So now that we've reviewed the different commands and methods that
are used by Scapy to send and receive packets,
we can move into the demonstration environment and see how this all works.
Remember to watch these with an eye towards how they could be used
in our Globomantics environment and how this would both improve
your work and the company's systems.
For this section,
we will be reviewing each of these different commands and methods.
These will include the send, sendp, sr, sr1, srp, and srp1commands.
Now let's get into the demonstration environment and show
how to send and receive packets with the different
commands that were just reviewed.
The first thing that we need to do is get into Scapy, and we'll clear this out,
and what we're going to show here first is we're going to show an
example of the send and the sendp commands.
The first thing that we need to do is create a packet,
and in this case,
we're going to be using the send, an example of the send command
first so it does not expect anything at Layer 2,
that will be automatically handled by Scapy.
So in this case, the IP layer has a destination IP address of 10.10.10.102.
All other fields will be derived by Scapy or used by the IP
addresses that are already assigned on this device,
and on top of that is a TCP layer with a source,
a random source port number and a destination port number of 22.
In this case, this remote device does have a service running on port 22,
so we would expect to see something back from it,
but in this case,
we are not using a command that actually receives back any packets.
So even if we return something, we wouldn't be able to see it using this command.
And now we can use the send command, and in this case,
we're just going to throw 100 packets out,
and to show that it's actually doing this,
we're actually just going to start Wireshark in the background,
and if I hit Enter and then we go back to Wireshark,
we will see at the beginning of this capture,
there are a whole bunch of these packets that went out and this
remote device did send back synacks on each one of these or as many
as it could here, SYN ACKs and SYN ACK.
So these are the ones that we're sending out,
these are the ones that we're getting back from that device.
Now, an example of the sendp command is very similar,
but instead of only an IP layer and above,
we would also add a Layer 2 layer underneath everything.
So in this case, we're just going to put an Ethernet layer there,
and I'm not going to put anything in it because it's all going to be derived
from Scapy and the local interface that it sends traffic out.
In this case, there is only one interface that is used for external traffic,
so it automatically pulled the MAC address from that interface.
If I use the sendp command, we can go over to Wireshark real quick and reset it,
send them out, and we'll see that this capture looks identical to the last one.
So now let's show an example of the sr, sr1, srp, and srp1 commands.
In this case, these commands are expecting to receive traffic back,
and because of this, can be used to return this traffic back into a variable.
So in this case,
if we use the same packet that we did for the other
commands for the send and the sendp commands,
in this case, we're going to use this Layer 3 packet,
we're going to use the sr and that variable inserted into it,
we hit Enter, we'll received back 2 packets,
well we received 2 packets and got 1 answer.
So there was one answer to what we actually showed.
So the Scapy actually saw two packets,
but one of them was not associated with what we're
sending and expecting to receive here.
But since I didn't reset, Wireshark,
I want to show what this looks like when I do it.
So if we do that, we can see here is the syn that we sent out,
and here is the ack that came back.
Well, how do we take a look at that inside here?
Well the command that we entered which was this one did not
return anything into a specific variable,
it only returned it to screen.
If we wanted to further parse that down,
we can take this last result that we received and pipe that into a variable,
and we can do that with the underscore.
So now if we look at a, it'll show the same thing as we just got on the screen,
and if we look at a [0], we'll see the results entry,
and if we look at a [0][0],
we'll see here is the query answer which includes
both the sent and the response.
So we're going to see a packet here that goes to 102 which is right here.
So if we see here, this is the packet coming back,
all this from here, so the IP layer, the TCP layer,
and the padding that comes back on it.
But if we wanted to look at that even further, we would add yet another index.
So in this case, it's only going to be showing the packet that was sent.
So there it's [a][0][0][0].
So that's the packet that went out, and on this one,
we can actually use the show command, we can see it in a different way.
So this is what it looks like with the show command.
Now if we take that same packet and we use the sr1 command,
what's returned to us is a bit different because it only
shows the return traffic if we do that.
So what we received here at the console,
and if we want to put that back into that variable,
we can still use the underscore and that is the return packet from 102 to
101 back from the SSH port on the remote device and with a syn ack flag,
and we can look at that with the a variable.
So the way the information is displayed and returned into the variable is a
bit different depending on which command you're doing.
So now if we wanted to show an example of the srp command,
we would have to change the format of the packet,
and in this case, we're only showing a packet that has an IP and a TCP layer.
All we need to do is add an Ethernet layer underneath it and then we
could use the srp command the same way as we were before.
And let's skip a step here and have it automatically returning into a variable.
If we look at a, we'll see that results in an answered list,
and we'll look at the first one, results,
second one is the answer which includes the packet
going out and the packet returned back.
Third one is just the packet that one out.
The index of one there at the end is just the return packet,
and if we wanted to make that a little bit easier to look at,
we could use it into, pipe it into the ls command.
So this is using the srp command.
Now the srp1 command, as you would expect, is very similar.
We'll use that same packet srp1, again, we're receiving that return traffic,
but it also includes that Ethernet layer.
And if we look at that with just a, we'll see that,
in this case, it's also including that Ethernet layer,
which was not included with the sr and the sr1 commands.
That's Ethernet, this is the IP piece,
and this is the TCP piece and this is the TCP data portion.
So that's the payload of the TCP portion of the packet.
So with that,
let's move on and talk about the different methods that we
could use to help port scan a specific host.