Breaking Code

July 16, 2012

[Quickpost] Updated Impacket/Pcapy installers for Python 2.5, 2.6 & 2.7

Hi folks! In a previous post I talked about using Impacket and Pcapy on Python 2.6. Since those installers are now out of date, here are fresh ones for various versions of Pcapy and Python, built against WinPcap 4.1.2. There’s also a new Impacket MSI installer that works against all Python versions.

Enjoy! :)

Edited 6-May-2013: updated Impacket to version 0.9.10
Edited 18-Feb-2014: updated Impacket to version 0.9.11

Download Impacket 0.9.11

impacket-0.9.11.win32.msi

impacket-0.9.11.win-amd64.msi

Download Pcapy 0.10.5

pcapy-0.10.5.win32-py2.5-winpcap4.1.2.msi

pcapy-0.10.5.win32-py2.6-winpcap4.1.2.exe

pcapy-0.10.5.win32-py2.7-winpcap4.1.2.exe

pcapy-0.10.5.win-amd64-py2.6-winpcap4.1.2.exe

pcapy-0.10.5.win-amd64-py2.7-winpcap4.1.2.exe

(more…)

June 29, 2010

Quickpost: Using Google Search from your Python code

Filed under: Tools, Web applications — Tags: , , , , , , , , — Mario Vilas @ 6:31 pm

Hi everyone. Today I’ll be showing you a quick script I wrote to make Google searches from Python. There are previous projects doing the same thing -actually, doing it better-, namely Googolplex by Sebastian Wain and xgoogle by Peteris Krumins, but unfortunately they’re no longer working. Maybe the lack of complexity of this script will keep it working a little longer… :)

The interface is extremely simple, the module exports only one function called search().

        # Get the first 20 hits for: "Breaking Code" WordPress blog
        from google import search
        for url in search('"Breaking Code" WordPress blog', stop=20):
            print(url)

You can control which one of the Google Search pages to use, which language to search in, how many results per page, which page to start searching from and when to stop, and how long to wait between queries – however the only mandatory argument is the query string, everything else has a default value.

        # Get the first 20 hits for "Mariposa botnet" in Google Spain
        from google import search
        for url in search('Mariposa botnet', tld='es', lang='es', stop=20):
            print(url)

A word of caution, though: if you wait too little between requests or make too many of them, Google may block your IP for a while. This is especially annoying when you’re behind a corporate proxy – I won’t be made responsible when your coworkers suddenly develop an urge to kill you! :D

Below are the download links (source code and Windows installers) and the source code for you to read online. Enjoy! :)

Changelog

  • Version 1.0 (initial release).
  • Version 1.01 (fixed the IOError exception bug).
  • Version 1.02 (fixed the missing href bug reported by Rahul Sasi and the duplicate results bug reported by Slawek).
  • Version 1.03 (extracts the hidden links from the results page, thanks ubershmekel!).
  • Version 1.04 (added support for BeautifulSoup 4, thanks alxndr!).
  • Version 1.05 (added compatibility with Python 3.x, better command line parser, and also added some improvements by machalekj)
  • Version 1.06 (added an option to only grab the relevant results, instead of all possible links from each result page, as requested by user Nicky and others).

Download

Source code: google-1.06.tar.gz

Windows 32 bits installer: google-1.06.win32.msi

Windows 64 bits installer: google-1.06.win-amd64.msi

Documentation: google-1.06-doc.zip

Source code

Get the source code from GitHub: https://github.com/MarioVilas/google
(more…)

March 23, 2009

Netifera 1.0 released!

Filed under: Tools — Tags: , , , , , , , — Mario Vilas @ 9:23 am

After a long wait, Netifera version 1.0 was released. I talked about this tool in a previous post. The feature list seems to have remained pretty much the same, with some new bruteforcing modules – most notably the remote OS and architecture detection was drastically improved, and as expected contains many bugfixes compared to the previous betas.

Here’s the full feature list:

Tools

  • Full IPv6 support
  • TCP and UDP network scanning
  • Service detection
  • Operating system identification
  • Reverse DNS scanning
  • DNS name brute forcing
  • DNS zone transfer information gathering
  • Geographical information about network addresses
  • Authentication brute force attack (against HTTP, FTP,IMAP and POP3)
  • Web crawler discovers applications, collects email addresses and adds the site structure to the model
  • Integrated terminal for connecting to and interacting with network services

Passive Tools

  • Modular packet capture service
  • Capture packets on multiple interfaces simultaneously
  • Parse ’pcap’ format capture files as input to sniffing modules
  • HTTP traffic analysis
  • DNS information gathering from captured responses
  • Network stack fingerprinting
  • Service detection from captured banners and protocol packets
  • Client application detection
  • Credential sniffing for many protocols

Data Model

All information discovered by the netifera platform is persistently
stored in a workspace database. Our extension design allows for
developers to easily create their own data types and integrate them
into the platform.

User Interface

The platform provides an intuitive and professional quality graphical
user interface for using the tools written for our platform and
navigating the information they produce. Different tasks in our
application such as sniffing information from the network, or actively
collecting information by scanning networks, or exploring the local
environment of a remotely deployed probe (coming soon! ) each have a
specialized configuration of the user interface called a ’perspective’

Programming API

The netifera platform brings together high quality programming APIs
for tasks such as:

  • High performance asynchronous socket connection and communication
  • Link level packet capture and raw socket injection
  • 802.11 monitor mode packet capture and injection (coming soon! )
  • Network protocol header construction and analysis (ethernet, ip, tcp, etc…)
  • Application layer protocol libraries (http, dns, ftp, etc…)

December 13, 2008

Did you check out Netifera already?

Filed under: Tools — Tags: , , , , , — Mario Vilas @ 2:27 am

Netifera is a new open source security tool for network mapping and security auditing for Linux and Mac OS X (Windows will also be supported in the future). It’s a only beta for now, but I think we’ll be hearing much more about it!

There are two kinds of recon you can do with Netifera, active and passive. Today active recon seems a bit rough in the edges, but I’m sure it will evolve soon. There are TCP and UDP port scanners, a very complete DNS tool, a simple web crawler and a rudimentary FTP password bruteforcer.

The passive recon tool is much more remarkable, however. By sniffing the network, Netifera detects active hosts and open ports, maps which host has connected to which (that can help you deduce the function of each host in the network, or the relationships between them), and you can run active recon tools on said hosts while sniffing. Most notably the DNS information gathering tool can use any discovered host with port 53 open as a DNS server.

But there are two reasons for which it draws my attention so much. One is the development framework. Everything is done as Java plugins, pretty much like Eclipse, thus making it very extensible and easier to port to multiple platforms. Here is a tutorial on writing sniffer plugins for Netifera, to add functionality to the passive recon tool. I believe this is a key feature – the possibility of adding plugins for anything can quickly turn this quick-and-dirty recon tool into a much more advanced security audit tool in the future, as more users contribute to the project. It makes me think of Metasploit or nmap, they are what they are today thanks to user contributions, and Netifera may (hopefully) follow the same path. The one drawback I see here is the choice of language -Java- as opposed to scripting languages -Python, Perl, Ruby- which are much less robust but allow for faster development and quick-and-dirty tests scripts or macros.

The second reason I liked this so much is the probe idea they’ll be adding in upcoming versions. What is a probe? In a nutshell, it’s a tiny portable java runtime engine that you can deploy anywhere in the network. This probes can run any code from the Netifera framework (including your custom-made plugins of course), so it’s essentially the same as having the tool installed and running there, but without the hassle. :) By deploying many probes in your network you can map it from several points of view simultaneously, giving you a better perspective on it’s security. The beta you can download from the Netifera web page does not yet have the ability to deploy probes on other hosts, it’s a pity because I really wanted to try that out :( but I’ve been told it will be available soon, so stay tuned.

Well, enough said. Just go grab a copy and toy with it a little, don’t trust my word for it and see for yourselves! :)

The Silver is the New Black Theme. Blog at WordPress.com.

Follow

Get every new post delivered to your Inbox.

Join 2,481 other followers