use Pushbullet and RPushbullet. After the initial setup (free account and free use), from any R instance (that has connectivity with the internet) I can run pbNote('note', 'title', 'body of note'), and it "instantly" comes up on my computer and mobile.
Because it is an R package/function, it can be easily scripted to meet whatever static/dynamic needs may arise. It can also send images (I'm told), files, addresses (think google maps), and lists.
I'm using the twitteR package and tweet something when a long-lasting task is done. You can then setup a second twitter account to follow the account you tweet to from R and set an alarm for new tweets.
To be able to tweet from R, you have to go through all the authentication steps for Twitter, though.
I use my own github package to send a text. This is wrapping python code I didn't write and don't understand so I maintain it for myself but have not been able to address other people's problems:
https://github.com/trinker/gmailR
So the use may look something like:
gmail(to=cell2email(5555555555, "sprint"), password = "password")
Including this at the end of the script sends me a text when the long task is complete. This really is taking advantage that cell numbers can be turned into email addresses if the cell carrier is known.

Are there any tools for diffing HTTP requests/responses?

I am trying to debug some problems with very picking/complex webservices where some of the clients that are theoretically making the same requests are getting different results. A debugging proxy like Charles helps a lot but since the requests are complex (lots of headers, cookies, query strings, form data, etc) and the clients create the headers in different orders (which should be perfectly acceptable), etc. it's an extremely tedious process to do manually.
I'm pondering writing something to do this myself but I was hoping someone else had already solved this problem?
As an aside does anyone know of any Charles-like debugging proxies that are completely opensource? If Charles were open source I would definitely contribute any work I did on this front back to the project. If there is something similar out there, I would much rather do this than write an separate program from scratch (especially since I imagine Charles or any analog already has all of the data structures I might need etc).
Edit:
Just to be clear -- text diffing will not work as the order of lines (e.g. headers at least) may be different and/or the order of values within lines (e.g. cookies at least) can be different and in both cases as long as the names and values and metadata are all the same, the different ordering should not cause requests that are otherwise the same to be considered different.
Fiddler has such an option, if you have WinDiff in your path. I don't know though if it will suit your needs, because at first glance it's jus doing text comparisions. But perhaps it normalizes the sessions before that, so I can't say.
If there's nothing purpose built for the job, you can use packet capture to get the message content saved to a text file (something that inserts itself in the IP stack like CommView). The you can text diff the results for different messages.
Can the open-source proxy Squid maybe help?

Resources