{"id":5078,"date":"2021-02-15T14:17:42","date_gmt":"2021-02-15T06:17:42","guid":{"rendered":"https:\/\/damogame.cn\/wordpress\/?p=5078"},"modified":"2021-02-15T14:17:42","modified_gmt":"2021-02-15T06:17:42","slug":"scapy-%e4%b8%ad%e6%96%87%e6%96%87%e6%a1%a3%ef%bc%9a%e4%b8%80%e3%80%81%e4%bb%8b%e7%bb%8d","status":"publish","type":"post","link":"https:\/\/i007.cc\/wordpress\/archives\/5078","title":{"rendered":"Scapy \u4e2d\u6587\u6587\u6863\uff1a\u4e00\u3001\u4ecb\u7ecd"},"content":{"rendered":"<div class=\"article-header-box\">\n<div class=\"article-header\">\n<div class=\"article-title-box\"><\/div>\n<div class=\"article-info-box\">\n<div class=\"blog-tags-box\">\n<div class=\"tags-box artic-tag-box\"><a href=\"https:\/\/blog.csdn.net\/wizardforcel\/article\/details\/54667639\">\u539f\u6587\u5730\u5740<\/a><\/div>\n<div><\/div>\n<\/div>\n<div class=\"operating\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<article class=\"baidu_pl\">\n<div id=\"article_content\" class=\"article_content clearfix\">\n<div id=\"content_views\" class=\"markdown_views\">\n<h1 id=\"\u4ecb\u7ecd\"><a name=\"t0\"><\/a><a name=\"t0\"><\/a>\u4ecb\u7ecd<\/h1>\n<blockquote><p>\u8bd1\u8005\uff1a<a href=\"http:\/\/blog.csdn.net\/pdcxs007\/article\/details\/46686843\">pdcxs007<\/a><\/p>\n<p>\u6765\u6e90\uff1a<a href=\"http:\/\/blog.csdn.net\/pdcxs007\/article\/details\/46686843\">Scapy\u4ecb\u7ecd\u5b98\u65b9\u6587\u6863\u7ffb\u8bd1<\/a><\/p>\n<p>\u539f\u6587\uff1a<a href=\"http:\/\/www.secdev.org\/projects\/scapy\/doc\/introduction.html\">Introduction<\/a><\/p>\n<p>\u534f\u8bae\uff1a<a href=\"http:\/\/creativecommons.org\/licenses\/by-nc-sa\/2.5\/\">CC BY-NC-SA 2.5<\/a><\/p><\/blockquote>\n<ul>\n<li><a href=\"https:\/\/blog.csdn.net\/wizardforcel\/article\/details\/54667639#%E5%85%B3%E4%BA%8Escapy\" target=\"_self\" rel=\"noopener\">\u5173\u4e8eScapy<\/a><\/li>\n<li><a href=\"https:\/\/blog.csdn.net\/wizardforcel\/article\/details\/54667639#scapy%E4%B8%BA%E4%BD%95%E5%A6%82%E6%AD%A4%E7%89%B9%E5%88%AB\" target=\"_self\" rel=\"noopener\">Scapy\u4e3a\u4f55\u5982\u6b64\u7279\u522b<\/a><\/li>\n<li><a href=\"https:\/\/blog.csdn.net\/wizardforcel\/article\/details\/54667639#%E5%BF%AB%E9%80%9F%E7%9A%84%E6%8A%A5%E6%96%87%E8%AE%BE%E8%AE%A1\" target=\"_self\" rel=\"noopener\">\u5feb\u901f\u7684\u62a5\u6587\u8bbe\u8ba1<\/a><\/li>\n<li><a href=\"https:\/\/blog.csdn.net\/wizardforcel\/article\/details\/54667639#%E4%B8%80%E6%AC%A1%E6%8E%A2%E6%B5%8B%E5%A4%9A%E6%AC%A1%E8%A7%A3%E9%87%8A\" target=\"_self\" rel=\"noopener\">\u4e00\u6b21\u63a2\u6d4b\u591a\u6b21\u89e3\u91ca<\/a><\/li>\n<li><a href=\"https:\/\/blog.csdn.net\/wizardforcel\/article\/details\/54667639#scapy%E8%A7%A3%E7%A0%81%E8%80%8C%E4%B8%8D%E8%A7%A3%E9%87%8A\" target=\"_self\" rel=\"noopener\">Scapy\u89e3\u7801\u800c\u4e0d\u89e3\u91ca<\/a><\/li>\n<li><a href=\"https:\/\/blog.csdn.net\/wizardforcel\/article\/details\/54667639#%E5%BF%AB%E9%80%9F%E5%B1%95%E7%A4%BAquick-demo\" target=\"_self\" rel=\"noopener\">\u5feb\u901f\u5c55\u793aQuick demo<\/a><\/li>\n<li><a href=\"https:\/\/blog.csdn.net\/wizardforcel\/article\/details\/54667639#%E5%90%88%E7%90%86%E7%9A%84%E9%BB%98%E8%AE%A4%E5%80%BC\" target=\"_self\" rel=\"noopener\">\u5408\u7406\u7684\u9ed8\u8ba4\u503c<\/a><\/li>\n<li><a href=\"https:\/\/blog.csdn.net\/wizardforcel\/article\/details\/54667639#%E5%AD%A6%E4%B9%A0python\" target=\"_self\" rel=\"noopener\">\u5b66\u4e60Python<\/a><\/li>\n<\/ul>\n<p>\u672c\u4eba\u82f1\u6587\u6c34\u5e73\u6709\u9650\uff0c\u7ffb\u8bd1\u4e0d\u5f53\u4e4b\u5904\uff0c\u8bf7\u53c2\u8003<a href=\"http:\/\/www.secdev.org\/projects\/scapy\/doc\/introduction.html#about-scapy\">\u5b98\u65b9\u7f51\u7ad9<\/a>\u3002<\/p>\n<h1 id=\"\u5173\u4e8escapy\"><a name=\"t1\"><\/a><a name=\"t1\"><\/a>\u5173\u4e8e<code>Scapy<\/code><\/h1>\n<p><code>Scapy<\/code>\u662f\u4e00\u4e2a\u53ef\u4ee5\u8ba9\u7528\u6237\u53d1\u9001\u3001\u4fa6\u542c\u548c\u89e3\u6790\u5e76\u4f2a\u88c5\u7f51\u7edc\u62a5\u6587\u7684<a title=\"undefined\" href=\"http:\/\/lib.csdn.net\/base\/11\">Python<\/a>\u7a0b\u5e8f\u3002\u8fd9\u4e9b\u529f\u80fd\u53ef\u4ee5\u7528\u4e8e\u5236\u4f5c\u4fa6\u6d4b\u3001\u626b\u63cf\u548c\u653b\u51fb\u7f51\u7edc\u7684\u5de5\u5177\u3002<\/p>\n<p>\u6362\u8a00\u4e4b\uff0c<code>Scapy<\/code>\u00a0\u662f\u4e00\u4e2a\u5f3a\u5927\u7684\u64cd\u7eb5\u62a5\u6587\u7684\u4ea4\u4e92\u7a0b\u5e8f\u3002\u5b83\u53ef\u4ee5\u4f2a\u9020\u6216\u8005\u89e3\u6790\u591a\u79cd\u534f\u8bae\u7684\u62a5\u6587\uff0c\u8fd8\u5177\u6709\u53d1\u9001\u3001\u6355\u83b7\u3001\u5339\u914d\u8bf7\u6c42\u548c\u54cd\u5e94\u8fd9\u4e9b\u62a5\u6587\u4ee5\u53ca\u66f4\u591a\u7684\u529f\u80fd\u3002<code>Scapy<\/code>\u00a0\u53ef\u4ee5\u8f7b\u677e\u5730\u505a\u5230\u50cf\u626b\u63cf(scanning)\u3001\u8def\u7531\u8ddf\u8e2a(tracerouting)\u3001\u63a2\u6d4b(probing)\u3001\u5355\u5143\u6d4b\u8bd5(unit tests)\u3001\u653b\u51fb(attacks)\u548c\u53d1\u73b0\u7f51\u7edc(network discorvery)\u8fd9\u6837\u7684\u4f20\u7edf\u4efb\u52a1\u3002\u5b83\u53ef\u4ee5\u4ee3\u66ff<code>hping<\/code>,<code>arpspoof<\/code>,<code>arp-sk<\/code>,<code>arping<\/code>,<code>p0f<\/code>\u00a0\u751a\u81f3\u662f\u90e8\u5206\u7684<code>Namp<\/code>,<code>tcpdump<\/code>\u548c<code>tshark<\/code>\u00a0\u7684\u529f\u80fd\u3002<\/p>\n<p><img decoding=\"async\" title=\"\" src=\"http:\/\/www.secdev.org\/projects\/scapy\/doc\/_images\/testing-taxonomy.png\" alt=\"testing-taxonomy.png\" \/><\/p>\n<p><code>Scapy<\/code>\u00a0\u5728\u5927\u591a\u6570\u5176\u5b83\u5de5\u5177\u65e0\u6cd5\u5b8c\u6210\u7684\u7279\u5b9a\u4efb\u52a1\u4e2d\u4e5f\u8868\u73b0\u4f18\u5f02\uff0c\u6bd4\u5982\u53d1\u9001\u65e0\u6548\u5e27\u3001\u6dfb\u52a0\u81ea\u5b9a\u4e49\u7684802.11\u7684\u4fa6\u3001\u591a\u6280\u672f\u7684\u7ed3\u5408(\u8df3\u8dc3\u653b\u51fb(VLAN hopping)+ARP\u7f13\u5b58\u4e2d\u6bd2(ARP cache poisoning)\u3001\u5728WEP\u52a0\u5bc6\u4fe1\u9053(WEP encrypted channel)\u4e0a\u7684VOIP\u89e3\u7801(VOIP decoding))\u7b49\u7b49\u7b49\u7b49\u3002<\/p>\n<p>\u7406\u5ff5\u975e\u5e38\u7b80\u5355\u3002<code>Scapy<\/code>\u00a0\u4e3b\u8981\u505a\u4e24\u4ef6\u4e8b\uff1a\u53d1\u9001\u62a5\u6587\u548c\u63a5\u6536\u56de\u5e94\u3002\u60a8\u5b9a\u4e49\u4e00\u7cfb\u5217\u7684\u62a5\u6587\uff0c\u5b83\u53d1\u9001\u8fd9\u4e9b\u62a5\u6587\uff0c\u6536\u5230\u56de\u5e94\uff0c\u5c06\u6536\u5230\u7684\u56de\u5e94\u548c\u8bf7\u6c42\u5339\u914d\uff0c\u8fd4\u56de\u4e00\u4e2a\u5b58\u653e\u7740(request, answer)\u5373(\u8bf7\u6c42, \u56de\u5e94)\u7684\u62a5\u6587\u5bf9(packet couples)\u7684\u5217\u8868(list)\u548c\u4e00\u4e2a\u6ca1\u6709\u5339\u914d\u7684\u62a5\u6587\u7684\u5217\u8868(list)\u3002\u8fd9\u6837\u5bf9\u4e8e\u50cf<code>Nmap<\/code>\u548c<code>hping<\/code>\u00a0\u8fd9\u6837\u7684\u5de5\u5177\u6709\u4e00\u4e2a\u5de8\u5927\u7684\u4f18\u52bf\uff1a\u56de\u5e94\u6ca1\u6709\u88ab\u51cf\u5c11 (open\/closed\/filtered)\u800c\u662f\u5b8c\u6574\u7684\u62a5\u6587\u3002<\/p>\n<p>\u5728\u8fd9\u4e4b\u4e0a\u53ef\u4ee5\u5efa\u7acb\u66f4\u591a\u7684\u9ad8\u7ea7\u529f\u80fd\uff0c\u6bd4\u5982\u60a8\u53ef\u4ee5\u8ddf\u8e2a\u8def\u7531(traceroutes)\u5e76\u5f97\u5230\u4e00\u4e2a\u53ea\u6709\u8bf7\u6c42\u7684\u8d77\u59cbTTL\u548c\u56de\u5e94\u7684\u6e90IP\u7684\u7ed3\u679c\uff0c\u60a8\u4e5f\u53ef\u4ee5ping\u6574\u4e2a\u7f51\u7edc\u5e76\u5f97\u5230\u5339\u914d\u7684\u56de\u590d\u7684\u5217\u8868\uff0c\u60a8\u8fd8\u53ef\u4ee5\u626b\u63cf\u5546\u54c1\u5e76\u5f97\u5230\u4e00\u4e2a&lt;nobr&gt;<code>LATEX<\/code>&lt;\/nobr&gt; \u62a5\u8868\u3002<\/p>\n<h1 id=\"scapy\u4e3a\u4f55\u5982\u6b64\u7279\u522b\"><a name=\"t2\"><\/a><a name=\"t2\"><\/a><code>Scapy<\/code>\u4e3a\u4f55\u5982\u6b64\u7279\u522b<\/h1>\n<p>\u7b2c\u4e00\uff0c\u5bf9\u4e8e\u5176\u5b83\u7684\u5927\u591a\u6570\u7f51\u7edc\u5de5\u5177\u6765\u8bf4\uff0c\u60a8\u65e0\u6cd5\u5236\u4f5c\u4e00\u4e9b\u4f5c\u8005\u65e0\u6cd5\u60f3\u5230\u7684\u4e1c\u897f\u3002\u8fd9\u4e9b\u5de5\u5177\u5df2\u7ecf\u88ab\u4e00\u4e2a\u7279\u5b9a\u7684\u76ee\u6807\u6240\u5c40\u9650\u548c\u56fa\u5b9a\uff0c\u56e0\u6b64\u65e0\u6cd5\u548c\u8fd9\u4e2a\u76ee\u6807\u6709\u5927\u7684\u504f\u79bb\u3002\u6bd4\u5982\uff0c\u4e00\u4e2aARP\u7f13\u5b58\u4e2d\u6bd2\u7a0b\u5e8f\u4e0d\u4f1a\u8ba9\u60a8\u4f7f\u7528<code>double 802.1q<\/code>\u00a0\u5305\u88f9\u5185\u5bb9\uff0c\u540c\u6837\u65e0\u6cd5\u627e\u5230\u4e00\u4e2a\u7a0b\u5e8f\u53ef\u4ee5\u53d1\u9001\u586b\u5145(padding)\u7684ICMP\u62a5\u6587(\u662f\u586b\u5145(padding)\uff0c\u4e0d\u662f\u8d1f\u8f7d\uff08payload))\u3002\u4e8b\u5b9e\u4e0a\uff0c\u6bcf\u6b21\u6709\u65b0\u9700\u6c42\u65f6\uff0c\u60a8\u5fc5\u9700\u91cd\u65b0\u5efa\u7acb\u4e00\u4e2a\u65b0\u7684\u5de5\u5177\u3002<\/p>\n<p>\u7b2c\u4e8c\uff0c\u8fd9\u4e9b\u5de5\u5177\u7ecf\u5e38\u6df7\u6dc6\u89e3\u7801(decoding)\u548c\u89e3\u91ca(interpreting)\u3002\u673a\u5668\u64c5\u957f\u89e3\u7801\u5e76\u80fd\u5e2e\u52a9\u4eba\u7c7b\u5b8c\u6210\u8fd9\u4e2a\u5de5\u4f5c\u3002\u89e3\u91ca\u5e94\u8be5\u7559\u7ed9\u4eba\u7c7b\u3002\u4e00\u4e9b\u7a0b\u5e8f\u8bd5\u56fe\u6a21\u62df\u8fd9\u4e2a\u884c\u4e3a\u3002\u6bd4\u5982\u5b83\u4eec\u8bf4\u201c\u8fd9\u4e2a\u7aef\u53e3\u662f\u6253\u5f00\u7684\u201d\u800c\u4e0d\u662f\u8bf4\u201c\u6211\u6536\u5230\u4e00\u4e2a<code>SYN-ACK<\/code>\u201c.\u6709\u65f6\u5b83\u4eec\u662f\u5bf9\u7684\uff0c\u4f46\u6709\u65f6\u4e0d\u662f\u3002\u8fd9\u6837\u505a\u5bf9\u4e8e\u521d\u5b66\u8005\u6765\u8bf4\u66f4\u5bb9\u6613\uff0c\u4f46\u662f\u5f53\u60a8\u77e5\u9053\u60a8\u6b63\u5728\u505a\u4ec0\u4e48\uff0c\u60a8\u5c06\u7ee7\u7eed\u8bd5\u56fe\u63a8\u4ece\u7a0b\u5e8f\u7684\u89e3\u91ca\u4e2d\u6d4b\u5b9e\u9645\u4e0a\u53d1\u751f\u4e86\u4ec0\u4e48\u6765\u5236\u4f5c\u81ea\u5df1\u7684\u5de5\u5177\uff0c\u4f46\u662f\u8fd9\u76f8\u5f53\u56f0\u96be\uff0c\u56e0\u4e3a\u5927\u91cf\u7684\u4fe1\u606f\u5df2\u7ecf\u4e22\u5931\u3002\u56e0\u6b64\u6700\u7ec8\u5e38\u5e38\u662f\u60a8\u4f7f\u7528<code>tcpdump -xX<\/code>\u6765\u89e3\u7801\u548c\u89e3\u91ca\u8fd9\u4e9b\u5de5\u5177\u4e22\u6389\u7684\u5185\u5bb9\u3002<\/p>\n<p>\u7b2c\u4e09\uff0c\u5373\u4f7f\u662f\u90a3\u4e9b\u53ea\u7ba1\u89e3\u7801\u7684\u7a0b\u5e8f\u4e5f\u6ca1\u6709\u628a\u5b83\u4eec\u6536\u5230\u7684\u6240\u6709\u7684\u4fe1\u606f\u4ea4\u7ed9\u60a8\u3002\u5b83\u4eec\u7ed9\u60a8\u5c55\u793a\u7684\u7f51\u7edc\u4fe1\u606f\u53ea\u662f\u5176\u4f5c\u8005\u8ba4\u4e3a\u8db3\u591f\u7684\u4fe1\u606f\u3002\u4f46\u662f\u8fd9\u4e9b\u5e76\u4e0d\u5b8c\u6574\uff0c\u5bf9\u60a8\u6765\u8bf4\u662f\u504f\u9887\u7684\u3002\u6bd4\u5982\uff0c\u60a8\u77e5\u9053\u6709\u4ec0\u4e48\u5de5\u5177\u53ef\u4ee5\u5f97\u5230\u4ee5\u592a\u5e27\u586b\u5145\u7684\u62a5\u6587\u5417(reports the Ethernet padding)\uff1f<\/p>\n<p>\u4e8b\u5b9e\u4e0a\uff0c\u6bcf\u6b21\u8fd0\u884c\u672c\u7a0b\u5e8f\uff0c\u66f4\u50cf\u662f\u5efa\u9020\u4e00\u4e2a\u65b0\u7684\u5de5\u5177\uff0c\u4e0d\u662f\u5904\u7406\u4e0a\u767e\u884c\u7684C\u7a0b\u5e8f\u4ee3\u7801\uff0c\u60a8\u4f7f\u7528<code>Scapy<\/code>\u53ea\u9700\u5199\u51e0\u884c\u4ee3\u7801\u3002<\/p>\n<p>\u5728\u63a2\u6d4b(probe)(\u6216\u8005\u626b\u63cf(scan)\u3001\u8def\u7531\u8ddf\u8e2a(traceroute)\u7b49\u7b49)\u4e4b\u540e\uff0c<code>Scapy<\/code>\u603b\u662f\u5728\u4efb\u4f55\u7684\u89e3\u91ca\u4e4b\u524d\u628a\u63a2\u6d4b\u5230\u7684\u6240\u6709\u7684\u5305\u89e3\u7801\u540e\u7ed9\u60a8\u3002\u8fd9\u610f\u5473\u7740\u60a8\u53ef\u4ee5\u63a2\u6d4b\u4e00\u6b21\u800c\u89e3\u91ca\u5f88\u591a\u6b21\uff0c\u4e5f\u53ef\u4ee5\u4f7f\u7528\u8def\u7531\u8ddf\u8e2a\u5e76\u67e5\u770b\u62a5\u6587\u586b\u5145\u5185\u5bb9\u3002<\/p>\n<h1 id=\"\u5feb\u901f\u7684\u62a5\u6587\u8bbe\u8ba1\"><a name=\"t3\"><\/a><a name=\"t3\"><\/a>\u5feb\u901f\u7684\u62a5\u6587\u8bbe\u8ba1<\/h1>\n<p>\u5176\u5b83\u7684\u5de5\u5177\u575a\u6301<strong>\u547d\u4ee4\u884c\u8fd0\u884c<\/strong>\u7684\u6a21\u5f0f\uff0c\u8fd9\u5bfc\u81f4\u63cf\u8ff0\u4e00\u4e2a\u62a5\u6587\u9700\u8981\u7cdf\u7cd5\u7684\u8bed\u6cd5\u3002\u5bf9\u4e8e\u8fd9\u4e9b\u5de5\u5177\uff0c\u89e3\u51b3\u7684\u65b9\u6cd5\u662f\u5728\u5176\u4f5c\u8005\u60f3\u50cf\u7684\u60c5\u666f\u4e0b\uff0c\u91c7\u7528\u4e00\u79cd\u66f4\u9ad8\u5c42\u4f46\u662f\u529f\u80fd\u66f4\u5f31\u7684\u63cf\u8ff0\u65b9\u6cd5\u3002\u4e3e\u4f8b\u6765\u8bf4\uff0c\u5728\u7aef\u53e3\u626b\u63cf\u7684\u60c5\u666f\u4e2d\uff0c\u7aef\u53e3\u626b\u63cf\u5668\u5fc5\u987b\u7684\u53c2\u6570\u53ea\u6709IP\u5730\u5740\u3002\u5373\u4f7f\u60c5\u666f\u6709\u6240\u6539\u53d8\uff0c\u60c5\u51b5\u4f9d\u7136\u5982\u6b64(Even if the scenario is tweaked a bit, you still are stuck to a port scan)\u3002<\/p>\n<p><code>Scapy<\/code>\u7684\u539f\u5219\u662f\u63a8\u8350\u4f7f\u7528\u4e00\u79cd<strong>\u7279\u5b9a\u9886\u57df\u8bed\u8a00<\/strong>(Domain Specific Language (DSL))\u4ee5\u8fbe\u5230\u5bf9\u4e8e\u4efb\u4f55\u79cd\u7c7b\u62a5\u6587\u7684\u529f\u80fd\u5f3a\u5927\u5e76\u5feb\u901f\u7684\u63cf\u8ff0\u3002\u4f7f\u7528<code>Python<\/code>\u8bed\u6cd5\u548c<code>Python<\/code>\u89e3\u91ca\u5668\u4f5c\u4e3a\u7279\u5b9a\u9886\u57df\u8bed\u8a00(DSL)\u7684\u8bed\u6cd5\u548c\u89e3\u91ca\u5668\u6709\u8bb8\u591a\u4f18\u52bf\uff1a\u6ca1\u6709\u5fc5\u8981\u5199\u4e00\u4e2a\u5355\u72ec\u7684\u89e3\u91ca\u5668\uff0c\u7528\u6237\u4e0d\u9700\u8981\u518d\u5b66\u4e00\u79cd\u65b0\u8bed\u8a00\u5e76\u53ef\u4ee5\u4ece\u8fd9\u4e2a\u5b8c\u6574\u3001\u7b80\u7ea6\u4e14\u975e\u5e38\u5f3a\u5927\u7684\u8bed\u8a00\u4e2d\u53d7\u76ca\u3002<\/p>\n<p><code>Scapy<\/code>\u5141\u8bb8\u7528\u6237\u5c06\u4e00\u4e2a\u6216\u4e00\u7cfb\u5217\u62a5\u6587\u63cf\u8ff0\u6210\u4e3a\u4e00\u4e2a\u4e2a\u5806\u8d77\u6765\u7684\u5c42(layer)\u3002\u6bcf\u5c42\u7684\u6570\u636e\u57df\u6709\u6709\u7528\u7684\u4e14\u53ef\u91cd\u8f7d\u7684\u9ed8\u8ba4\u503c\u3002<code>Scapy<\/code>\u4e0d\u5f3a\u5236\u7528\u6237\u4f7f\u7528\u9884\u5148\u5b9a\u4e49\u7684\u65b9\u6cd5\u548c\u6a21\u677f\u3002\u8fd9\u6837\u6bcf\u6b21\u78b0\u5230\u4e0d\u540c\u7684\u60c5\u666f\u65f6\u5199\u65b0\u5de5\u5177\u7684\u9700\u8981\u5f97\u5230\u4e86\u51cf\u5c11\u3002\u5728C\u8bed\u8a00\u4e2d\uff0c\u63cf\u8ff0\u4e00\u4e2a\u62a5\u6587\u53ef\u80fd\u5e73\u5747\u8981\u752860\u884c\u4ee3\u7801\u3002\u4f7f\u7528<code>Scapy<\/code>\uff0c\u53d1\u9001\u7684\u62a5\u6587\u53ef\u80fd\u4ec5\u9700\u4e00\u884c\u4ee3\u7801\u63cf\u8ff0\u518d\u52a0\u4e00\u884c\u6253\u5370\u7ed3\u679c\u7684\u4ee3\u7801\u300290%\u7684\u7f51\u7edc\u63a2\u6d4b\u5de5\u5177\u53ef\u4ee5\u4f7f\u7528<code>Scapy<\/code>\u4f7f\u75282\u884c\u4ee3\u7801\u91cd\u65b0\u5b9e\u73b0\u3002<\/p>\n<h1 id=\"\u4e00\u6b21\u63a2\u6d4b\u591a\u6b21\u89e3\u91ca\"><a name=\"t4\"><\/a><a name=\"t4\"><\/a>\u4e00\u6b21\u63a2\u6d4b\uff0c\u591a\u6b21\u89e3\u91ca<\/h1>\n<p>\u7f51\u7edc\u7684\u53d1\u73b0\u662f\u4e00\u4e2a\u9ed1\u76d2\u6d4b\u8bd5\u3002\u5f53\u63a2\u6d4b\u4e00\u4e2a\u7f51\u7edc\u65f6\uff0c\u8bb8\u591a\u4fa6\u6d4b\u62a5\u6587(stimuli)\u53d1\u9001\u7136\u800c\u5b83\u4eec\u5f53\u4e2d\u53ea\u6709\u5c11\u6570\u80fd\u591f\u88ab\u56de\u5e94\u3002\u5982\u679c\u9009\u62e9\u4e86\u6b63\u786e\u7684\u4fa6\u6d4b\u62a5\u6587\uff0c\u5e0c\u671b\u5f97\u5230\u7684\u4fe1\u606f\u53ef\u4ee5\u901a\u8fc7\u56de\u5e94\u7684\u62a5\u6587\u6216\u8005\u662f\u6ca1\u6709\u56de\u5e94\u7684\u60c5\u51b5\u6765\u83b7\u5f97\u3002\u4e0d\u50cf\u5f88\u591a\u5176\u5b83\u7684\u5de5\u5177\uff0c<code>Scapy<\/code>\u5f97\u5230\u6240\u6709\u7684\u4fe1\u606f\uff0c\u4e5f\u5c31\u662f\u8bf4\uff0c\u6240\u6709\u7684\u53d1\u9001\u7684\u4fa6\u6d4b\u62a5\u6587\u548c\u6240\u6709\u6536\u5230\u7684\u56de\u5e94\u3002\u901a\u8fc7\u68c0\u67e5\u8fd9\u4e9b\u6570\u636e\u7528\u6237\u53ef\u4ee5\u5f97\u5230\u60f3\u8981\u7684\u4fe1\u606f\u3002\u5f53\u6570\u636e\u91cf\u8f83\u5c0f\u65f6\uff0c\u7528\u6237\u53ef\u4ee5\u76f4\u63a5\u67e5\u770b\u6570\u636e\u3002\u5728\u5176\u5b83\u60c5\u51b5\u4e0b\uff0c\u5bf9\u4e8e\u6570\u636e\u7684\u89e3\u91ca\u5c06\u4f9d\u8d56\u4e8e\u5173\u6ce8\u70b9\u7684\u4e0d\u540c\u3002\u591a\u6570\u5de5\u5177\u9009\u62e9\u5c55\u793a\u5173\u6ce8\u70b9\u5185\u5bb9\u800c\u5ffd\u7565\u548c\u5173\u6ce8\u70b9\u65e0\u5173\u7684\u5185\u5bb9\u3002\u7531\u4e8e<code>Scapy<\/code>\u7ed9\u51fa\u5b8c\u6574\u7684\u539f\u59cb\u6570\u636e\uff0c\u56e0\u6b64\u8fd9\u4e9b\u6570\u636e\u53ef\u4ee5\u591a\u6b21\u4f7f\u7528\u4ece\u800c\u5141\u8bb8\u5173\u6ce8\u70b9\u5728\u5206\u6790\u8fc7\u7a0b\u4e2d\u53d1\u751f\u53d8\u5316\u3002\u6bd4\u5982\uff0c\u53ef\u80fd\u63a2\u6d4b\u4e00\u4e2aTCP\u7aef\u53e3\u626b\u63cf\u800c\u5173\u6ce8(\u5c55\u793a)\u7aef\u53e3\u626b\u63cf\u7684\u7ed3\u679c\u3002\u540c\u65f6\u4e5f\u53ef\u4ee5\u67e5\u770b\u56de\u5e94\u62a5\u6587\u7684TTL\u65b9\u9762\u7684\u5185\u5bb9\u3002\u4e00\u4e2a\u65b0\u7684\u63a2\u6d4b\u5e76\u4e0d\u9700\u8981\u518d\u6765\u4e00\u6b21\uff0c\u800c\u53ea\u662f\u5728\u5df2\u6709\u7684\u6570\u636e\u4e2d\u6539\u4e00\u4e0b\u5173\u6ce8\u70b9\u5373\u53ef\u3002<\/p>\n<p><img decoding=\"async\" title=\"\" src=\"http:\/\/www.secdev.org\/projects\/scapy\/doc\/_images\/scapy-concept.png\" alt=\"scapy concept\" \/><\/p>\n<h1 id=\"scapy\u89e3\u7801\u800c\u4e0d\u89e3\u91ca\"><a name=\"t5\"><\/a><a name=\"t5\"><\/a><code>Scapy<\/code>\u89e3\u7801\u800c\u4e0d\u89e3\u91ca<\/h1>\n<p>\u7f51\u7edc\u63a2\u6d4b\u5de5\u5177\u6240\u5171\u6709\u7684\u4e00\u4e2a\u95ee\u9898\u662f\u5b83\u4eec\u90fd\u8bd5\u56fe\u89e3\u91ca\u6536\u5230\u7684\u56de\u5e94\u800c\u975e\u4ec5\u4ec5\u89e3\u7801\u5e76\u7ed9\u51fa\u7ed3\u679c\u3002\u62a5\u544a\u4e00\u4e9b\u7c7b\u4f3c\u4e8e<strong>\u572880\u7aef\u53e3\u6536\u5230\u4e00\u4e2aTCP Reset\u62a5\u6587<\/strong>\u8fd9\u6837\u7684\u6d88\u606f\u4e0d\u5c5e\u4e8e\u89e3\u91ca\u9519\u8bef\u3002\u62a5\u544a<strong>80\u7aef\u53e3\u5173\u95ed<\/strong>\u5728\u591a\u6570\u60c5\u51b5\u4e0b\u662f\u6b63\u786e\u7684\uff0c\u4f46\u662f\u5728\u67d0\u4e9b\u7279\u5b9a\u7684\u5de5\u5177\u7684\u4f5c\u8005\u6ca1\u6709\u60f3\u5230\u7684\u4e0a\u4e0b\u6587\u4e2d\u662f\u9519\u8bef\u7684\u3002\u6bd4\u5982\uff0c\u4e00\u4e9b\u626b\u63cf\u5668\u5728\u6536\u5230\u4e00\u4e2a\u76ee\u7684\u5730\u5740\u4e0d\u53ef\u8fbe\u7684ICMP\u62a5\u6587\u540e\u503e\u5411\u4e8e\u62a5\u544a\u4e00\u4e2a\u8fc7\u6ee4TCP\u7aef\u53e3\u3002\u8fd9\u53ef\u80fd\u662f\u6b63\u786e\u7684\uff0c\u4f46\u662f\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\uff0c\u8fd9\u8868\u660e\u62a5\u6587\u88ab\u9632\u706b\u5899\u8fc7\u6ee4\u6389\u800c\u627e\u4e0d\u5230\u62a5\u6587\u7684\u975e\u76ee\u7684\u4e3b\u673a\u3002<\/p>\n<p>\u89e3\u91ca\u7ed3\u679c\u53ef\u4ee5\u5e2e\u52a9\u90a3\u4e9b\u4e0d\u77e5\u9053\u4ec0\u4e48\u662f\u7aef\u53e3\u626b\u63cf\u7684\u7528\u6237\uff0c\u4f46\u662f\u5f0a\u5927\u4e8e\u5229\uff0c\u56e0\u4e3a\u8fd9\u5bf9\u4e8e\u7ed3\u679c\u662f\u4e00\u79cd\u4e3b\u89c2\u7684\u89e3\u91ca\u3002\u53ef\u80fd\u7684\u7ed3\u679c\u5c31\u662f\u5b83\u4eec\u53ef\u4ee5\u81ea\u5df1\u89e3\u91ca\uff0c\u77e5\u8bc6\u4e30\u5bcc\u7684\u7528\u6237\u5c06\u8bd5\u56fe\u53cd\u5411\u8fd8\u539f\u8fd9\u4e2a\u5de5\u5177\u7684\u89e3\u91ca\u4ee5\u5f97\u5230\u5f15\u8d77\u8fd9\u4e2a\u89e3\u91ca\u7684\u771f\u6b63\u539f\u56e0\u3002\u4e0d\u5e78\u7684\u662f\uff0c\u5728\u8fd9\u4e2a\u8fc7\u7a0b\u4e2d\u6709\u5927\u91cf\u7684\u4fe1\u606f\u4e22\u5931\u3002<\/p>\n<h1 id=\"\u5feb\u901f\u5c55\u793aquick-demo\"><a name=\"t6\"><\/a><a name=\"t6\"><\/a>\u5feb\u901f\u5c55\u793a(Quick demo)<\/h1>\n<p>\u9996\u5148\u6211\u4eec\u7a0d\u5fae\u8bd5\u4e00\u4e0b\uff0c\u4e00\u6b21\u521b\u5efa4\u4e2aIP\u62a5\u6587\u6765\u770b\u770b\u8fd9\u4e2a\u5de5\u5177\u662f\u5982\u4f55\u5de5\u4f5c\u7684\u3002\u6211\u4eec\u9996\u5148\u521d\u59cb\u5316IP\u7c7b\u3002\u7136\u540e\uff0c\u6211\u4eec\u91cd\u65b0\u5c06\u5176\u5b9e\u4f8b\u5316\u5e76\u7ed9\u51fa4\u4e2aIP\u62a5\u6587\u7684\u76ee\u7684\u5730\u5740(\/30\u7ed9\u51fa\u63a9\u7801)\u3002\u4f7f\u7528<code>Python<\/code>\u8bed\u6cd5\uff0c\u6211\u4eec\u5728\u4e00\u7cfb\u5217\u660e\u786e\u7684\u62a5\u6587\u4e2d\u5b9a\u4e49\u8fd9\u4e2a\u62a5\u6587(we develop this implicit packet in a set of explicit packets)\u3002\u7136\u540e\uff0c\u6211\u4eec\u9000\u51fa\u89e3\u91ca\u5668\u3002\u4f5c\u4e3a\u6211\u4eec\u63d0\u4f9b\u7684\u4f1a\u8bdd\u6587\u4ef6(session file)\uff0c\u8fd9\u4e9b\u6211\u4eec\u6b63\u5728\u4f7f\u7528\u53d8\u91cf\u5df2\u7ecf\u4fdd\u5b58\uff0c\u7136\u540e\u91cd\u65b0\u52a0\u8f7d\uff1a<\/p>\n<pre class=\"prettyprint\"><code class=\"hljs python has-numbering\"><span class=\"hljs-comment\"># .\/scapy.py -s mysession<\/span>\r\nNew session [mysession]\r\nWelcome to Scapy (<span class=\"hljs-number\">0.9<\/span><span class=\"hljs-number\">.17<\/span><span class=\"hljs-number\">.108<\/span>beta)\r\n<span class=\"hljs-prompt\">&gt;&gt;&gt; <\/span>IP()\r\n&lt;IP |&gt;\r\n<span class=\"hljs-prompt\">&gt;&gt;&gt; <\/span>target=<span class=\"hljs-string\">\"www.target.com\"<\/span>\r\n<span class=\"hljs-prompt\">&gt;&gt;&gt; <\/span>target=<span class=\"hljs-string\">\"www.target.com\/30\"<\/span>\r\n<span class=\"hljs-prompt\">&gt;&gt;&gt; <\/span>ip=IP(dst=target)\r\n<span class=\"hljs-prompt\">&gt;&gt;&gt; <\/span>ip\r\n&lt;IP dst=&lt;Net www.target.com\/<span class=\"hljs-number\">30<\/span>&gt; |&gt;\r\n<span class=\"hljs-prompt\">&gt;&gt;&gt; <\/span>[p <span class=\"hljs-keyword\">for<\/span> p <span class=\"hljs-keyword\">in<\/span> ip]\r\n[&lt;IP dst=<span class=\"hljs-number\">207.171<\/span><span class=\"hljs-number\">.175<\/span><span class=\"hljs-number\">.28<\/span> |&gt;, &lt;IP dst=<span class=\"hljs-number\">207.171<\/span><span class=\"hljs-number\">.175<\/span><span class=\"hljs-number\">.29<\/span> |&gt;\r\n &lt;IP dst=<span class=\"hljs-number\">207.171<\/span><span class=\"hljs-number\">.175<\/span><span class=\"hljs-number\">.30<\/span> |&gt;, &lt;IP dst=<span class=\"hljs-number\">207.171<\/span><span class=\"hljs-number\">.175<\/span><span class=\"hljs-number\">.31<\/span> |&gt;]\r\n<span class=\"hljs-prompt\">&gt;&gt;&gt; <\/span>^D <\/code><\/pre>\n<pre class=\"prettyprint\"><code class=\"hljs vbnet has-numbering\"><span class=\"hljs-preprocessor\"># scapy -s mysession<\/span>\r\n<span class=\"hljs-keyword\">Using<\/span> session [mysession]\r\nWelcome <span class=\"hljs-keyword\">to<\/span> Scapy (<span class=\"hljs-number\">0.9<\/span><span class=\"hljs-number\">.17<\/span><span class=\"hljs-number\">.108<\/span>beta)\r\n&gt;&gt;&gt; ip\r\n&lt;IP dst=&lt;Net www.target.com\/<span class=\"hljs-number\">30<\/span> |&gt; <\/code><\/pre>\n<p>\u73b0\u5728\uff0c\u6211\u4eec\u6765\u64cd\u7eb5\u4e00\u4e9b\u62a5\u6587\uff1a<\/p>\n<pre class=\"prettyprint\"><code class=\"hljs python has-numbering\"><span class=\"hljs-prompt\">&gt;&gt;&gt; <\/span>IP()\r\n&lt;IP |&gt;\r\n<span class=\"hljs-prompt\">&gt;&gt;&gt; <\/span>a=IP(dst=<span class=\"hljs-string\">\"172.16.1.40\"<\/span>)\r\n&lt;IP dst=<span class=\"hljs-number\">172.16<\/span><span class=\"hljs-number\">.1<\/span><span class=\"hljs-number\">.40<\/span> |&gt;\r\n<span class=\"hljs-prompt\">&gt;&gt;&gt; <\/span>a.dst\r\n<span class=\"hljs-string\">'172.16.1.40'<\/span>\r\n<span class=\"hljs-prompt\">&gt;&gt;&gt; <\/span>a.ttl\r\n<span class=\"hljs-number\">64<\/span><\/code><\/pre>\n<p>\u8ba9\u6211\u4eec\u6765\u8bf4\u6211\u60f3\u8981\u4e00\u4e2a\u5e7f\u64ad\u7684MAC\u5730\u5740\uff0c\u5e76\u4e14\u8d1f\u8f7d\u7684IP\u62a5\u6587\u8981\u5230\u8fbeketchup.com\u548cmayo.com\uff0cTTL\u503c\u4ece1\u52309\uff0c\u5e76\u8d1f\u8f7dUDP\u62a5\u6587\uff1a<\/p>\n<pre class=\"prettyprint\"><code class=\"hljs python has-numbering\"><span class=\"hljs-prompt\">&gt;&gt;&gt; <\/span>Ether(dst=<span class=\"hljs-string\">\"ff:ff:ff:ff:ff:ff\"<\/span>)\r\n     \/IP(dst=[<span class=\"hljs-string\">\"ketchup.com\"<\/span>, <span class=\"hljs-string\">\"mayo.com\"<\/span>], ttl=(<span class=\"hljs-number\">1<\/span>,<span class=\"hljs-number\">9<\/span>))\r\n     \/UDP()<\/code><\/pre>\n<p>\u73b0\u5728\u6211\u4eec\u5728\u4e00\u884c(\u4e00\u4e2a\u786e\u5b9a\u62a5\u6587(implicit packet))\u4e2d\u5b9a\u4e49\u4e8618\u4e2a\u62a5\u6587\u3002<\/p>\n<h1 id=\"\u5408\u7406\u7684\u9ed8\u8ba4\u503c\"><a name=\"t7\"><\/a><a name=\"t7\"><\/a>\u5408\u7406\u7684\u9ed8\u8ba4\u503c<\/h1>\n<p><code>Scapy<\/code>\u8bd5\u56fe\u5728\u6240\u6709\u79cd\u7c7b\u7684\u62a5\u6587\u6570\u636e\u57df\u4e2d\u4f7f\u7528\u5408\u7406\u7684\u9ed8\u8ba4\u503c\uff0c\u5982\u679c\u6ca1\u6709\u88ab\u91cd\u8f7d\u7684\u8bdd\uff0c<\/p>\n<ul>\n<li>IP\u6e90\u5730\u5740\u6839\u636e\u76ee\u7684\u5730\u5740\u548c\u8def\u7531\u8868\u9009\u62e9<\/li>\n<li>\u6821\u9a8c\u548c\u81ea\u52a8\u8ba1\u7b97<\/li>\n<li>\u6e90MAC\u5730\u5740\u6839\u636e\u8f93\u51fa\u63a5\u53e3(output interface)\u9009\u62e9<\/li>\n<li>\u4ee5\u592a\u7f51\u7c7b\u578b\u548cIP\u534f\u8bae\u7531\u9ad8\u5c42\u51b3\u5b9a<\/li>\n<\/ul>\n<p><img decoding=\"async\" title=\"\" src=\"http:\/\/www.secdev.org\/projects\/scapy\/doc\/_images\/default-values-ip.png\" alt=\"default values ip\" \/><\/p>\n<p>\u5176\u5b83\u6570\u636e\u57df\u9009\u62e9\u6700\u6709\u7528\u7684\u503c\uff1a<\/p>\n<ul>\n<li>TCP\u6e90\u7aef\u53e3\u4e3a20,\u76ee\u7684\u7aef\u53e3\u4e3a80<\/li>\n<li>UDP\u6e90\u7aef\u53e3\u548c\u76ee\u7684\u7aef\u53e3\u5747\u4e3a53<\/li>\n<li>ICMP\u7c7b\u578b\u4e3aecho request<\/li>\n<\/ul>\n<h1 id=\"\u5b66\u4e60python\"><a name=\"t8\"><\/a><a name=\"t8\"><\/a>\u5b66\u4e60<code>Python<\/code><\/h1>\n<p><code>Scapy<\/code>\u4f7f\u7528<code>Python<\/code>\u89e3\u91ca\u5668\u4f5c\u4e3a\u547d\u4ee4\u9762\u677f\u3002\u8fd9\u610f\u5473\u7740\u4f60\u53ef\u4ee5\u76f4\u63a5\u4f7f\u7528<code>Python<\/code>\u8bed\u8a00(\u521b\u5efa\u53d8\u91cf\uff0c\u4f7f\u7528\u5faa\u73af\uff0c\u5b9a\u4e49\u51fd\u6570\u7b49\u7b49)\u3002<\/p>\n<p>\u5982\u679c\u4f60\u521a\u5f00\u59cb\u4f7f\u7528<code>Python<\/code>\u5e76\u4e14\u56e0\u6b64\u4f60\u4e0d\u7406\u89e3\u8fd9\u4e9b\u8bcd\u8bed\uff0c\u6216\u8005\u5982\u679c\u4f60\u60f3\u5b66\u4e60\u8fd9\u4e2a\u8bed\u8a00\uff0c\u82b1\u4e00\u4e2a\u5c0f\u65f6\u6765\u9605\u8bfb\u4e00\u4e2aGuido Van Rossum\u5199\u7684\u975e\u5e38\u68d2\u7684<a href=\"https:\/\/docs.python.org\/tutorial\">Python\u6559\u7a0b<\/a>\u3002\u5728\u6b64\u4e4b\u540e\uff0c\u4f60\u5c06\u77e5\u9053<code>Python<\/code>\u00a0:)(\u771f\u7684\uff01)\u3002\u5bf9\u4e8e\u66f4\u52a0\u6df1\u5165\u7684\u5b66\u4e60\uff0c<a href=\"http:\/\/woodpecker.org.cn\/diveintopython\/\">Dive Into Python<\/a>\u4e5f\u662f\u4e00\u4e2a\u5f88\u597d\u7684\u5f00\u59cb\u3002<\/p>\n<p>\u4f5c\u4e3a\u4e00\u4e2a\u5feb\u901f\u7684\u5f00\u59cb\uff0c\u4e0b\u9762\u662f<code>Python<\/code>\u6570\u636e\u7c7b\u578b\u7684\u6982\u89c8\uff1a<\/p>\n<ul>\n<li><code>int<\/code>(signed, 32bits) :\u00a0<code>42<\/code><\/li>\n<li><code>long<\/code>(signed, infinite) :\u00a0<code>42L<\/code><\/li>\n<li><code>str<\/code>\u00a0:\u00a0<code>\"bell\\x07\\n\"<\/code>\u00a0or\u00a0<code>'bell\\x07\\n'<\/code><\/li>\n<li><code>tuple<\/code>\u00a0(immutable):\u00a0<code>(1,4,\"42\")<\/code><\/li>\n<li><code>list<\/code>\u00a0(mutable):\u00a0<code>[4,2,\"1\"]<\/code><\/li>\n<li><code>dict<\/code>\u00a0(mutable):\u00a0<code>{\"one\":1, \"two\":2}<\/code><\/li>\n<\/ul>\n<p><code>Python<\/code>\u4e2d\u6ca1\u6709\u5757\u5206\u5272\u7b26\uff0c\u800c\u662f\u540c\u7f29\u8fdb\u51b3\u5b9a\uff1a<\/p>\n<pre class=\"prettyprint\"><code class=\"hljs vbscript has-numbering\"><span class=\"hljs-keyword\">if<\/span> cond:\r\n    <span class=\"hljs-built_in\">instr<\/span>\r\n    <span class=\"hljs-built_in\">instr<\/span>\r\nelif cond2:\r\n    <span class=\"hljs-built_in\">instr<\/span>\r\n<span class=\"hljs-keyword\">else<\/span>:\r\n    <span class=\"hljs-built_in\">instr<\/span><\/code><\/pre>\n<\/div>\n<\/div>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>\u539f\u6587\u5730\u5740 \u4ecb\u7ecd \u8bd1\u8005\uff1apdcxs007 <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[],"tags":[119],"class_list":["post-5078","post","type-post","status-publish","format-standard","hentry","tag-03-"],"_links":{"self":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts\/5078","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/comments?post=5078"}],"version-history":[{"count":0,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts\/5078\/revisions"}],"wp:attachment":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/media?parent=5078"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/categories?post=5078"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/tags?post=5078"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}