Summary

This page covers a script that will use Scapy to monitor wireless networks, clients, and access points nearby, and create an output similar to airodump-ng.

This will introduce the reader to some basic, but essential, techniques for using Python to manipulate the wireless hardware alongside calls to the Scapy library.

The Script

In this article we will cover the following script:

!/usr/bin/env python

import logging logging.getLogger("scapy.runtime").setLevel(logging.ERROR) # Shut up Scapy from scapy.all import * conf.verb = 0 # Scapy I thought I told you to shut up import os import sys import time from threading import Thread, Lock from subprocess import Popen, PIPE from signal import SIGINT, signal import argparse import socket import struct import fcntl

Console colors

W = '\033[0m' # white (normal) R = '\033[31m' # red G = '\033[32m' # green O = '\033[33m' # orange B = '\033[34m' # blue P = '\033[35m' # purple C = '\033[36m' # cyan GR = '\033[37m' # gray T = '\033[93m' # tan

def parse_args(): #Create the arguments

   parser = argparse.ArgumentParser()

   parser.add_argument("-i", "--interface", help="Choose monitor mode interface. By default script will find the most powerful interface and starts monitor mode on it. Example: -i mon5")
   parser.add_argument("-c", "--channel", help="Listen on and deauth only clients on the specified channel. Example: -c 6")
   parser.add_argument("-m", "--maximum", help="Choose the maximum number of clients to deauth. List of clients will be emptied and repopulated after hitting the limit. Example: -m 5")
   parser.add_argument("-n", "--noupdate", help="Do not clear the deauth list when the maximum (-m) number of client/AP combos is reached. Must be used in conjunction with -m. Example: -m 10 -n", action='store_true')
   parser.add_argument("-t", "--timeinterval", help="Choose the time interval between packets being sent. Default is as fast as possible. If you see scapy errors like 'no buffer space' try: -t .00001")
   parser.add_argument("-p", "--packets", help="Choose the number of packets to send in each deauth burst. Default value is 1; 1 packet to the client and 1 packet to the AP. Send 2 deauth packets to the client and 2 deauth packets to the AP: -p 2")
   parser.add_argument("-d", "--directedonly", help="Skip the deauthentication packets to the broadcast address of the access points and only send them to client/AP pairs", action='store_true')
   parser.add_argument("-a", "--accesspoint", help="Enter the MAC address of a specific access point to target")
   parser.add_argument("--world", help="N. American standard is 11 channels but the rest of the world it's 13 so this options enables the scanning of 13 channels", action="store_true")

   return parser.parse_args()

Begin interface settings

def get_mon_iface(args):

   global monitor_on
   monitors, interfaces = iwconfig()
   if args.interface:
       monitor_on = True
       return args.interface
   if len(monitors) > 0:
       monitor_on = True
       return monitors[0]
   else:
       # Start monitor mode on a wireless interface
       print '['+G+'*'+W+'] Finding the most powerful interface...'
       interface = get_iface(interfaces)
       monmode = start_mon_mode(interface)
       return monmode

def iwconfig():

   monitors = []
   interfaces = {}
   try:
       proc = Popen(['iwconfig'], stdout=PIPE, stderr=DN)
   except OSError:
       sys.exit('['+R+'-'+W+'] Could not execute "iwconfig"')
   for line in proc.communicate()[0].split('\n'):
       if len(line) == 0: continue # Isn't an empty string
       if line[0] != ' ': # Doesn't start with space
           wired_search = re.search('eth[0-9]

Scapy/Airodump Clone

From charlesreid1

Summary

The Script