Simple TLS field manipulation using Scapy TLS module.

ScapyTLSmod.md

Scapy TLS Field Manipulation

Used Scapy 2.4.3 w/ IPython 7.13.0

Pre-Req:

# Enable TLS parsing in Scapy in (/usr/lib/pythonX/dist-packages/scapy/config.py) by adding 'tls' to the "load_layers" list
# OR in a script by adding the line:
load_layer("tls")

Making Packet Modifications:

# Load file and specific packet
pcap = rdpcap('<file.pcap>')[<INT_packet_num>]

# Copy and parse raw TLS
pcap_tls = TLS(pcap_in[Raw].load)

# Fields can be written to with either integers or hexadecimal 
# ex. - integer:
pcap_tls.len = 306
# ex. - hex:
pcap_tls.version = 0x0303

# Overwrite TLS data and write out to file
pcap[Raw] = pcap_tls
wrpcap('<file.pcap>', pcap)