raw-packet/raw-packetProyecto Raw-packet
Este proyecto se creó únicamente con fines educativos y no puede utilizarse para
violar la ley ni para obtener beneficios personales.
El autor de este proyecto no es responsable de ningún daño posible causado por los materiales de este proyecto.
Este proyecto implementa protocolos de red como Ethernet, ARP, IPv4, UDP, TCP, DHCPv4, ICMPv4, IPv6, DHCPv6, ICMPv6, DNS y MDNS sobre raw socket.
Autor: Vladimir Ivanov
Subautores: Ilja Bulatov
Email del proyecto: [email protected]
SO requerido: Windows, MacOS, Linux
Versiones mínimas de Python: 3.6
Licencia: MIT
sudo apt update sudo apt install -y python3 python3-pip wireless-tools tshark pip3 install --upgrade pip sudo pip3 install raw-packet
## Instalación en MacOS:
#### 1. Instalar Homebrew:```
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"
brew tap raw-packet/raw-packet
#### 3. Instalar Raw-packet:```
brew install raw-packet
pip3 install --upgrade pip pip3 install raw-packet
---
## Publicaciones (en ruso)
- [Actualizaciones de seguridad de Apple](https://support.apple.com/en-us/HT209341)
- [PHDays: Apple, todo sobre MiTM](https://www.phdays.com/en/program/reports/apple-all-about-mitm/)
- [Yandex IT SEC 2018: Apple vs DHCP](https://events.yandex.ru/lib/talks/5519/)
- [Xakep.ru: MiTM Wi-Fi avanzado](https://xakep.ru/2017/09/25/wifi-mitm-advanced/)
- [Atacando DHCP](https://habrahabr.ru/company/dsec/blog/333978/)
- [Atacando DHCP parte 2: Wi-Fi](https://habrahabr.ru/post/338860/)
- [Atacando DHCP parte 3: Apple](https://habrahabr.ru/post/338864/)
- [Atacando DHCP parte 4: Apple + ARP](https://habrahabr.ru/post/339666/)
---
## Rendimiento
Este proyecto fue diseñado específicamente para mejorar el rendimiento y la velocidad de las solicitudes necesarias para ataques de red.
En Linux puedes comparar el rendimiento de este proyecto con la popular librería de Python [SCAPY](https://scapy.net/) mediante el script [time_test.py](https://github.com/raw-packet/raw-packet/blob/master/Scripts/Others/time_test.py)
Puedes ver nuestras pruebas a continuación
| Número de paquetes | 10 | 100 | 1000 | 10000 |
|--------------------------------------------|-------------------|------------------|-----------------|---------------|
| Solicitudes ARP en Scapy (seg) | 0,0522048473358 | 0,0785529613495 | 0,302206039429 | 2,95294880867 |
| Solicitudes ARP en Raw-packet (seg) | 0,00202298164368 | 0,00270104408264 | 0,090922832489 | 1,3037519455 |
| Solicitudes DHCP discover en Scapy (seg) | 0,397399187088 | 4,16092181206 | 39,5892789364 | - |
| Solicitudes DHCP discover en Raw-packet (seg) | 0,00177597999573 | 0,0219049453735 | 0,162989854813 | - |
| Solicitudes DNS en Scapy (seg) | 0.608256101608 | 6.05325508118 | 58.4151289463 | - |
| Solicitudes DNS en Raw-packet (seg) | 0.00274395942688 | 0.0127770900726 | 0.0796978473663 | - |
---
# Scripts
# Ataques a Apple
## Script: [apple_mitm](https://github.com/raw-packet/raw-packet/blob/master/raw_packet/Scripts/Apple/apple_mitm.py)
Este script encuentra automáticamente dispositivos Apple en la red local mediante un escaneo ARP, NMAP o ICMPv6 e implementa el ataque MiTM con las siguientes técnicas:
1. Suplantación ARP
1. Segundo ACK DHCP
1. Predecir el siguiente ID de transacción DHCP
1. Servidor SLAAC/DHCPv6 falso
1. Suplantación NA (IPv6)
1. Suplantación RA (IPv6)```
root@kali:~# apple_mitm --help
usage: apple_mitm [-h] [-T TECHNIQUE] [-D DISCONNECT] [-P PHISHING_SITE] [-i MITM_IFACE]
[-d DEAUTH_IFACE] [-0 DEAUTH_PACKETS] [-g4 GATEWAY_IPV4] [-g6 GATEWAY_IPV6]
[-d4 DNS_IPV4] [-d6 DNS_IPV6] [-m TARGET_MAC] [-t4 TARGET_IPV4]
[-n4 TARGET_NEW_IPV4] [-t6 TARGET_IPV6] [-n6 TARGET_NEW_IPV6]
[--ipv6_prefix IPV6_PREFIX]
MiTM Apple devices (apple_mitm)
optional arguments:
-h, --help show this help message and exit
-T TECHNIQUE, --technique TECHNIQUE
Set MiTM technique:
1. ARP Spoofing
2. Second DHCP ACK
3. Predict next DHCP transaction ID
4. Rogue SLAAC/DHCPv6 server
5. NA Spoofing (IPv6)
6. RA Spoofing (IPv6)
-D DISCONNECT, --disconnect DISCONNECT
Set device Disconnect technique:
1. IPv4 network conflict detection
2. Send WiFi deauthentication packets
3. Do not disconnect device after MiTM
-P PHISHING_SITE, --phishing_site PHISHING_SITE
Set Phishing site "apple", "google" or Path to your site
-i MITM_IFACE, --mitm_iface MITM_IFACE
Set interface name for MiTM
-d DEAUTH_IFACE, --deauth_iface DEAUTH_IFACE
Set interface name for send wifi deauth packets
-0 DEAUTH_PACKETS, --deauth_packets DEAUTH_PACKETS
Set number of deauth packets (default: 25)
-g4 GATEWAY_IPV4, --gateway_ipv4 GATEWAY_IPV4
Set gateway IPv4 address
-g6 GATEWAY_IPV6, --gateway_ipv6 GATEWAY_IPV6
Set gateway IPv6 address
-d4 DNS_IPV4, --dns_ipv4 DNS_IPV4
Set DNS server IPv4 address
-d6 DNS_IPV6, --dns_ipv6 DNS_IPV6
Set DNS server IPv6 address
-m TARGET_MAC, --target_mac TARGET_MAC
Set target MAC address
-t4 TARGET_IPV4, --target_ipv4 TARGET_IPV4
Set target IPv4 address
-n4 TARGET_NEW_IPV4, --target_new_ipv4 TARGET_NEW_IPV4
Set new IPv4 address for target
-t6 TARGET_IPV6, --target_ipv6 TARGET_IPV6
Set link local target IPv6 address
-n6 TARGET_NEW_IPV6, --target_new_ipv6 TARGET_NEW_IPV6
Set new global IPv6 address for target
--ipv6_prefix IPV6_PREFIX
Set IPv6 network prefix, default - fde4:8dba:82e1:ffff::/64
Desconecta el dispositivo Apple de la red local mediante paquetes ARP``` root@kali:~# apple_arp_dos --help usage: apple_arp_dos [-h] [-i INTERFACE] [-t TARGET_IP] [-m TARGET_MAC] [-q]
Disconnect Apple device in local network with ARP packets (apple_arp_dos)
optional arguments: -h, --help show this help message and exit -i INTERFACE, --interface INTERFACE Set network interface name -t TARGET_IP, --target_ip TARGET_IP Set target IPv4 address -m TARGET_MAC, --target_mac TARGET_MAC Set target MAC address -q, --quiet Minimal output
### Sample script output:
---
## Script: [apple_dhcp_server](https://github.com/raw-packet/raw-packet/blob/master/raw_packet/Scripts/Apple/apple_dhcp_server.py)
Servidor DHCPv4 rogue para dispositivo Apple con predicción del siguiente ID de transacción DHCPv4```
root@kali:~# apple_dhcp_server --help
usage: apple_dhcp_server [-h] [-i INTERFACE] -t TARGET_IP -m TARGET_MAC [-b] [-q]
Rogue DHCPv4 server for Apple devices (apple_dhcp_server)
optional arguments:
-h, --help show this help message and exit
-i INTERFACE, --interface INTERFACE
Set network interface name
-t TARGET_IP, --target_ip TARGET_IP
Set new IPv4 address for target
-m TARGET_MAC, --target_mac TARGET_MAC
Set target MAC address
-b, --broadcast Send broadcast DHCPv4 responses
-q, --quiet Minimal output
El Protocolo de resolución de direcciones (ARP) es un protocolo de comunicación utilizado para descubrir la dirección de la capa de enlace, como una dirección MAC, asociada a una dirección de la capa de Internet, normalmente una dirección IPv4.
Este script crea y envía solicitudes ARP (¿Quién tiene?) para buscar hosts activos en la red local.``` root@kali:~# arp_scan --help usage: arp_scan [-h] [-i INTERFACE] [-t TARGET_IP] [--timeout TIMEOUT] [--retry RETRY]
ARP Scanner (arp_scan)
optional arguments: -h, --help show this help message and exit -i INTERFACE, --interface INTERFACE Set interface name for ARP scanner -t TARGET_IP, --target_ip TARGET_IP Set target IPv4 address --timeout TIMEOUT Set timeout (default=5) --retry RETRY Set number of retry packets (default=5)
### Salida de ejemplo del script:
---
## Script: [arp_spoof](https://github.com/raw-packet/raw-packet/blob/master/raw_packet/Scripts/ARP/arp_spoof.py)
Este script implementa el ataque de ARP spoofing.
El ARP spoofing, envenenamiento de caché ARP o enrutamiento de envenenamiento ARP, es una técnica en la que un atacante envía mensajes falsos (suplantados) del Protocolo de Resolución de Direcciones (ARP) a una red local.```
root@kali:~# arp_spoof --help
usage: arp_spoof [-h] [-i INTERFACE] [-t TARGET_IP] [-m TARGET_MAC] [-g GATEWAY_IP] [-r] [--ipv4_multicast]
[--ipv6_multicast] [--broadcast] [-q]
ARP Spoofing (arp_spoof)
optional arguments:
-h, --help show this help message and exit
-i INTERFACE, --interface INTERFACE
Set interface name for send ARP packets
-t TARGET_IP, --target_ip TARGET_IP
Set target IP address
-m TARGET_MAC, --target_mac TARGET_MAC
Set target MAC address
-g GATEWAY_IP, --gateway_ip GATEWAY_IP
Set gateway IP address
-r, --requests Send only ARP requests
--ipv4_multicast Send ARP replies/requests to IPv4 multicast MAC address
--ipv6_multicast Send ARP replies/requests to IPv6 multicast MAC address
--broadcast Send ARP replies/requests to broadcast MAC address
-q, --quiet Minimal output
El Protocolo de configuración dinámica de host (DHCP) es un protocolo de administración de red utilizado en redes UDP/IP mediante el cual un servidor DHCP asigna dinámicamente una dirección IP y otros parámetros de configuración de red a cada dispositivo de una red para que puedan comunicarse con otras redes IP.
Este script implementa un ataque contra los clientes de red mediante el uso de un servidor DHCPv4 falso que responde con una configuración maliciosa más rápido que el servidor DHCPv4 legítimo. Este ataque también se conoce como Rogue DHCPv4 Server Attack.``` root@kali:~# dhcpv4_server --help usage: dhcpv4_server [-h] [-i INTERFACE] [-f FIRST_OFFER_IP] [-l LAST_OFFER_IP] [-m TARGET_MAC] [-t TARGET_IP] [--netmask NETMASK] [--dhcp_mac DHCP_MAC] [--dhcp_ip DHCP_IP] [--router ROUTER] [--dns DNS] [--tftp TFTP] [--wins WINS] [--domain DOMAIN] [--lease_time LEASE_TIME] [--discover] [-O SHELLSHOCK_OPTION_CODE] [-c SHELLSHOCK_COMMAND] [-b] [-p BIND_PORT] [-N] [-E] [-R] [-e REVERSE_PORT] [-n] [-B] [--ip_path IP_PATH] [--iface_name IFACE_NAME] [--broadcast_response] [--dnsop] [--exit] [--apple] [-q]
DHCPv4 server (dhcpv4_server)
optional arguments: -h, --help show this help message and exit -i INTERFACE, --interface INTERFACE Set interface name for send reply packets -f FIRST_OFFER_IP, --first_offer_ip FIRST_OFFER_IP Set first client ip for offering -l LAST_OFFER_IP, --last_offer_ip LAST_OFFER_IP Set last client ip for offering -m TARGET_MAC, --target_mac TARGET_MAC Set target MAC address -t TARGET_IP, --target_ip TARGET_IP Set client IP address with MAC in --target_mac --netmask NETMASK Set network mask --dhcp_mac DHCP_MAC Set DHCP server MAC address, if not set use your MAC address --dhcp_ip DHCP_IP Set DHCP server IP address, if not set use your IP address --router ROUTER Set router IP address, if not set use your ip address --dns DNS Set DNS server IP address, if not set use your ip address --tftp TFTP Set TFTP server IP address --wins WINS Set WINS server IP address --domain DOMAIN Set domain name for search, default=local --lease_time LEASE_TIME Set lease time, default=172800 --discover Send DHCP discover packets in the background thread -O SHELLSHOCK_OPTION_CODE, --shellshock_option_code SHELLSHOCK_OPTION_CODE Set dhcp option code for inject shellshock payload, default=114 -c SHELLSHOCK_COMMAND, --shellshock_command SHELLSHOCK_COMMAND Set shellshock command in DHCP client -b, --bind_shell Use awk bind tcp shell in DHCP client -p BIND_PORT, --bind_port BIND_PORT Set port for listen bind shell (default=1234) -N, --nc_reverse_shell Use nc reverse tcp shell in DHCP client -E, --nce_reverse_shell Use nc -e reverse tcp shell in DHCP client -R, --bash_reverse_shell Use bash reverse tcp shell in DHCP client -e REVERSE_PORT, --reverse_port REVERSE_PORT Set port for listen bind shell (default=443) -n, --without_network Do not add network configure in payload -B, --without_base64 Do not use base64 encode in payload --ip_path IP_PATH Set path to "ip" in shellshock payload, default = /bin/ --iface_name IFACE_NAME Set iface name in shellshock payload, default = eth0 --broadcast_response Send broadcast response --dnsop Do not send DHCP OFFER packets --exit Exit on success MiTM attack --apple Add delay before send DHCP ACK -q, --quiet Minimal output
### Sample script output:
---
# DHCPv6
El [Protocolo de configuración dinámica de host versión 6 (DHCPv6)](https://en.wikipedia.org/wiki/DHCPv6) es un protocolo de red para configurar hosts de Protocolo de Internet versión 6 (IPv6) con direcciones IP, prefijos IP y otros datos de configuración necesarios para operar en una red IPv6. Es el equivalente IPv6 del Protocolo de configuración dinámica de host para IPv4.
## Script: [dhcpv6_server](https://github.com/raw-packet/raw-packet/blob/master/raw_packet/Scripts/DHCPv6/dhcpv6_server.py)
Este script implementa un servidor DHCPv6 falso para realizar ataques SLAAC/DHCPv6 rogue.```
root@kali:~# dhcpv6_server --help
usage: dhcpv6_server [-h] [-i INTERFACE] [-p PREFIX] [-f FIRST_SUFFIX] [-l LAST_SUFFIX]
[-t TARGET_MAC] [-T TARGET_IPV6] [-D] [-d DNS] [-s DNS_SEARCH]
[--delay DELAY] [-q]
SLAAC/DHCPv6 server (dhcpv6_server)
optional arguments:
-h, --help show this help message and exit
-i INTERFACE, --interface INTERFACE
Set interface name for send reply packets
-p PREFIX, --prefix PREFIX
Set network prefix
-f FIRST_SUFFIX, --first_suffix FIRST_SUFFIX
Set first suffix client IPv6 for offering
-l LAST_SUFFIX, --last_suffix LAST_SUFFIX
Set last suffix client IPv6 for offering
-t TARGET_MAC, --target_mac TARGET_MAC
Set target MAC address
-T TARGET_IPV6, --target_ipv6 TARGET_IPV6
Set client Global IPv6 address with MAC --target_mac
-D, --disable_dhcpv6 Do not use DHCPv6 protocol
-d DNS, --dns DNS Set recursive DNS IPv6 address
-s DNS_SEARCH, --dns_search DNS_SEARCH
Set DNS search domain
--delay DELAY Set delay between packets
-q, --quiet Minimal output
Este script implementa un servidor DNS simple (como un dnschef), que es útil en ataques MiTM. Puedes configurar registros A o AAAA para varios dominios.``` root@kali:~# dns_server -h usage: dns_server [-h] [-i INTERFACE] [-p PORT] [-t TARGET_MAC] [--T4 T4] [--T6 T6] [-c CONFIG_FILE] [--fake_domains FAKE_DOMAINS] [--no_such_domains NO_SUCH_DOMAINS] [--fake_ipv4 FAKE_IPV4] [--fake_ipv6 FAKE_IPV6] [--ipv6] [--disable_ipv4] [--log_file_name LOG_FILE_NAME] [--log_file_format LOG_FILE_FORMAT] [-f] [-q]
DNS server (dns_server)
optional arguments: -h, --help show this help message and exit -i INTERFACE, --interface INTERFACE Set interface name for send DNS reply packets -p PORT, --port PORT Set UDP port for listen DNS request packets (default: 53) -t TARGET_MAC, --target_mac TARGET_MAC Set target MAC address --T4 T4 Set target IPv4 address --T6 T6 Set target IPv6 address -c CONFIG_FILE, --config_file CONFIG_FILE Set json config file name, example: --config_file "dns_server_config.json" --fake_domains FAKE_DOMAINS Set fake domain regexp or domains, example: --fake_domains ".*apple.com,.*google.com" --no_such_domains NO_SUCH_DOMAINS Set no such domain or domains, example: --no_such_domains "apple.com,google.com" --fake_ipv4 FAKE_IPV4 Set fake IP address or addresses, example: --fake_ipv4 "192.168.0.1,192.168.0.2" --fake_ipv6 FAKE_IPV6 Set fake IPv6 address or addresses, example: --fake_ipv6 "fd00::1,fd00::2" --ipv6 Enable IPv6 --disable_ipv4 Disable IPv4 --log_file_name LOG_FILE_NAME Set file name for save DNS queries (default: "dns_server_log") --log_file_format LOG_FILE_FORMAT Set file format for save results: csv, xml, json, txt (default: "json") -f, --fake_answer Set your IPv4 or IPv6 address in all answers -q, --quiet Minimal output
### Configuración de script de muestra:```json
{
".*google.com": {
"A": ["192.168.0.1", "192.168.0.2"],
"AAAA": "fd00::1",
"NS": ["ns1.google.com", "ns2.google.com"],
"MX": "mail.google.com"
},
".*apple.com": {
"A": "192.168.0.1",
"AAAA": ["fd00::1", "fd00::2"],
"NS": "ns.apple.com",
"MX": ["mail1.apple.com", "mail2.apple.com"]
},
"gooogle.com": {
"no such domain": true
},
"evil.com": {
"success": true,
"A": "my ipv4 address",
"AAAA": "my ipv6 address"
}
}
Este script implementa el ataque de redirección ICMPv4.``` root@kali:~# icmpv4_redirect --help usage: icmpv4_redirect [-h] [-i INTERFACE] [-t TARGET_IP] [-m TARGET_MAC] [-g GATEWAY_IP] [-r REDIRECT_IP] [-q]
ICMPv4 redirect (icmpv4_redirect)
optional arguments: -h, --help show this help message and exit -i INTERFACE, --interface INTERFACE Set interface name for send ICMP redirect packets -t TARGET_IP, --target_ip TARGET_IP Set target IPv4 address -m TARGET_MAC, --target_mac TARGET_MAC Set target MAC address -g GATEWAY_IP, --gateway_ip GATEWAY_IP Set gateway IPv4 address (default: <your_ipv4_gateway>) -r REDIRECT_IP, --redirect_ip REDIRECT_IP Set IP addresses where to redirect (example: "1.1.1.1,8.8.8.8") -q, --quiet Minimal output
### Salida de ejemplo del script:
---
# IPv6
## Script: [ipv6_scan.py](https://github.com/raw-packet/raw-packet/blob/testing/raw_packet/Scripts/IPv6/ipv6_scan.py)
Busca hosts que soportan IPv6 en la red local mediante el protocolo ICMPv6```
root@kali:~# ipv6_scan --help
usage: ipv6_scan [-h] [-i INTERFACE] [-m TARGET_MAC] [-t TIMEOUT] [-r RETRY] [-s]
ICMPv6 scan (icmpv6_scan)
optional arguments:
-h, --help show this help message and exit
-i INTERFACE, --interface INTERFACE
Set interface name for ARP scanner
-m TARGET_MAC, --target_mac TARGET_MAC
Set target MAC address
-t TIMEOUT, --timeout TIMEOUT
Set timeout (default=5)
-r RETRY, --retry RETRY
Set number of retry (default=5)
-s, --router_search Search router IPv6 link local address
Este script implementa el ataque de suplantación de Router Advertisement y Neighbor Advertisement.``` root@kali:~# ipv6_spoof --help usage: ipv6_spoof [-h] [-T TECHNIQUE] [-i INTERFACE] [-t TARGET_IP] [-m TARGET_MAC] [-g GATEWAY_IP] [-p IPV6_PREFIX] [-d DNS_IP] [-n DNS_DOMAIN_SEARCH] [-q]
IPv6 Spoofing (ipv6_spoof)
optional arguments: -h, --help show this help message and exit -T TECHNIQUE, --technique TECHNIQUE Set ICMPv6 MiTM technique (example: 1) 1. ICMPv6 RA (Router Advertisement) Spoofing 2. ICMPv6 NA (Neighbor Advertisement) Spoofing -i INTERFACE, --interface INTERFACE Set interface name for send ARP packets -t TARGET_IP, --target_ip TARGET_IP Set target IPv6 link local address -m TARGET_MAC, --target_mac TARGET_MAC Set target MAC address -g GATEWAY_IP, --gateway_ip GATEWAY_IP Set gateway IPv6 link local address -p IPV6_PREFIX, --ipv6_prefix IPV6_PREFIX Set IPv6 prefix, default="fde4:8dba:82e1:ffff::/64" -d DNS_IP, --dns_ip DNS_IP Set DNS server IPv6 link local address -n DNS_DOMAIN_SEARCH, --dns_domain_search DNS_DOMAIN_SEARCH Set DNS domain search; default: "local" -q, --quiet Minimal output
## Suplantación de anuncios de router
### Salida de ejemplo del script:
## Suplantación de anuncios de vecino
### Salida de ejemplo del script:
---
# Creador de Conflictos de Red (ncc)
## Script: [ncc](https://github.com/raw-packet/raw-packet/blob/testing/raw_packet/Scripts/NCC/ncc.py)
Script para crear conflictos de red para diversas pruebas.```
root@kali:~# ncc --help
usage: ncc [-h] [-i INTERFACE] [-t TARGET_IP] [-m TARGET_MAC] [--replies] [--requests]
[--broadcast] [-p PACKETS] [-q] [-e]
Network Conflict Creator (ncc)
optional arguments:
-h, --help show this help message and exit
-i INTERFACE, --interface INTERFACE
Set interface name for listen and send packets
-t TARGET_IP, --target_ip TARGET_IP
Set target IP address
-m TARGET_MAC, --target_mac TARGET_MAC
Set target MAC address
--replies Send only ARP replies
--requests Send only ARP requests
--broadcast Send broadcast ARP requests
-p PACKETS, --packets PACKETS
Number of ARP packets (default: 10)
-q, --quiet Minimal output
-e, --exit Exit on success
Funciona en Windows, MacOS y Linux
Comprobar ARP Spoofing
Comprobar redirección ICMPv4
Comprobar Rogue DHCPv4
Comprobar redirección ICMPv6
Comprobar suplantación de anuncios de enrutador ICMPv6 (Router Advertisement Spoofing)
Comprobar suplantación de anuncios de vecino ICMPv6 (Neighbor Advertisement Spoofing)
Comprobar Rogue DHCPv6
Comprobar suplantación STP``` root@kali:~# nsc --help usage: nsc [-h] [-i SEND_INTERFACE] [-l LISTEN_INTERFACE] [-n TEST_HOST_INTERFACE] [-t TEST_HOST_IP] [-m TEST_HOST_MAC] [-o TEST_HOST_OS] [-u TEST_SSH_USER] [-p TEST_SSH_PASS] [-k TEST_SSH_PKEY] [-G GATEWAY_IP] [-g GATEWAY_MAC] [-r NUMBER_OF_PACKETS] [-L LISTEN_TIME] [-q]
Network Security Check (nsc)
optional arguments: -h, --help show this help message and exit -i SEND_INTERFACE, --send_interface SEND_INTERFACE Set interface name for send packets -l LISTEN_INTERFACE, --listen_interface LISTEN_INTERFACE Set interface name for listen packets -n TEST_HOST_INTERFACE, --test_host_interface TEST_HOST_INTERFACE Set test host network interface for listen packets -t TEST_HOST_IP, --test_host_ip TEST_HOST_IP Set test host IP address for ssh connection -m TEST_HOST_MAC, --test_host_mac TEST_HOST_MAC Set test host MAC address for ssh connection -o TEST_HOST_OS, --test_host_os TEST_HOST_OS Set test host OS (MacOS, Linux, Windows) -u TEST_SSH_USER, --test_ssh_user TEST_SSH_USER Set test host user name for ssh connection -p TEST_SSH_PASS, --test_ssh_pass TEST_SSH_PASS Set test host password for ssh connection -k TEST_SSH_PKEY, --test_ssh_pkey TEST_SSH_PKEY Set test host private key for ssh connection -G GATEWAY_IP, --gateway_ip GATEWAY_IP Set gateway IPv4 address -g GATEWAY_MAC, --gateway_mac GATEWAY_MAC Set gateway MAC address -r NUMBER_OF_PACKETS, --number_of_packets NUMBER_OF_PACKETS Set number of spoofing packets for each test (default: 10) -L LISTEN_TIME, --listen_time LISTEN_TIME Set time to listen spoofing packets in seconds (default: 60) -q, --quiet Minimal output
### Salida de ejemplo del script:
### Salida de ejemplo del script (host de prueba):
---
# WiFi
## Script: [wat](https://github.com/raw-packet/raw-packet/blob/testing/raw_packet/Scripts/WiFi/wat.py)
### Herramienta de ataque WiFi multiplataforma (wat)
1. Funciona en MacOS y Linux
1. Recopila información de puntos de acceso (AP) inalámbricos
1. Envía paquetes de asociación
1. Envía paquetes de desautenticación
1. Cambia entre canales WiFi
1. Guarda handshakes WPA en formatos: pcap, hccapx, 22000
1. Soporta PMKID (ataque sin cliente en AP)
1. Guarda el PMKID RSN WPA en formato para fuerza bruta con hashcat
1. Soporta la vulnerabilidad CVE-2019-15126 kr00k (descifrado de paquetes CCMP con clave temporal NULL de 128 bits)```
root@kali:~# wat --help
usage: wat [-h] [-i INTERFACE] [-c CHANNEL] [-d]
Cross platform WiFi attack tool (wat)
Ctrl-E Show Wireless access point information
Ctrl-D Send IEEE 802.11 deauth packets
Ctrl-D Switch WiFi channel
Ctrl-A Send IEEE 802.11 association packet
Ctrl-R Start scanner (switch between WiFi channels)
Ctrl-H Show help information
Ctrl-C Exit
optional arguments:
-h, --help show this help message and exit
-i INTERFACE, --interface INTERFACE
Set wireless interface name for sniff packets
-c CHANNEL, --channel CHANNEL
Set WiFi channel
-d, --debug Maximum output
