Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 1 | <p align="center"> |
| 2 | <img src="doc/scapy_logo.png" width=200> |
| 3 | </p> |
Pierre LALET | 064203b | 2016-01-12 11:36:39 +0100 | [diff] [blame] | 4 | |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 5 | # Scapy # |
The Gitter Badger | 0dfb134 | 2017-07-05 15:41:47 +0000 | [diff] [blame] | 6 | |
Pierre LALET | 9825669 | 2016-12-15 09:55:58 +0100 | [diff] [blame] | 7 | [](https://travis-ci.org/secdev/scapy) |
Pierre LALET | d733f6b | 2017-03-15 17:11:30 +0100 | [diff] [blame] | 8 | [](https://ci.appveyor.com/project/secdev/scapy) |
Pierre LALET | 6925006 | 2017-01-08 13:25:53 +0100 | [diff] [blame] | 9 | [](https://codecov.io/gh/secdev/scapy) |
johnthagen | db0e715 | 2018-01-10 19:20:29 -0500 | [diff] [blame] | 10 | [](https://pypi.python.org/pypi/scapy/) |
johnthagen | 9481a65 | 2017-07-31 08:33:50 -0400 | [diff] [blame] | 11 | [](https://pypi.python.org/pypi/scapy/) |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 12 | [](LICENSE) |
Guillaume Valadon | e815325 | 2017-08-02 10:43:13 +0200 | [diff] [blame] | 13 | [](https://gitter.im/secdev/scapy?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge) |
Victor Engmark | eb40f18 | 2016-06-11 10:16:51 +0100 | [diff] [blame] | 14 | |
Pierre LALET | 064203b | 2016-01-12 11:36:39 +0100 | [diff] [blame] | 15 | |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 16 | Scapy is a powerful Python-based interactive packet manipulation program and |
| 17 | library. |
Pierre LALET | 064203b | 2016-01-12 11:36:39 +0100 | [diff] [blame] | 18 | |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 19 | It is able to forge or decode packets of a wide number of protocols, send them |
gpotter2 | a70aed4 | 2017-11-24 20:43:33 +0100 | [diff] [blame] | 20 | on the wire, capture them, store or read them using pcap files, match requests |
| 21 | and replies, and much more. It is designed to allow fast packet prototyping by |
| 22 | using default values that work. |
Pierre LALET | 064203b | 2016-01-12 11:36:39 +0100 | [diff] [blame] | 23 | |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 24 | It can easily handle most classical tasks like scanning, tracerouting, probing, |
johnthagen | 75433ce | 2018-01-18 16:12:52 -0500 | [diff] [blame] | 25 | unit tests, attacks or network discovery (it can replace `hping`, 85% of `nmap`, |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 26 | `arpspoof`, `arp-sk`, `arping`, `tcpdump`, `wireshark`, `p0f`, etc.). It also |
| 27 | performs very well at a lot of other specific tasks that most other tools can't |
| 28 | handle, like sending invalid frames, injecting your own 802.11 frames, combining |
| 29 | techniques (VLAN hopping+ARP cache poisoning, VoIP decoding on WEP protected |
| 30 | channel, ...), etc. |
gpotter2 | 98ea57e | 2017-01-08 12:52:30 +0100 | [diff] [blame] | 31 | |
Pierre LALET | 0b555e5 | 2017-12-27 15:28:48 +0100 | [diff] [blame] | 32 | Scapy supports Python 2.7 and Python 3 (3.3 to 3.6). It's intended to |
| 33 | be cross platform, and runs on many different platforms (Linux, OSX, |
| 34 | *BSD, and Windows). |
gpotter2 | 98ea57e | 2017-01-08 12:52:30 +0100 | [diff] [blame] | 35 | |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 36 | ## Hands-on ## |
gpotter2 | 98ea57e | 2017-01-08 12:52:30 +0100 | [diff] [blame] | 37 | |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 38 | ### Interactive shell ### |
gpotter2 | 98ea57e | 2017-01-08 12:52:30 +0100 | [diff] [blame] | 39 | |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 40 | Scapy can easily be used as an interactive shell to interact with the network. |
| 41 | The following example shows how to send an ICMP Echo Request message to |
| 42 | `github.com`, then display the reply source IP address: |
gpotter2 | 98ea57e | 2017-01-08 12:52:30 +0100 | [diff] [blame] | 43 | |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 44 | ```python |
| 45 | sudo ./run_scapy |
| 46 | Welcome to Scapy |
| 47 | >>> p = IP(dst="github.com")/ICMP() |
| 48 | >>> r = sr1(p) |
| 49 | Begin emission: |
| 50 | .Finished to send 1 packets. |
| 51 | * |
| 52 | Received 2 packets, got 1 answers, remaining 0 packets |
| 53 | >>> r[IP].src |
| 54 | '192.30.253.113' |
| 55 | ``` |
Pierre LALET | 064203b | 2016-01-12 11:36:39 +0100 | [diff] [blame] | 56 | |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 57 | ### Python module ### |
| 58 | |
| 59 | It is straightforward to use Scapy as a regular Python module, for example to |
| 60 | check if a TCP port is opened. First, save the following code in a file names |
| 61 | `send_tcp_syn.py` |
| 62 | |
| 63 | ```python |
| 64 | from scapy.all import * |
| 65 | conf.verb = 0 |
| 66 | |
| 67 | p = IP(dst="github.com")/TCP() |
| 68 | r = sr1(p) |
johnthagen | 69cc321 | 2018-01-17 22:01:19 -0500 | [diff] [blame] | 69 | print(r.summary()) |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 70 | ``` |
| 71 | |
| 72 | Then, launch the script with: |
| 73 | ```python |
| 74 | sudo python send_tcp_syn.py |
| 75 | IP / TCP 192.30.253.113:http > 192.168.46.10:ftp_data SA / Padding |
| 76 | ``` |
| 77 | |
Guillaume Valadon | 7ccb925 | 2018-01-10 07:55:05 +0100 | [diff] [blame] | 78 | ### Resources ### |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 79 | |
| 80 | To begin with Scapy, you should check [the notebook |
| 81 | hands-on](doc/notebooks/Scapy%20in%2015%20minutes.ipynb) and the [interactive |
| 82 | tutorial](http://scapy.readthedocs.io/en/latest/usage.html#interactive-tutorial). |
| 83 | If you want to learn more, see [the quick demo: an interactive |
| 84 | session](http://scapy.readthedocs.io/en/latest/introduction.html#quick-demo) |
| 85 | (some examples may be outdated), or play with the |
| 86 | [HTTP/2](doc/notebooks/HTTP_2_Tuto.ipynb) and [TLS](doc/notebooks/tls) |
| 87 | notebooks. |
| 88 | |
Guillaume Valadon | 7ccb925 | 2018-01-10 07:55:05 +0100 | [diff] [blame] | 89 | The [documentation](http://scapy.readthedocs.io/en/latest/) contains more |
| 90 | advanced use cases, and examples. |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 91 | |
| 92 | ## Installation ## |
| 93 | |
| 94 | Scapy works without any external Python modules on Linux and BSD like operating |
| 95 | systems. On Windows, you need to install some mandatory dependencies as |
| 96 | described in [the |
| 97 | documentation](http://scapy.readthedocs.io/en/latest/installation.html#windows). |
| 98 | |
| 99 | On most systems, using Scapy is as simple as running the following commands: |
| 100 | ``` |
| 101 | git clone https://github.com/secdev/scapy |
| 102 | cd scapy |
| 103 | ./run_scapy |
| 104 | >>> |
| 105 | ``` |
| 106 | |
| 107 | To benefit from all Scapy features, such as plotting, you might want to install |
| 108 | Python modules, such as `matplotlib` or `cryptography`. See the |
| 109 | [documentation](http://scapy.readthedocs.io/en/latest/installation.html) and |
| 110 | follow the instructions to install them. |
| 111 | |
Guillaume Valadon | 9c789b3 | 2017-09-11 16:39:26 +0200 | [diff] [blame] | 112 | ## Contributing ## |
Pierre LALET | af2a96b | 2016-02-09 13:38:04 +0100 | [diff] [blame] | 113 | |
| 114 | Want to contribute? Great! Please take a few minutes to |
| 115 | [read this](CONTRIBUTING.md)! |