Created
March 28, 2019 01:34
-
-
Save pocc/94df273fe038069d16f7c1a0c7e8b1c2 to your computer and use it in GitHub Desktop.
Send udp/tcp/icmp pings in Scapy to top 50 websites and watch those packets appear in a Wireshark live capture
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
# Run `tail -f -n +1 /tmp/scapy.pcap | wireshark -k -i -` in another terminal | |
import re | |
import requests | |
from scapy.all import * | |
LIVE_PCAP="/tmp/scapy.pcap" | |
def top_50_websites(): | |
pagetext = requests.get('https://www.alexa.com/topsites').text | |
print("Getting top websites...") | |
return re.findall(r"\"/siteinfo/([a-zA-Z0-9-_.]+)\"", pagetext) | |
def top_500_websites(): | |
site = "https://moz.com/top500" | |
pagetext = requests.get(site).text | |
return re.findall(r'href="http://([a-zA-Z0-9-_.]+)"', pagetext) | |
def ping(packet, sites, save_file): | |
pkt_pipe = PcapWriter(save_file, append=True, sync=True) | |
pkt_type = str(type(packet))[26:-2] | |
for site in sites: | |
try: | |
ans, unans = sr( IP(dst=site) / packet, timeout=1, retry=0, verbose=False) | |
if ans: | |
pkt_pipe.write(ans[0]) | |
if pkt_type == 'UDP': | |
print("UDP ping from", site) | |
else: | |
if pkt_type != 'UDP': | |
print("no", pkt_type, "response from", site) | |
pkt_pipe.write(unans[0]) | |
except socket.gaierror: | |
print("Skipping", site, "because its IP cannot be found.") | |
tcp_ping = TCP(sport=RandShort(), dport=80, flags='S') | |
icmp_ping = ICMP() | |
udp_ping = UDP(dport=0) | |
top_sites = top_50_websites() | |
ping( tcp_ping, top_sites, LIVE_PCAP ) | |
ping( icmp_ping, top_sites, LIVE_PCAP ) | |
ping( udp_ping, top_sites, LIVE_PCAP ) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment