activecm/passerPassive service locator, a python sniffer that identifies servers, clients, names and much more
Passive service locator, a python sniffer that identifies servers, clients, names and much more
Quick notes for getting going with passer, the passive service sniffer. You're responsible for getting permission to sniff.
Passer can work off a live packet capture or from a pcap file (command line parameter, see examples below). It reports live services and clients, ethernet cards on the lan, dns entries, operating systems, and routers - all passively!
If you're using windows or your paths to the support files don't match mine for some other reason, let me know where they are and I'll be glad to update the script.
# Install system dependencies
sudo apt-get install arp-scan ettercap-text-only nmap wireshark
# Install python dependencies
sudo pip install -r requirements.txt
# Prevent Scapy from performing DNS lookups
echo 'noenum = [ Resolve(), TCP_SERVICES, UDP_SERVICES ]' >> ~/.scapy_startup.py
# Install system dependencies
sudo yum install arp-scan ettercap nmap wireshark
# Install python dependencies
sudo pip install -r requirements.txt
# Prevent Scapy from performing DNS lookups
echo 'noenum = [ Resolve(), TCP_SERVICES, UDP_SERVICES ]' >> ~/.scapy_startup.py
To install scapy, see the installation guide.
Passer also comes packaged as a Docker image. If you don't already have Docker here is a quick and dirty way to install it on Linux:
curl -fsSL https://get.docker.com | sh -
Otherwise, follow the install instructions for your operating system.
For most uses, we recommend the passer script included in this repo. This script will handle all docker-specific
wget https://raw.githubusercontent.com/activecm/passer/master/passer
chmod +x passer
You can then use this script just as you would in any of the examples below. For example:
./passer -i eth0
# The equivalent without using the included script would be:
docker run --rm --name=passer -i --init --net=host --cap-add=net_raw activecm/passer -i eth0
In order to stop passer run:
docker stop passer
/path/to/passer.py
This sniffs from all network interfaces and sends all output lines to your console.
sudo /path/to/passer.py
or
su - -c '/path/to/passer.py'
/path/to/passer.py -i IfaceName
Running route should give some live interfaces you might use.
❕
-iis incompatible with-r.
/path/to/passer.py -r /path/to/packets.pcap
❕
-ris incompatible with-i.
cat packetdata.pcap | ./passer.py -r /proc/self/fd/0
zcat packetdata.pcap.gz | ./passer.py -r /proc/self/fd/0
bzcat packetdata.pcap.bz2 | ./passer.py -r /proc/self/fd/0
tcpdump -i eth0 -qtnp -w - | ./passer.py -r /proc/self/fd/0
# etc...
This lets you capture packets with any tool that can save packets to a pcap file, and later process them with passer on a different system.
/path/to/passer.py -l /path/to/networkinfo.txt
/path/to/passer.py 2>/dev/null
/path/to/passer.py -h
/path/to/passer.py -u /path/to/oddpackets.pcap
This is generally intended for the development process; packets saved to this file are ones that need to have signatures written. Contributions of odd packets, descriptions of services, and patches to the program are gratefully accepted.
This should be as simple as placing the BPF filter in single quotes at the end of the command line. As of version 1.16, the underlying library does not appear to successfully use the supplied filter, but there's a workaround. Use tcpdump to do the filtering, and hand the pared-down set of packets to passer on stdin, like above:
tcpdump -r packets.pcap -w - 'icmp or arp' | ./passer.py -r /proc/self/fd/0
See the "Sample filters" section, below, for some suggestions of filters to use in either capturing packets in advance or live sniffing.
socket.error: (1, 'Operation not permitted')
You're probably trying to sniff live as a non-root user. Either log in as root, use sudo/su, or work with pcap files.
If passer crashes or won't work on your system, please make an issue that includes the error message, if any, and any details about your operating system.
Passer's output goes to stdout, and if you give the command line
parameter -l /path/to/logfile, to that file as well. Here's the format:
| Type | IPAddr | Proto | State | Optional description (may be empty) |
|---|---|---|---|---|
| 'IP' | IPaddr | 'IP' | dead or live | p0f OS description |
| 'MA' | IPaddr | 'Ethernet' | MacAddr | ManufDescription |
| 'TC' | IPaddr | 'TCP_'Port | closed or open | client description |
| 'TS' | IPaddr | 'TCP_'Port | closed or listening | server description |
| 'UC' | IPaddr | 'UDP_'Port | open or closed | udp client port description |
| 'US' | IPaddr | 'UDP_'Port | open or closed | udp server port description |
| 'DN' | IPaddr | 'A' or 'PTR' | hostname | possible extra info |
| 'RO' | IPaddr | 'TTLEx' | router | possible extra info |
Lines are comma separated for easy loading into a spreadsheet or SQL import. None of the fields should contain commas. There is a sample output file at http://www.stearns.org/passer/passer-sample-log.txt .
Here are some examples of how to get the data you want out of these lines:
cat /var/tmp/passer-log | sort -u | less
cat /var/tmp/passer-log | sort -t, -k2 -u | less
cat /var/tmp/passer-log | sort -u | egrep '(^DN|^RO)' | less
cat /var/tmp/passer-log | sort -u | grep ',192\.168\.0\.17,' | less
cat /var/tmp/passer-log | sort -u | grep ',192\.168\.' | less
cat /var/tmp/passer-log | sort -u | grep ',TCP_25,listening,' | less
cat /var/tmp/passer-log | sort -u | grep -v ',closed,' | less
cat /var/tmp/passer-log | sort -u | grep ',closed,' | less