1.DNS解析
#!/usr/bin/envpython
#coding=utf8
'''
数据包格式:
(<IPfrag=0 proto=udp src=192.168.1.61dst=202.96.209.5 |<UDPsport=domaindpo
rt=domain|<DNSid=1 qr=0 opcode=QUERY tc=0rd=1 qdcount=1 ancount=0 nscount=0
arcount=0qd=<DNSQRqname='www.qq.com' qtype=Aqclass=IN |> |>>>, <IPversion=
4L ihl=5L tos=0x0len=88 id=53905 flags=DF frag=0L ttl=248 proto=udp chksum=0x4e
b7 src=202.96.209.5dst=192.168.1.61 options=[] |<UDPsport=domain dport=domain
len=68 chksum=0x2652 |<DNSid=1 qr=1L opcode=QUERY aa=0L tc=0L rd=1Lra=1L z=0
L rcode=ok qdcount=1ancount=2 nscount=0 arcount=0 qd=<DNSQRqname='www.qq.com.
' qtype=A qclass=IN|> an=<DNSRRrrname='www.qq.com.'type=A rclass=IN ttl=265
rdata='101.226.103.106'|<DNSRRrrname='www.qq.com.' type=Arclass=IN ttl=265 r
data='101.226.129.158'|>> ns=None ar=None |>>>)
'''
from scapy.allimport *
def DnsQuery(sip):
ip_header=IP(src=sip,dst="202.96.209.5")
udp_header=UDP(dport=53)
dns_header=DNS(id=1,qr=0,opcode=0,tc=0,rd=1,qdcount=1,ancount=0,nscount=0,arcount=0)#构造标准的DNS数据包
dns_header.qd=DNSQR(qname="www.qq.com",qtype=1,qclass=1)#构造DNS资源记录
packet=ip_header/udp_header/dns_header
ans,unans=sr(packet,timeout=1,verbose=0)
type_dict={1:'A',5:'CNAME'}
#print ans[0]
for s,r in ans:
print "Received_IP:%s"%(r[IP].dst)
print "Query Domain:%s"%(r[DNS].qd.qname)
print "%s\t%s"%("Type","IP(Domain)")
print "-"*30
for i in xrange(15):
try:
print "%s\t%s"%(type_dict[r[DNS].an[i].type],r[DNS].an[i].rdata)
except:
pass
print "*"*30
for x in [61]:
ip="192.168.1."+str(x)
#print ip
DnsQuery(ip)
2.Scan Syn扫描
#!/usr/bin/envpython
#coding=utf8
'''
数据包格式:
(<IPfrag=0 proto=tcp dst=192.168.1.1|<TCPsport=16334 dport=tcpmuxflags=S |
>>,<IPversion=4L ihl=5L tos=0x0 len=40id=19281 flags= frag=0L ttl=255 proto=
tcp chksum=0xe4efsrc=192.168.1.1 dst=192.168.1.61 options=[] |<TCPsport=tcpmu
x dport=16334 seq=0ack=1 dataofs=5L reserved=0L flags=RA window=0 chksum=0xe471
urgptr=0 |<Paddingload='\x00\x00\x00\x00\x00\x00'|>>>)
'''
from scapy.allimport *
#ans,unans=sr(IP(dst="192.168.1.1")/TCP(dport=[23],flags="S"),timeout=2,verbose=0)
ans,unans=sr(IP(dst="192.168.1.1")/TCP(sport=RandShort(),dport=(1,1024),flags="S"),timeout=2,verbose=0)#发送SYN包
status_dict={18:'open',20:'closed'}
#print ans[0]
for s,r in ans:
sport,flags=r[TCP].sport,status_dict[r[TCP].flags]#获取返回的数据包源端口和响应状态,是ACK＋SYN，还是RST+ACK,若是ACK+SYN则是open,否则是closed
if flags!="closed":
print "{0}{1}".format(sport,flags)
3.arp扫描，获取存活主机的Mac
#!/usr/bin/envpython
#coding=utf8
'''
数据包格式
[(<Etherdst=ff:ff:ff:ff:ff:ff type=0x806|<ARPpdst=192.168.1.1 |>>,
<Etherdst=00:0c:29:a4:0c:45 src=00:18:b9:00:50:bftype=0x806 |<ARPhwtype=0x1pxype=0x800 hwlen=6 plen=4 op=is-at hwsrc=00:18:b9:00:50:bf psrc=192.168.1.1hwdst=00:0c:29:a4:0c:45 pdst=192.168.1.61 |<Paddingload='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'|>>>)]
'''
from scapy.allimport *
ans,unans=srp(Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst="192.168.1.0/24"),timeout=2,verbose=0)
#print ans[0]#打印接收到的第1个包
for s,r in ans:#递归每一个包(包中包含发送与接收包),s发送包,r接收包
print r[Ether].src,r[ARP].psrc#打印MAC＝>IP
如果想了解更多，请关注我们的公众号
公众号ID:opdevos
扫码关注
