caster0x00/abovePassive network security sniffer that analyzes 28 protocols (ARP, STP, OSPF, VLAN, SCADA) to detect vulnerabilities in network equipment without generating traffic.
Network security sniffer for finding vulnerabilities in the network. Designed for pentesters and security engineers.
___ __
/ | / /_ ____ _ _____
/ /| | / __ \/ __ \ | / / _ \
/ ___ |/ /_/ / /_/ / |/ / __/
/_/ |_/_.___/\____/|___/\___/
Above: Network Security Sniffer
Developer: Mahama Bazarov (Caster)
Contact: [email protected]
Version: 2.8.1
Codename: Rubens Barrichello
Documentation & Usage: https://github.com/caster0x00/Above
All information contained in this repository is provided for educational and research purposes only. The author is not responsible for any illegal use of this tool.
It is a specialized network security tool that helps both pentesters and security professionals.
Above is a network security sniffer for finding vulnerabilities in network equipment. It is based entirely on network traffic analysis, so it does not make any noise on the air. He's invisible. Completely based on the Scapy library.
Above allows pentesters to automate the process of finding vulnerabilities in network hardware. Discovery protocols, dynamic routing, 802.1Q, Resolution protocols, ICS, FHRP, STP, LLMNR/NBT-NS, etc.
Detects up to 28 protocols:
MACSec (802.1X AE)
EAPOL (Checking 802.1X versions)
ARP (Host Discovery)
CDP (Cisco Discovery Protocol)
DTP (Dynamic Trunking Protocol)
LLDP (Link Layer Discovery Protocol)
VLAN (802.1Q)
S7COMM (Siemens) (SCADA)
OMRON (SCADA)
TACACS+ (Terminal Access Controller Access Control System Plus)
ModbusTCP (SCADA)
STP (Spanning Tree Protocol)
OSPF (Open Shortest Path First)
EIGRP (Enhanced Interior Gateway Routing Protocol)
BGP (Border Gateway Protocol)
VRRP (Virtual Router Redundancy Protocol)
HSRP (Host Standby Redundancy Protocol)
GLBP (Gateway Load Balancing Protocol)
IGMP (Internet Group Management Protocol)
LLMNR (Link Local Multicast Name Resolution)
NBT-NS (NetBIOS Name Service)
MDNS (Multicast DNS)
DHCP (Dynamic Host Configuration Protocol)
DHCPv6 (Dynamic Host Configuration Protocol v6)
ICMPv6 (Internet Control Message Protocol v6)
SSDP (Simple Service Discovery Protocol)
MNDP (MikroTik Neighbor Discovery Protocol)
SNMP (Simple Network Management Protocol)
Above works in two modes:
The tool is very simple in its operation and is driven by arguments:
.pcap as input and looks for protocols in it.pcap file, its name you specify yourselfusage: above.py [-h] [--interface INTERFACE] [--timer TIMER] [--output OUTPUT] [--input INPUT] [--passive-arp] [--search-vlan]
options:
-h, --help show this help message and exit
--interface INTERFACE
Interface for traffic listening
--timer TIMER Time in seconds to capture packets, default: not set
--output OUTPUT File name where the traffic will be recorded, default: not set
--input INPUT File name of the traffic dump
--passive-arp Passive ARP (Host Discovery)
--search-vlan VLAN Search
The information obtained will be useful not only to the pentester, but also to the security engineer, he will know what he needs to pay attention to.
When Above detects a protocol, it outputs the necessary information to indicate the attack vector or security issue:
Impact: What kind of attack can be performed on this protocol;
Tools: What tool can be used to launch an attack;
Technical information: Required information for the pentester, sender MAC/IP addresses, FHRP group IDs, OSPF/EIGRP domains, etc.
Mitigation: Recommendations for fixing the security problems
Source/Destination Addresses: For protocols, Above displays information about the source and destination MAC addresses and IP addresses
You can install Above directly from the Kali Linux repositories
caster@kali:~$ sudo apt update && sudo apt install above
Or:
:~$ sudo apt-get install python3-scapy python3-colorama python3-setuptools
:~$ git clone https://github.com/caster0x00/above
:~$ cd above/
:~/above$ sudo python3 setup.py install
# Install python3 first
brew install python3
# Then install required dependencies
sudo pip3 install scapy colorama setuptools
# Clone the repo
git clone https://github.com/caster0x00/above
cd above/
sudo python3 setup.py install
Don't forget to deactivate your firewall on macOS!
Above requires root access for sniffing
Above can be run with or without a timer:
caster@kali:~$ sudo above --interface eth0 --timer 120
To stop traffic sniffing, press CTRL + С
Example:
caster@kali:~$ sudo above --interface eth0 --timer 120
___ __
/ | / /_ ____ _ _____
/ /| | / __ \/ __ \ | / / _ \
/ ___ |/ /_/ / /_/ / |/ / __/
/_/ |_/_.___/\____/|___/\___/
Above: Network Security Sniffer
Developer: Mahama Bazarov (Caster)
Contact: [email protected]
Version: 2.8.1
Codename: Rubens Barrichello
Documentation & Usage: https://github.com/caster0x00/Above
[*] Start Sniffing
[+] Detected STP Frame
[*] Attack Impact: Partial MITM
[*] Tools: Yersinia, Scapy
[*] STP Root Switch MAC: 00:11:22:33:44:55
[*] STP Root ID: 32768
[*] STP Root Path Cost: 0
[*] Mitigation: Enable BPDU Guard or Portfast
[*] Vendor: Routerboard.com
If you need to record the sniffed traffic, use the --output argument
caster@kali:~$ sudo above --interface eth0 --timer 120 --output above.pcap
If you interrupt the tool with CTRL+C, the traffic is still written to the file
If you already have some recorded traffic, you can use the --input argument to look for potential security issues
caster@kali:~$ above --input hsrp.cap
Example:
caster@kali:~$ sudo above --input hsrp.cap
___ __
/ | / /_ ____ _ _____
/ /| | / __ \/ __ \ | / / _ \
/ ___ |/ /_/ / /_/ / |/ / __/
/_/ |_/_.___/\____/|___/\___/
Above: Network Security Sniffer
Developer: Mahama Bazarov (Caster)
Contact: [email protected]
Version: 2.8.1
Codename: Rubens Barrichello
Documentation & Usage: https://github.com/caster0x00/Above
[+] Analyzing pcap file...
[+] Detected HSRP Packet
[*] HSRP Active Router Priority: 90
[+] Attack Impact: MITM
[*] Tools: Loki, Scapy, Yersinia
[*] HSRP Group Number: 10
[+] HSRP Virtual IP Address: 10.28.168.254
[*] HSRP Sender IP: 10.28.168.253
[*] HSRP Sender MAC: 00:00:0c:07:ac:0a
[!] Authentication: Plaintext Phrase: cisco
[*] Mitigation: Priority 255, Authentication, Extended ACL
[*] Vendor: Cisco Systems